CLASSIFICATION OF NETWORK ATTACKS USING MACHINE LEARNING METHODS IN CONDITIONS OF TRAINING DATA IMBALANCE

Abstract

The object of the research is the process of detecting network intrusions. The subject of the research is methods for classifying network intrusions. The aim of the research is to improve the quality and speed of ensemble classifiers in network intrusion classification problems under conditions of imbalance in training data. Methods used: machine learning methods, data preprocessing methods, ensemble classifiers, rebalancing method by synthetic minority augmentation. Results obtained: the effectiveness of using various approaches for classifying network intrusions under conditions of class imbalance in the training sample was investigated. A comprehensive approach was proposed, which involves preprocessing data using the SMOTE method for synthetic balancing of the training sample, as well as its subsequent analysis using ensemble machine learning models, which made it possible to improve the classification performance of minority classes. The best results were obtained when combining SMOTE with ensemble models, in particular Bagging, Gradient Boosting and AdaBoost. Conclusions. Based on the results of the study, an improved approach to network traffic classification was proposed, which combines pre-sampling by the SMOTE method with ensemble algorithms bagging and boosting. The combined use of these methods allowed to improve the value of the Recall metric for minority classes. Overall, the proposed approach provided an improvement in the classification quality: 18% for the Infiltration attack, 33% for the SQL Injection attack and up to 53% for the XSS attack compared to basic machine learning models without additional rebalancing of input data.