Adaptive TreeHive: Ensemble of trees for enhancing imbalanced intrusion classification.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Intrusion Detection

Background:

• Imbalanced intrusion classification presents challenges due to minority class instances.
• Traditional methods like over-sampling (SMOTE) and under-sampling have limitations such as overfitting and data loss.
• Ensemble learning methods (Random Forest, Bagging, Boosting) are used but can be improved for imbalanced data.

Purpose of the Study:

• To propose a novel method, Adaptive TreeHive, for selecting informative instances to address imbalanced intrusion data.
• To evaluate the performance of Adaptive TreeHive against traditional data balancing and ensemble methods.
• To reduce computational power and execution time requirements in intrusion detection systems.

Main Methods:

• Developed Adaptive TreeHive for selecting informative majority and minority instances.
• Applied over-sampling and under-sampling techniques in conjunction with informative instance selection.
• Utilized ensemble algorithms: Random Forest (C4.5 base), Bagging (Naïve Bayes base), and Boosting (AdaBoost, C4.5 base).

Main Results:

• Adaptive TreeHive demonstrated superior performance across five large-scale benchmark datasets (NSL-KDD, UNSW-NB15, CIC-IDS2017, CSE-CIC-IDS2018, CICDDoS2019).
• Achieved high accuracy rates, including 99.96% on NSL-KDD and 99.83% on CIC-IDS2017.
• Outperformed standard under-sampling and over-sampling data balancing methods.

Conclusions:

• Adaptive TreeHive effectively addresses imbalanced ratios and high dimensionality in intrusion detection.
• The proposed method offers a significant improvement over traditional ensemble classifiers for imbalanced network intrusion data.
• Adaptive TreeHive enhances cybersecurity by providing more accurate and efficient intrusion classification.