Attention-driven multi-model architecture for unbalanced network traffic intrusion detection via extreme gradient boosting

Abstract

• In order to address the security challenge inherent in the context of intrusion detection in imbalanced network traffic, this study proposed an Attention-Driven Multi-Model Architecture called CWFLAM-VAE integrated with Extreme Gradient Boosting (XGBoost) for Detecting Intrusions in Imbalance Network Traffic. While both techniques have been used individually in the context of intrusion detection, their combined application in this manner has not been previously explored which makes it a novel approach to tackling the problem of class imbalance in Network Intrusion Detection Systems (NIDS). • We designed a class-wise focal loss attention mechanism-based variational auto-encoder (CWFLAM-VAE) to tackle the issue of class imbalance. The attention mechanism makes it possible for the model to generate each element of the output sequence while concentrating on specific areas of the input sequence. The class-wise focal loss was designed to augment the underrepresented minority samples by allocating different weights to different classes, with a more specific focus on the rare samples. • We employed Extreme Gradient Boosting (XGBoost) to train the proposed framework's key features by enhancing the efficacy of the IDS by improving detection, while also diminishing the duration of both the training and overall detections time. • The effectiveness of the proposed IDS model was compared with baseline classifiers and data balancing techniques, as well as with the relevant state-of-the-art work, which depict that the proposed model offers better performance in the overall detection of intrusions of minority samples in an imbalanced network traffic. Network Intrusion Detection Systems (NIDS) face significant challenges in identifying rare attack instances due to the inherent class imbalance and diversity in network traffic. This imbalance, often characterized by a dominance of benign network traffic data, reduces the effectiveness of traditional detection methods. To address this, we proposed CWFLAM-VAE, an attention-driven multi-model architecture that combines Class-Wise Focal Loss, Variational Autoencoder, and Extreme Gradient Boosting. CWFLAM-VAE generates synthetic rare-class attack data while preserving the original feature distribution, mitigating imbalance and improving classification performance. The effectiveness of our proposed system was evaluated by employing two datasets, one of which is the NSL-KDD, which exhibits a skewed distribution of network traffic favoring the majority class, and CSE-CIC-IDS2018 dataset, where approximately 83 % of the data consists of benign network traffic. We compared our method with existing sampling techniques (SMOTE, ROS, ADASYN, RUS) and existing classifiers (Logistic Regression, KNN, SVM, Decision Tree, LSTM, CNN). The experimental findings distinctly reveal the efficacy of the CWFLAM-VAE in resolving class imbalance concerns, with Extreme Gradient Boosting surpassing alternative machine learning techniques particularly in the detection of rare instances of attack traffic with an f-score of 97.6 % and 98.1 %, as well as a false positive rate of 0.17 and 0.27 for both data respectively.

Topics & Concepts