CSCVAE-NID: A Conditionally Symmetric Two-Stage CVAE Framework with Cost-Sensitive Learning for Imbalanced Network...

Area of Science:

• Cybersecurity
• Machine Learning
• Network Security

Background:

• Network Intrusion Detection Systems (NIDSs) face challenges due to complex threats and class imbalance.
• Scarcity of minority attack samples and misclassification costs hinder traditional model effectiveness, causing high False Positive Rates (FPRs) and low Recall.

Purpose of the Study:

• To propose a novel, conditionally symmetric two-stage framework (CSCVAE-NID) for high-performance NIDSs.
• To address data imbalance and misclassification costs in network intrusion detection.

Main Methods:

• Introduced a Data Augmentation Conditional Variational Autoencoder (DA-CVAE) for data-level imbalance correction by generating synthetic samples.
• Developed a Cost-Sensitive Multi-Class Classification CVAE (CSMC-CVAE) that reframes classification as probabilistic distribution matching with a cost-sensitive loss function.

Main Results:

• The CSCVAE-NID framework demonstrated superior performance on CICIDS-2017 and UNSW-NB15 datasets.
• Achieved exceptional results in both binary and multi-class classification tasks compared to state-of-the-art methods.
• The DA-CVAE module proved independent and extensible for supporting other intrusion detection methodologies.

Conclusions:

• The proposed CSCVAE-NID framework effectively tackles class imbalance and misclassification costs in NIDSs.
• This approach significantly enhances the performance of network intrusion detection systems.
• The modular design allows for broad applicability and integration with existing and future NIDS solutions.