Dealing with Imbalanced Data in Multi-class Network Intrusion Detection Systems Using XGBoost

Network intrusion detection is a crucial cyber-security problem, where machine learning is recognised as a relevant approach to detect signs of malicious activity in the network traffic. However, intrusion detection patterns learned with imbalanced network traffic data often fail in recognizing rare attacks. One way to address this issue is to use oversampling before learning, in order to adjust the ratio between the different classes and make the traffic data more balanced. This paper investigates the effect of oversampling coupled to feature selection, in order to understand how the feature relevance may change due to the creation of artificial rare samples. We perform this study using XGBoost for the network traffic classification. The experiments are performed with two benchmark multi-class network intrusion detection problems.