Abstract:The proliferation of internet-connected devices and the complexity of modern network environments have led to the collection of massive and high-dimensional datasets, resulting in substantial information redundancy and sample imbalance issues. These challenges not only hinder the computational efficiency and generalizability of anomaly detection systems but also compromise their ability to detect rare attack types, posing significant security threats. To address these pressing issues, we propose a novel causal genetic network-based anomaly detection method, the CNSGA, which integrates causal inference and the nondominated sorting genetic algorithm-III (NSGA-III). The CNSGA leverages causal reasoning to exclude irrelevant information, focusing solely on the features that are causally related to the outcome labels. Simultaneously, NSGA-III iteratively eliminates redundant information and prioritizes minority samples, thereby enhancing detection performance. To quantitatively assess the improvements achieved, we introduce two indices: a detection balance index and an optimal feature subset index. These indices, along with the causal effect weights, serve as fitness metrics for iterative optimization. The optimized individuals are then selected for subsequent population generation on the basis of nondominated reference point ordering. The experimental results obtained with four real-world network attack datasets demonstrate that the CNSGA significantly outperforms existing methods in terms of overall precision, the imbalance index, and the optimal feature subset index, with maximum increases exceeding 10%, 0.5, and 50%, respectively. Notably, for the CICDDoS2019 dataset, the CNSGA requires only 16-dimensional features to effectively detect more than 70% of all sample types, including 6 more network attack sample types than the other methods detect. The significance and impact of this work encompass the ability to eliminate redundant information, increase detection rates, balance attack detection systems, and ensure stability and generalizability. The proposed CNSGA framework represents a significant step forward in developing efficient and accurate anomaly detection systems capable of defending against a wide range of cyber threats in complex network environments.

Improving the Stability of Intrusion Detection with Causal Deep Learning

Improving the Accuracy of Network Intrusion Detection with Causal Machine Learning

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

Intrusion detection framework based on causal reasoning for DDoS

Adaptive deep learning for network intrusion detection by risk analysis

A Three-Layer Architecture for Intelligent Intrusion Detection Using Deep Learning

Comparison of Machine Learning and Deep Learning Models for Network Intrusion Detection Systems

Interpretable Detection and Localization of False Data Injection Attacks Based on Causal Learning

Intrusion Detection With Deep Learning Classifiers: A Synergistic Approach of Probabilistic Clustering and Human Expertise to Reduce False Alarms

Network Anomaly Intrusion Detection Based on Deep Learning Approach

DICE: Domain-attack Invariant Causal Learning for Improved Data Privacy Protection and Adversarial Robustness

A Deep Learning Model for Network Intrusion Detection with Imbalanced Data

HDCBAN: Hybrid Neural Network for Network Intrusion Detection System

An Enhanced Deep Neural Network Enabled with Cuckoo Search Algorithm for Intrusion Detection in Wide Area Networks

Causal Genetic Network Anomaly Detection Method for Imbalanced Data and Information Redundancy

Learning to Detect: A Data-driven Approach for Network Intrusion Detection

Strengthening Network Security: Deep Learning Models for Intrusion Detection with Optimized Feature Subset and Effective Imbalance Handling

A Simple Framework to Enhance the Adversarial Robustness of Deep Learning-based Intrusion Detection System

Deep Learning Approach for IDS

Addressing the class imbalance problem in network intrusion detection systems using data resampling and deep learning