Improving Network Attack Classification on Imbalanced Real-world Intrusion Incident Datasets

In real-world datasets, the volume of collected data varies according to the characteristics of each attack type, resulting in class-imbalanced datasets. This class imbalance impacts attack type classifier performance by causing mispredictions of minority attack types, leading to unreliable detection of less common, yet more harmful, intrusions. To address this issue, we propose a two-step pair selection strategy to enhance contrastive learning (CL) in the realistic network traffic environment. We evaluate the proposed solution using datasets collected by the Korea Internet Security Agency (KISA) based on real-world cybersecurity incidents.