Enhancing Firewall Packet Classification through Artificial Neural Networks and Synthetic Minority Over-Sampling Technique: An Innovative Approach with Evaluative Comparison

• Published in: Applied sciences Vol. 14; no. 16; p. 7426
• Main Authors: Korkmaz, Adem, Bulut, Selma, Talan, Tarık, Kosunalp, Selahattin, Iliev, Teodor
• Format: Journal Article
• Language: English
• Published: Basel MDPI AG 01.08.2024
• Subjects: Accuracy; Algorithms; Artificial intelligence; artificial neural networks; Big Data; Classification; Cybersecurity; Deep learning; Denial of service attacks; firewall packet classification; Firewalls; imbalanced data; Machine learning; Methods; network security; Neural networks; Safety and security measures; Sampling techniques; Security systems; SMOTE; Germany
• ISSN: 2076-3417; 2076-3417
• DOI: 10.3390/app14167426

Firewall packet classification is a critical component of network security, demanding precise and reliable methods to ensure optimal functionality. This study introduces an advanced approach that combines Artificial Neural Networks (ANNs) with various data balancing techniques, including the Synthetic Minority Over-sampling Technique (SMOTE), ADASYN, and BorderlineSMOTE, to enhance the classification of firewall packets into four distinct classes: ‘allow’, ‘deny’, ‘drop’, and ‘reset-both’. Initial experiments without data balancing revealed that while the ANN model achieved perfect precision, recall, and F1-Scores for the ‘allow’, ‘deny’, and ‘drop’ classes, it struggled to accurately classify the ‘reset-both’ class. To address this, we applied SMOTE, ADASYN, and BorderlineSMOTE to mitigate class imbalance, which led to significant improvements in overall classification performance. Among the techniques, the ANN combined with BorderlineSMOTE demonstrated superior efficacy, achieving a 97% overall accuracy and consistently high performance across all classes, particularly in the accurate classification of minority classes. In contrast, while SMOTE and ADASYN also improved the model’s performance, the results with BorderlineSMOTE were notably more balanced and reliable. This study provides a comparative analysis with existing machine learning models, highlighting the effectiveness of the proposed approach in firewall packet classification. The synthesized results validate the potential of integrating ANNs with advanced data balancing techniques to enhance the robustness and reliability of network security systems. The findings underscore the importance of addressing class imbalance in machine learning models, particularly in security-critical applications, and offer valuable insights for the design and improvement of future network security infrastructures.