A multi-classification detection model for imbalanced data in NIDS based on reconstruction and feature matching

• Published in: Journal of cloud computing : advances, systems and applications Vol. 13; no. 1; pp. 31 - 13
• Main Authors: Yang, Yue, Cheng, Jieren, Liu, Zhaowu, Li, Huimin, Xu, Ganglou
• Format: Journal Article
• Language: English
• Published: Berlin/Heidelberg Springer Berlin Heidelberg 03.02.2024; Springer Nature B.V; SpringerOpen
• Subjects: Accuracy; Adaptive scaling; Classification; Computer Communication Networks; Computer Science; Computer System Implementation; Computer Systems Organization and Communication Networks; Edge computing; Feature matching; Information Systems Applications (incl.Internet); Intrusion detection; Matching; Mobile Edge Computing Meets AI; Model accuracy; Reconstruction; Software Engineering/Programming and Operating Systems; Special Purpose and Application-Based Systems; Training; Adaptive scaling; Feature matching; Intrusion detection; Edge computing
• ISSN: 2192-113X; 2192-113X
• DOI: 10.1186/s13677-023-00584-7

With the exponential growth of various data interactions on network systems, network intrusions are also increasing. The emergence of edge computing technology brings a new solution to network security. However, due to the difficulty of processing massive and unbalanced data at the edge, higher accuracy requirements are necessary for deployed detection models. This paper proposes a multi-classification model for network intrusion detection based on reconstruction and feature matching. This model can be deployed on small-scale edge nodes, effectively identifying various attack behaviors through the utilization of reconstruction errors and adaptive scaling. Furthermore, we proposed a model transfer method based on feature matching to enhance the training and detection efficiency of multi-classification models under different data distribution conditions. The proposed model has been evaluated on the CICIDS2017 dataset in terms of accuracy, recall, precision and F1 score. The model demonstrates high accuracy for normal flows in the network, majority class attacks, and minority class attacks, achieving an overall multi-class accuracy of 99.81%, outperforming similar models. Furthermore, this model demonstrates faster convergence and training speed after feature matching, exhibiting better robustness and outstanding performance at the edge.