NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation

Yuhan Suo; Rui Wang; Senchun Chai; Runqi Chai; Mengwei Su

doi:10.1007/978-981-99-0617-8_10

NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation

Yuhan Suo, Rui Wang, Senchun Chai^*, Runqi Chai, Mengwei Su

^*Corresponding author for this work

School of Automation

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

3 Citations (Scopus)

Abstract

This paper mainly studies the problem of sample generation for imbalanced intrusion datasets. The NKB-SMOTE algorithm is proposed based on the SMOTE algorithm by combining the K-means algorithm and using a mixture of oversampling and undersampling methods. The Synthetic Minority Oversampling (SMOTE) Technique sample generation is performed on the minority class samples in the boundary cluster, the Tomek links method is used for the majority class samples in the boundary cluster to undersample the boundary cluster, and the NearMiss-2 method is used to undersample the overall data. Then, multi-classification experiments are conducted on the UNSW-NB15 dataset, and the results show that the proposed NKB-SMOTE algorithm can improve the generation quality of samples and alleviate the fuzzy class boundary problem compared with the traditional SMOTE algorithm. Finally, the actual experiment also verifies the effectiveness of the intrusion detection model based on NKB-SMOTE in real scenarios.

Original language	English
Title of host publication	Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers
Editors	Fuchun Sun, Angelo Cangelosi, Jianwei Zhang, Yuanlong Yu, Huaping Liu, Bin Fang
Publisher	Springer Science and Business Media Deutschland GmbH
Pages	130-147
Number of pages	18
ISBN (Print)	9789819906161
DOIs	https://doi.org/10.1007/978-981-99-0617-8_10
Publication status	Published - 2023
Event	7th International Conference on Cognitive Systems and Information Processing, ICCSIP 2022 - Fuzhou, China Duration: 17 Dec 2022 → 18 Dec 2022

Publication series

Name	Communications in Computer and Information Science
Volume	1787 CCIS
ISSN (Print)	1865-0929
ISSN (Electronic)	1865-0937

Conference

Conference	7th International Conference on Cognitive Systems and Information Processing, ICCSIP 2022
Country/Territory	China
City	Fuzhou
Period	17/12/22 → 18/12/22

Keywords

Intrusion detection
Machine learning
NBK-SMOTE
Network security
Sample generation

Access to Document

10.1007/978-981-99-0617-8_10

Cite this

Suo, Y., Wang, R., Chai, S., Chai, R., & Su, M. (2023). NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation. In F. Sun, A. Cangelosi, J. Zhang, Y. Yu, H. Liu, & B. Fang (Eds.), Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers (pp. 130-147). (Communications in Computer and Information Science; Vol. 1787 CCIS). Springer Science and Business Media Deutschland GmbH. https://doi.org/10.1007/978-981-99-0617-8_10

Suo, Yuhan ; Wang, Rui ; Chai, Senchun et al. / NKB-S : Network Intrusion Detection Based on SMOTE Sample Generation. Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers. editor / Fuchun Sun ; Angelo Cangelosi ; Jianwei Zhang ; Yuanlong Yu ; Huaping Liu ; Bin Fang. Springer Science and Business Media Deutschland GmbH, 2023. pp. 130-147 (Communications in Computer and Information Science).

@inproceedings{ac4a3b21452a4cf8a572e8b4e75b1d0c,

title = "NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation",

abstract = "This paper mainly studies the problem of sample generation for imbalanced intrusion datasets. The NKB-SMOTE algorithm is proposed based on the SMOTE algorithm by combining the K-means algorithm and using a mixture of oversampling and undersampling methods. The Synthetic Minority Oversampling (SMOTE) Technique sample generation is performed on the minority class samples in the boundary cluster, the Tomek links method is used for the majority class samples in the boundary cluster to undersample the boundary cluster, and the NearMiss-2 method is used to undersample the overall data. Then, multi-classification experiments are conducted on the UNSW-NB15 dataset, and the results show that the proposed NKB-SMOTE algorithm can improve the generation quality of samples and alleviate the fuzzy class boundary problem compared with the traditional SMOTE algorithm. Finally, the actual experiment also verifies the effectiveness of the intrusion detection model based on NKB-SMOTE in real scenarios.",

keywords = "Intrusion detection, Machine learning, NBK-SMOTE, Network security, Sample generation",

author = "Yuhan Suo and Rui Wang and Senchun Chai and Runqi Chai and Mengwei Su",

note = "Publisher Copyright: {\textcopyright} 2023, The Author(s), under exclusive license to Springer Nature Singapore Pte Ltd.; 7th International Conference on Cognitive Systems and Information Processing, ICCSIP 2022 ; Conference date: 17-12-2022 Through 18-12-2022",

year = "2023",

doi = "10.1007/978-981-99-0617-8_10",

language = "English",

isbn = "9789819906161",

series = "Communications in Computer and Information Science",

publisher = "Springer Science and Business Media Deutschland GmbH",

pages = "130--147",

editor = "Fuchun Sun and Angelo Cangelosi and Jianwei Zhang and Yuanlong Yu and Huaping Liu and Bin Fang",

booktitle = "Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers",

address = "Germany",

}

Suo, Y, Wang, R, Chai, S, Chai, R & Su, M 2023, NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation. in F Sun, A Cangelosi, J Zhang, Y Yu, H Liu & B Fang (eds), Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers. Communications in Computer and Information Science, vol. 1787 CCIS, Springer Science and Business Media Deutschland GmbH, pp. 130-147, 7th International Conference on Cognitive Systems and Information Processing, ICCSIP 2022, Fuzhou, China, 17/12/22. https://doi.org/10.1007/978-981-99-0617-8_10

NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation. / Suo, Yuhan; Wang, Rui; Chai, Senchun et al.
Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers. ed. / Fuchun Sun; Angelo Cangelosi; Jianwei Zhang; Yuanlong Yu; Huaping Liu; Bin Fang. Springer Science and Business Media Deutschland GmbH, 2023. p. 130-147 (Communications in Computer and Information Science; Vol. 1787 CCIS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

TY - GEN

T1 - NKB-S

T2 - 7th International Conference on Cognitive Systems and Information Processing, ICCSIP 2022

AU - Suo, Yuhan

AU - Wang, Rui

AU - Chai, Senchun

AU - Chai, Runqi

AU - Su, Mengwei

PY - 2023

Y1 - 2023

N2 - This paper mainly studies the problem of sample generation for imbalanced intrusion datasets. The NKB-SMOTE algorithm is proposed based on the SMOTE algorithm by combining the K-means algorithm and using a mixture of oversampling and undersampling methods. The Synthetic Minority Oversampling (SMOTE) Technique sample generation is performed on the minority class samples in the boundary cluster, the Tomek links method is used for the majority class samples in the boundary cluster to undersample the boundary cluster, and the NearMiss-2 method is used to undersample the overall data. Then, multi-classification experiments are conducted on the UNSW-NB15 dataset, and the results show that the proposed NKB-SMOTE algorithm can improve the generation quality of samples and alleviate the fuzzy class boundary problem compared with the traditional SMOTE algorithm. Finally, the actual experiment also verifies the effectiveness of the intrusion detection model based on NKB-SMOTE in real scenarios.

AB - This paper mainly studies the problem of sample generation for imbalanced intrusion datasets. The NKB-SMOTE algorithm is proposed based on the SMOTE algorithm by combining the K-means algorithm and using a mixture of oversampling and undersampling methods. The Synthetic Minority Oversampling (SMOTE) Technique sample generation is performed on the minority class samples in the boundary cluster, the Tomek links method is used for the majority class samples in the boundary cluster to undersample the boundary cluster, and the NearMiss-2 method is used to undersample the overall data. Then, multi-classification experiments are conducted on the UNSW-NB15 dataset, and the results show that the proposed NKB-SMOTE algorithm can improve the generation quality of samples and alleviate the fuzzy class boundary problem compared with the traditional SMOTE algorithm. Finally, the actual experiment also verifies the effectiveness of the intrusion detection model based on NKB-SMOTE in real scenarios.

KW - Intrusion detection

KW - Machine learning

KW - NBK-SMOTE

KW - Network security

KW - Sample generation

UR - http://www.scopus.com/inward/record.url?scp=85149871062&partnerID=8YFLogxK

U2 - 10.1007/978-981-99-0617-8_10

DO - 10.1007/978-981-99-0617-8_10

M3 - Conference contribution

AN - SCOPUS:85149871062

SN - 9789819906161

T3 - Communications in Computer and Information Science

SP - 130

EP - 147

BT - Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers

A2 - Sun, Fuchun

A2 - Cangelosi, Angelo

A2 - Zhang, Jianwei

A2 - Yu, Yuanlong

A2 - Liu, Huaping

A2 - Fang, Bin

PB - Springer Science and Business Media Deutschland GmbH

Y2 - 17 December 2022 through 18 December 2022

ER -

Suo Y, Wang R, Chai S, Chai R, Su M. NKB-S: Network Intrusion Detection Based on SMOTE Sample Generation. In Sun F, Cangelosi A, Zhang J, Yu Y, Liu H, Fang B, editors, Cognitive Systems and Information Processing - 7th International Conference, ICCSIP 2022, Revised Selected Papers. Springer Science and Business Media Deutschland GmbH. 2023. p. 130-147. (Communications in Computer and Information Science). doi: 10.1007/978-981-99-0617-8_10