A two-stage intrusion detection method based on light gradient boosting machine and autoencoder.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Intrusion detection systems (IDS) face challenges from high dimensionality and zero-day attacks, reducing efficiency.
• The curse of dimensionality and increasing sophisticated attacks like zero-day exploits overwhelm traditional IDS.
• Effective intrusion detection is crucial for protecting network infrastructure from evolving threats.

Purpose of the Study:

• To propose a novel intrusion detection framework addressing dimensionality and zero-day attack challenges.
• To enhance the efficiency and accuracy of intrusion detection systems through advanced machine learning techniques.
• To validate the proposed framework's effectiveness against benchmark datasets and existing methods.

Main Methods:

• Implemented a framework combining LightGBM (Light Gradient Boosting Machine) and autoencoders for intrusion detection.
• Utilized Recursive Feature Elimination (RFE) for dimensionality reduction.
• Incorporated a focal loss (FL) function into LightGBM for improved learning of difficult samples.
• Employed a two-stage prediction strategy involving LightGBM and autoencoder analysis.

Main Results:

• The proposed framework demonstrated superior performance over classical methods on NSL-KDD and UNSWNB15 datasets.
• Achieved over 90% accuracy, recall, and F1 score on both datasets, validating its effectiveness.
• Significantly reduced time overhead compared to existing intrusion detection techniques.

Conclusions:

• The novel LightGBM and autoencoder-based framework effectively overcomes dimensionality and zero-day attack issues in intrusion detection.
• The proposed method offers a valid and superior alternative to current advanced intrusion detection techniques.
• This research contributes a more efficient and accurate solution for network security.