Tomek Links and Random Undersampling for Infiltration Attack Detection in Imbalanced CSE-CIC-IDS2018 Dataset

Abstract

Several previous studies have used the CSE-CIC-IDS2018 dataset to develop intrusion detection systems (IDSs) with advanced models, such as long short-term memory (LSTM). However, these studies underscore the imbalance in the dataset, where the 'Benign' label is much more common than some attack labels, such as 'Infiltration'. This study aims to build and improve a model for detecting infiltration attacks using the CSE-CIC-IDS2018 dataset. The first step after obtaining the dataset is preprocessing, which involves applying a label encoder, performing principal component analysis (PCA) for dimension reduction, and normalizing the features. The next step is to apply undersampling and use the LSTM as a prediction model. We mitigate imbalance in the dataset by combining several undersampling methods, including Tomek links and random undersampling (RUS). Finally, receiver operating characteristic (ROC), area under the curve (AUC), and g-mean methods optimize the threshold for each prediction method. The test results show that PCA can improve the efficiency of the LSTM model, with the LSTM + PCA model being 1.7× smaller and 1.1x faster. Then Tomek links + RUS is proven to provide the best sensitivity and G-mean compared to the base model, namely 0.73 and 0.80, respectively. Finally, threshold optimization using the ROC curve further enhances the model's predictive performance, increasing its sensitivity to 0.82.