Abordagens para o problema do desbalanceamento em detecção de intrusão: um estudo de caso aplicando CIC-IDS2018

Abstract

The exponential growth of digital technologies and the Internet has been accompanied by an alarming increase in cybercrimes. This scenario has motivated the intensification of investments in cybersecurity. Furthermore, studies on the topic are also constantly evolving. Within this context, this work consists of an intrusion detection method that addresses the problems associated with the imbalance present in the CIC-IDS2018 dataset, through pre-processing and model training techniques. The method addresses the combined use of undersampling and oversampling techniques along with weights for cost-sensitive training. With the approach used to address the imbalance, it was possible to provide an improvement in the macro average of the models’ AUC from 92.0% to 98.2%. Additionally, the WebAttack minority class demonstrated an AUC increase from 56.2% to 99.6%. Finally, the mean accuracy obtained was 95.4%, approaching the results of related works. The experiments conducted show that the proposed approach can improve performance on intrusion detection and identification, especially in minority classes, without significantly compromising the overall performance.