Deep Regularization Mechanism for Combating Class Imbalance Problem in Intrusion Detection System for Defending DDoS Attack in SDN

Abstract

Integration of deep learning into Intrusion Detection Systems (IDS) for Software Defined Networking (SDN) is an emerging field of research. Most of the datasets used to build IDS are highly imbalanced, especially in the case of DDoS attacks, which account for a larger percentage of malicious samples than normal traffic. As a result of a class imbalance, the classification result is distorted since deep learning is limited in its ability to generalize and is misled into favoring the majority class. This study aims to confront the problem of class imbalance by introducing a new deep regularization mechanism that allows the learning model to unlearn biased information. Unlike the existing system, the proposed mechanism integrates two multi-layer neural networks to extract shared information and biased distribution. The first learning model generalizes the data distribution to classify network traffic as normal or attacks class. On the other hand, the second model is integrated with the embedding layers feature of the first model, which learns the bias distribution and then it regressively instructs the first network not to learn this biased information. The proposed regularization scheme is evaluated on the most recent and highly imbalanced network dataset CIC-DDoS2019. The proposed scheme is compared with different supervised learning classifiers executed on the same dataset in the experiment, balanced with the smote technique. The proposed model outperforms other learning techniques and reached an overall precision, recall, and F1-score of 96.71, 97.14, and 96.92%, respectively.