Network Intrusion Detection Model Based on PCA + ADASYN and XGBoost

Abstract

Due to the class-imbalance and redundancy of sample features, the network intrusion detection model based on classification algorithm has high false positive rate (FPR) for minority sample. A network intrusion detection model based on PCA + ADASYN and XGBoost is proposed. The principal component analysis (PCA) algorithm is used to reduce the redundancy features of the data. On this basis, the adaptive synthetic sampling (ADASYN) algorithm is used to oversample minority sample to solve the problem of class-imbalanced at the data level. Finally, XGBoost is used as a classifier to classify the detected data. In order to verify the validity of the model, several groups of comparative experiments were carried out on KDD CUP99 data set. The FPR of the proposed model for minority samples (r2l, u2r) were 17.3% and 19.7%, and the F1 were 90.1% and 84.5%. The experimental results show that by dealing with the problem of data redundancy and class-imbalanced, we can reduce the FPR of the detection model for minority sample and improve the F1.