An Effective Intrusion Detection Model for Class-imbalanced Learning Based on SMOTE and Attention Mechanism

Abstract

With the rapid development of the Internet of Things, the continuous emergence of network attacks has brought great threats to network security. Many methods based on deep learning have been applied in detecting intrusion. However, most of these studies ignore the imbalance of network traffic, and the focus on intrusion detection is to find a small number of attack samples. Therefore, they have low accuracy in classifying network attack samples that are far less than normal traffic. In this article, we establish an intrusion detection model SE-DAS(SMOTE and Edited Nearest Neighbours with Dual Attention SRU, SEDAS), which uses the SE algorithm to balance the minority samples in network intrusion detection. Specifically, we use the feature attention mechanism to analyze the relationship between historical information and input features, and extract important features. A timing attention mechanism is used to independently select historical information at key time points in the SRU(Simple Recurrent Units) network to improve the stability of the model detection efficiency. The experimental results on the UNSW-NB15 dataset show that the detection effect of the model on minority categories is 0.037 higher than the macro-average ROC(Receiver Operating Characteristic Curve) area using the original SMOTE algorithm, and the recall rate reaches 98.65%, which is better than similar deep learning models.