Network Intrusion Detection Method Based on FCWGAN and BiLSTM

Area of Science:

• Cybersecurity
• Machine Learning
• Data Science

Background:

• Imbalanced datasets in intrusion detection systems (IDS) lead to biased models, high false positives, and false negatives.
• Existing methods struggle to effectively handle class imbalance, compromising network security analysis.
• Accurate network intrusion detection is crucial for protecting sensitive data and infrastructure.

Purpose of the Study:

• To propose a novel method for enhancing network intrusion detection models by addressing class imbalance.
• To improve the accuracy and effectiveness of intrusion detection systems.
• To reduce false-positive and false-negative rates in network traffic analysis.

Main Methods:

• A feature selection method using XGBoost and Spearman's correlation coefficient to identify and filter relevant features.
• A conditional Wasserstein generative adversarial network (CWGAN) to generate synthetic samples for dataset augmentation.
• A bidirectional long short-term memory (BiLSTM) network for model training and classification.

Main Results:

• The proposed feature selection-conditional Wasserstein generative adversarial network (FCWGAN) and BiLSTM model achieved high accuracy rates of 99.57% on the NSL-KDD dataset and 85.59% on the UNSW-NB15 dataset.
• The model demonstrated superior performance compared to a similar conditional WGAN and deep neural network (CWGAN-DNN) model, with accuracy improvements of 1.44% and 2.98%, respectively.
• The method effectively mitigates the impact of class imbalance, enhancing the detection capabilities of intrusion detection models.

Conclusions:

• The proposed FCWGAN-BiLSTM method offers a robust solution for improving network intrusion detection accuracy on imbalanced datasets.
• Feature selection and generative adversarial networks are effective in enhancing the performance of deep learning models for cybersecurity.
• This approach provides a significant advancement in building more reliable and effective network intrusion detection systems.