Network Traffic Augmentation Algorithm in the Problem of Network Attacks Detection in Mixed Networks

This article addresses network attack detection in mixed networks, focusing on improving accuracy against challenges like class imbalance and varying network architectures typical for mixed networks. The literature review highlights the lack of validation of augmented data in similar solutions as a major problem. Thus, a novel data augmentation algorithm is proposed, based on Synthetic Minority Oversampling Technique with validation functions (Kolmogorov-Smirnov test and ROC AUC evaluation) for fine- tuning hyperparameters. The fine-tuning process includes two main stages: initialization of coefficients a<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</inf>, a<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf>, b<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</inf> and b<inf xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2</inf>, which are used during next stage; the stage of changing the values of hyperparameters over n iterations (where n equal 5 by default). Experimental results using the CICIDS2017 dataset show an increase in detection accuracy from 0.799 to 0.917 (F1-score). Random Forest machine learning model was used during evaluation of network attack detection. The proposed method demonstrates adaptability to diverse network traffic and effectiveness in mitigating class imbalance. Future work aims to develop advanced augmentation and detection methods to enhance total detection accuracy.