A fast network intrusion detection system using adaptive synthetic oversampling and LightGBM. Issue 106 (July 2021)

• Record Type: Journal Article
• Authors: Liu, Jingmei; Gao, Yuanbo; Hu, Fengjie
• Is Part Of: Computers & security. Issue 106(2021)
• Publication Date: 2021-07
• Subjects: Intrusion detection system -- Adaptive synthetic oversampling -- LightGBM -- Imbalanced data -- Ensemble learning; Computer security -- Periodicals; Electronic data processing departments -- Security measures -- Periodicals; 005.805
• DOI: 10.1016/j.cose.2021.102289
• Languages: English
• ISSNs: 0167-4048

Abstract

Abstract: Network intrusion detection systems play an important role in protecting the network from attacks. However, Existing network intrusion data is imbalanced, which makes it difficult to accurately detect minority attacks, and the training and detection time of deep neural network detection systems is relatively long. According to these problems, this paper proposes a network intrusion detection system based on adaptive synthetic (ADASYN) oversampling technology and LightGBM. First, we normalize and one-hot encode the original data through data preprocessing to avoid the impact of the maximum or minimum value on the overall characteristics. Second, we increase the minority samples by ADASYN oversampling technology to solve the problem of the low detection rate of minority attacks due to the imbalance of the training data. Finally, the LightGBM ensemble learning model is used to further reduce the time complexity of the system while ensuring the accuracy of detection. Through experimental verification on the NSL-KDD, UNSW-NB15 and CICIDS2017 data sets, the results show that the detection rate of minority samples can be improved after ADASYN oversampling, thereby improving the overall accuracy rate. The accuracy of the proposed algorithm is up to 92.57%, 89.56% and 99.91% respectively in the three test sets, and it consumes less time in the training and detection process, which is superior to other existing methods.