Performance Optimization of Imbalanced Intrusion Detection Data Classification Based on Voting Approach

Intrusion detection systems IDSs often suffer from the category imbalance problem, i.e., malicious traffic is much less than normal traffic, which results in inefficient system detection. This paper proposed a data generation technique incorporating Pearson's correlation coefficient to solve this problem. At the same time, feature selection based on chi-square distribution and integrated learning based on voting method are also used for model optimization. In the data generation stage, the Pearson correlation coefficient-based sample similarity calculation was introduced to improve the Borderline-SMOTE method to generate high-quality data and reduce the negative impact of low-quality samples on the classification model. Different experiments were conducted for multiple machine learning methods in the model optimization phase and selected the most effective combination. Experiments on three public datasets, UNSW-NB15, NSL-KDD, and CIC-IDS-2017, proved the effectiveness of the method, especially in the detection of a few categories, which achieved significant improvement, especially in the UNSW-NB15 dataset, the F1 scores of the few categories of Analysis and Backdoor had 42$ $ and 39$ $ improvement, respectively. In addition, a new evaluation metric, Mean Category Accuracy MCA , was proposed, which provides a more balanced assessment of the detection performance of all attack types.