A Weighted Machine Learning-Based Attacks Classification to Alleviating Class Imbalance

Abstract

The Industrial Internet of Things (IIoT) has become very popular in recent years. However, IIoT is still an attractive and vulnerable target for attackers to exploit and experiment with different types of attacks. To confront this problem, the research community began exploring novel systems to protect the network. However, there are concerns related to some of theses systems regarding the increasing levels of required human interaction, which impact their efficiency. Recently, machine learning techniques are gaining much interest in security applications as they exhibit fast processing capabilities with real-time predictions. One of the significant challenges in the implementation of these techniques is the available training data for each new potential attack category, which is most of the time, unfeasible. Hence, these techniques might suffer from low detection rates for the attacks with relatively small training data (minority classes). In this article, we propose a novel algorithm based on machine learning to alleviate the class imbalance problem by computing an optimized weight for each machine learning-based decision. In particular, a supervised machine learning algorithm is first used to classify the attack categories for each node. The decisions made by the machine learning classifier are then stored in a private database. A specially designed best effort iterative weighted attack classification algorithm exploits this collected data to enhance the accuracy of the rarely detectable attack types. For each class, the weight that maximizes the diagonal to maximum ratios of the confusion matrix is iteratively computed. Such approach is shown to enhance the overall classification performance and detection accuracy even for the rarely detectable classes. Both the UNSW and NSL-KDD datasets are used in this article to validate the proposed model and verify its efficiency in detecting intrusions. The simulation results show that the proposed model can effectively detect intrusion attacks with a higher detection rate and the lowest false alarm rate compared to the state-of-the-art techniques. 2007-2012 IEEE.