A Deep Learning-Based Multi-Level Prediction Approach for Intrusion Detection Enhancement on Imbalanced and Overlapped Datasets

With the rapid progress of the Internet and communication technologies, particularly the Internet of Things, the risk of cyberattacks has also increased. As a result, network security has become a significant research topic in the last decade. The intrusion detection system (IDS) is an efficient security tool for investigating the network traffic. Among techniques for constructing it, deep learning (DL) models are the most widely used. However, the available datasets for developing IDSs are inherently imbalanced. Additionally, some datasets also suffer from the class overlap phenomenon. The partial imbalance with low overlap between some classes limits the full potential of these classifiers. Nevertheless, the high degree of imbalance and overlap between the classes drastically decreases their performance. Therefore, further solutions must be explored when constructing the IDS on highly imbalanced and overlapped datasets. In this paper, we propose a DL-based multi-level IDS that introduces a trade-off between performance and specificity at each level. Initially, each group of overlapped classes is aggregated into a single class at the first level. Then, they are further specified in the subsequent levels. In addition, the class weight is utilized with each model for better balance. We evaluated the efficiency of the proposed approach on the UNSW-NB15, achieving 88.96%, 82.48%, and 80.78% accuracy with four, seven, and ten output classes at each level, respectively.