Convolutional Neural Networks for Imbalanced Advanced Security Network Metrics and Non-Payload-Based Obfuscations Dataset to Detect Intrusion

Abstract

Network Intrusion Detection Systems (NIDSs) are essential for identifying and preventing cyber threats in modern networks. However, improving their adaptability and responsiveness to unforeseen threats remains a significant challenge. Among the various datasets available for NIDS, the ASNM dataset holds particular significance due to its rich diversity of network traffic traces, including detailed labels for legitimate traffic, direct attacks, and obfuscated network attacks. Despite its potential, the ASNM dataset has been relatively underexplored in existing research, presenting an opportunity for further investigation and application in the development and benchmarking of advanced NIDS models. In this paper, we introduce a convolutional neural network (CNN) architecture designed for network intrusion detection, which autonomously learns patterns and anomalies directly from raw network data. Unlike traditional methods that rely on handcrafted features or predefined signatures, the proposed CNN dynamically adapts to detect both known and obfuscated attacks. The quality and balance of the dataset used to train NIDSs are critical, as imbalanced data can skew detection results and significantly impact overall system performance. To address this, we introduce an innovative preprocessing technique to mitigate class imbalances, ensuring more accurate classification across all categories, including under-represented attack types. The proposed CNN architecture was rigorously tested against decision trees, neural networks, and k-nearest neighbor classifiers, demonstrating superior performance. The model achieved a True Positive Rate (TPR) of 99.43% and an average recall of 99.26% on a balanced dataset, significantly outperforming traditional models. Furthermore, the preprocessing method improved the TPR by 62% and 83% on datasets with and without obfuscated samples, respectively, highlighting its effectiveness in addressing dataset imbalances and improving detection accuracy. In conclusion, the combination of the ASNM dataset's comprehensive attack scenarios and the dynamic feature-learning capabilities of the proposed CNN represents a significant advancement in intrusion detection technology.