네트워크 침입탐지에서 데이터 불균형을 고려한 균형 랜덤포레스트의 효과 : NSL-KDD 데이터셋을 중심으로
Effects of Balanced Random Forest Considering Data Imbalance in Network Intrusion Detection: Focusing on NSL-KDD Dataset
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
As a way to respond to external intrusion threats due to the increase in Internet use, research on machine learning methods for network intrusion detection is active. However, the random forester method for intrusion detection has a data imbalance problem caused by minority classes. In general classification, including network intrusion detection, it is often aimed at the accuracy of the entire model rather than problems caused by such minority classes. So, it is not easy to deal with data imbalance. In this paper, we try to show the data imbalance problem in the basic random forest(RF) model used in network intrusion detection, and present the application and effects of balanced random forest(BRF). RF and BRF models were made up using the well-known KDDTrain+ data and evaluated with KDDTest+ data. The difference in the performance of RF and BRF was the tendency for BRF to have higher recall and lower accuracy compared to RF in intrusion types included in minority classes. Despite the decrease in accuracy, this effect of BRF can be expected to reduce serious damage by detecting intrusion types with high probabilities.
Abstract
As a way to respond to external intrusion threats due to the increase in Internet use, research on machine learning methods for network intrusion detection is active. However, the random forester method for intrusion detection has a data imbalance problem caused by minority classes. In general classification, including network intrusion detection, it is often aimed at the accuracy of the entire model rather than problems caused by such minority classes. So, it is not easy to deal with data imbalance. In this paper, we try to show the data imbalance problem in the basic random forest(RF) model used in network intrusion detection, and present the application and effects of balanced random forest(BRF). RF and BRF models were made up using the well-known KDDTrain+ data and evaluated with KDDTest+ data. The difference in the performance of RF and BRF was the tendency for BRF to have higher recall and lower accuracy compared to RF in intrusion types included in minority classes. Despite the decrease in accuracy, this effect of BRF can be expected to reduce serious damage by detecting intrusion types with high probabilities.
참고문헌 (24)
- Yin, C., "A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks", IEEE Access, 5, pp.21954~21961 (2017)
- Amiri, F., "Mutual Information Based Feature Selection for Intrusion Detection Systems", Journal of Network And Computer Applications, 34(4), pp.1184~1199 (2011)
- Zhou, Y., "Building An Efficient Intrusion Detection System Based on Feature Selection And Ensemble Classifier", Computer Network, 174, pp.107247~ (2020)
- Chebrolu, S., "Feature Deduction And Ensemble Design of Intrusion Detection Systems", Computer Security, 24(4), pp.295~307 (2005)
- Farnaaz, N., "Random Forest Modeling for Network Intrusion Detection System", Procedia Computer Science, 89, pp.213~217 (2016)
- Zorarpaci, E., "A Fast Intrusion Detection System Based on Swift Wrapper Feature Selection And Speedy Ensemble Classifier", Engineering Applications of Artificial Intelligence, 133, pp.108162~ (2024)
- Using Random Forest to Learn Imbalanced Data, "Chen, C.", Department of Statistics, ~, pp.Technical Report 666 (2004)
- Breiman, L., "Random forest", Machine Learning, 45, pp.5~32 (2001)
- Ho, T. K., "The Random Subspace Method for Constructing Decision Forests", IEEE Trans. Pattern Anal. Mach. Intel, 20(8), pp.832~844 (1998)
- Hajisalem, V., "A Hybrid Intrusion Detection System Based on ABC-AFS Algorithm for Misuse and Anomaly Detection", Computer Network, 136, pp.37~50 (2018)
- Joldzic, O., "A Transparent And Scalable Anomaly-Based DoS Detection Method", Computer Network, 104, pp.27~42 (2016)
- 권현, "딥뉴럴네트워크 기반의 네트워크 침입탐지시스템 설계", 한국차세대컴퓨팅학회 논문지, 16(1), pp.7~18 (2020)
- Silivery, A. K., "A Model for Multi-Attack Classification to Improve Intrusion Detection Performance Using Deep Learning Approaches", Measurement : Sensors, 30, pp.100924~ (2023)
- Sun, Z., "An Improved Random Forest Based on The Classification Accuracy and Correlation Measurement of Decision Trees", Expert Systems With Applications, 237, pp.121549~ (2024)
- Vibhute, A. D., "Towards Detection of Network Anomalies Using Machine Learning Algorithms on The NSL-KDD Benchmark Datasets", Procedia Computer Science, 233, pp.960~969 (2024)
- Khalilia, M., "Predicting Disease Risks from Highly Imbalanced Data Using Random Forest", BMC Med. Informat. Decis. Making, 11(1), pp.51~ (2011)
- Strobl, C., "Bias in Random Forest Variable Importance Measures: Illustrations, Sources And A Solution", BMC Bioinformat, 8(1), pp.25~ (2007)
- "NSL-KDD" (2024)[URL]
- Chawla, N. V., "SMOTEboost: Improving Prediction of The Minority Class in Boosting", Proceedings of The 7th European Conference on Principles and Practice of Knowledge Discovery in Databases, pp.107~119 (2003)
- Domingos, P., "Metacost: A General Method for Making Classifiers Cost-Sensitive", Proceedings of The 5th ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp.155~164 (1999)
- Kubat, M., "Machine Learning for The Detection of Oil Spills in Satellite Radar Images", Machine Learning, 30, pp.195~215 (1998)
- Sahli, Y., "A Comparison of The NSL-KDD Dataset And Its Predecessor The KDD Cup ’99 Dataset", International Journal of Scientific Research and Management, 10(1), pp.832~839 (2022)
- Aggarwal, P., "Analysis of KDD Dataset Attributes : Class Wise for Intrusions Detection", Procedia Computer Science, 57, pp.842~851 (2015)
- Tavallaee, M., "A Detailed Analysis of The KDD CUP '99 Dataset", Proceedings of the 2'nd IEEE int’l conf. on CISDA'09, pp.53~58 (2009)