Machine learning plays an increasingly significant role in the building of Network Intrusion Detection Systems. However, machine learning models trained with imbalanced cybersecurity data cannot recognize minority data effectively.
Some reasons causing imbalanced data
- In data flow majority class tends to be benign classes, thus making dataset imbalance.
- The malicious attack approaches changes over time and very few samples can be seen or labeled
The imbalance problem is prevalent in Cybersecurity which can significantly deteriorate the performance of Machine Learning models.
New types of attacks are constantly developed which could be absent from training dataset and can be misclassified as “benign”.
Proposed Solution:
- Undersampling or Oversampling.
- Merging minority classes into larger groups using unsupervised ML approaches.