ADASYN-Random Forest Based Intrusion Detection Model

TL;DR

This paper proposes an intrusion detection model combining ADASYN data balancing with Random Forest classification, significantly improving detection accuracy and robustness on imbalanced cybersecurity datasets.

Contribution

The study introduces a novel combination of ADASYN sampling and Random Forest for intrusion detection, enhancing performance on imbalanced datasets.

Findings

Improved precision, recall, F1 scores, and AUC after applying ADASYN.

Effective detection of network attacks with large, imbalanced datasets.

Better performance and robustness compared to traditional models.

Abstract

Intrusion detection has been a key topic in the field of cyber security, and the common network threats nowadays have the characteristics of varieties and variation. Considering the serious imbalance of intrusion detection datasets will result in low classification performance on attack behaviors of small sample size and difficulty to detect network attacks accurately and efficiently, using Adaptive Synthetic Sampling (ADASYN) method to balance datasets was proposed in this paper. In addition, Random Forest algorithm was used to train intrusion detection classifiers. Through the comparative experiment of Intrusion detection on CICIDS 2017 dataset, it is found that ADASYN with Random Forest performs better. Based on the experimental results, the improvement of precision, recall, F1 scores and AUC values after ADASYN is then analyzed. Experiments show that the proposed method can be applied to intrusion detection with large data, and can effectively improve the classification accuracy of network attack behaviors. Compared with traditional machine learning models, it has better performance, generalization ability and robustness.