A novel intrusion detection method based on threshold modification using receiver operating characteristic curve. (21st February 2020)

• Record Type: Journal Article
• Authors: Luo, Jun; Chai, Senchun; Zhang, Baihai; Xia, Yuanqing; Gao, Jianlei; Zeng, Guoqiang
• Is Part Of: Concurrency and computation. Volume 32:Number 14(2020)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2020-02-21
• Subjects: class imbalance -- convolutional neural networks -- network intrusion detection -- receiver operating characteristic curve -- threshold modification; Parallel processing (Electronic computers) -- Periodicals; Parallel computers -- Periodicals; 004.35
• DOI: 10.1002/cpe.5690
• Languages: English
• ISSNs: 1532-0626

Abstract

Summary: Class imbalance makes traditional intrusion detection system have low detection rate (DR) and high false positive rate (FR) for minority class, which is unsuitable for practical needs. In order to improve the DRs and reduce FRs of minority classes, we propose a novel intrusion detection method, which combines convolutional neural networks (CNNs) algorithm with threshold modification method based on receiver operating characteristic (ROC) curve. In this method, we use CNNs as a classifier and modify threshold of the classifier through ROC curve. In addition, NSLKDD dataset and UNSW‐NB15 dataset have been carried out to evaluate the performance of this method. The experimental results illustrate that the proposed method has a better performance no matter in improving DRs or reducing FRs of minority classes.