Deep Learning-Based Intrusion Detection for Rare Class Network Attacks

With the continuous development of network technology, complex network systems generate massive unbalanced attack traffic. Due to the severe imbalance in the quantities of normal samples and attack samples, as well as among different types of attack samples, intrusion detection systems suffer from low detection rates for rare class attack data. In this paper, we propose a geometric synthetic minority oversampling technique based on optimized kernel density estimation algorithm. This method can generate diverse rare class attack data by learning the distribution of rare class attack data while maintaining similarity with the original sample features. Meanwhile, the balanced data is input to a feature extraction module built upon multiple denoising autoencoders, reducing information redundancy in high-dimensional data and improving the detection performance for unknown attacks. Subsequently, a soft voting ensemble learning technique is utilized for multi-class anomaly detection on the balanced and dimensionally reduced data. Finally, an intrusion detection system is constructed based on data preprocessing, imbalance handling, feature extraction, and anomaly detection modules, and validated on the NSL-KDD and N-BaIoT datasets. Comparative experiments with baseline models and other state-of-the-art methods demonstrate that the proposed system improves the detection rate of rare class attack data. Furthermore, it achieves a good overall detection rate on the Internet of Things dataset (N-BaIoT), indicating its strong applicability.