Sequential Binary Classification for Intrusion Detection

TL;DR

This paper introduces Sequential Binary Classification (SBC), a hierarchical method for improving intrusion detection systems by effectively managing class imbalance in multi-class classification tasks, demonstrated through experiments on benchmark datasets.

Contribution

The paper proposes a novel hierarchical SBC approach that structurally addresses class imbalance in IDS, differing from traditional data-driven techniques.

Findings

SBC effectively handles class imbalance in IDS datasets.

Experimental results show SBC outperforms standard ML models.

The approach is validated on benchmark IDS datasets.

Abstract

Network Intrusion Detection Systems (IDS) have become increasingly important as networks become more vulnerable to new and sophisticated attacks. Machine Learning (ML)-based IDS are increasingly seen as the most effective approach to handle this issue. However, IDS datasets suffer from high class imbalance, which impacts the performance of standard ML models. Different from existing data-driven techniques to handling class imbalance, this paper explores a structural approach to handling class imbalance in multi-class classification (MCC) problems. The proposed approach - Sequential Binary Classification (SBC), is a hierarchical cascade of (regular) binary classifiers. Experiments on benchmark IDS datasets demonstrate that the structural approach to handling class-imbalance, as exemplified by SBC, is a viable approach to handling the issue.