Abstract:With the rapid development of network technology, the Internet has brought significant convenience to various sectors of society, holding a prominent position. Due to the unpredictable and severe consequences resulting from malicious attacks, the detection of anomalous network traffic has garnered considerable attention from researchers over the past few decades. Accurately labeling a sufficient amount of network traffic data as a training dataset within a short period of time is a challenging task, given the rapid and massive generation of network traffic data. Furthermore, the proportion of malicious attack traffic is relatively small compared to the overall traffic data, and the distribution of traffic data across different types of malicious attacks also varies significantly. To address the aforementioned challenges, this paper presents a novel network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing. Building upon the assumption of consistent distribution between labeled and unlabeled data, this paper introduces the multiclass split balancing strategy and the adaptive confidence threshold function. These innovative approaches aim to tackle the issue of the multiclass imbalanced in traffic data. By leveraging the mutually beneficial relationship between semi-supervised learning and ensemble learning, this paper presents the collaborative rotation forest algorithm. This algorithm is specifically designed to enhance performance of anomaly detection in an environment with label inadequacy. Several comparative experiments conducted on the NSL-KDD, UNSW-NB15, and ToN-IoT demonstrate that the proposed algorithm achieves significant improvements in performance. Specifically, it enhances precision by 1.5–5.7%, recall by 1.5−5.7%, and F-Measure by 1.4−4.3% compared to the state-of-the-art algorithms.

Mix-CL: Semi-Supervised Continual Learning for Network Intrusion Detection

A Method of Few-Shot Network Intrusion Detection Based on Meta-Learning Framework

CBF-IDS: Addressing Class Imbalance Using CNN-BiLSTM with Focal Loss in Network Intrusion Detection System

A Multi-Channel Contrastive Learning Network Based Intrusion Detection Method

Sub-network Discovery and Soft-masking for Continual Learning of Mixed Tasks

MEMBER: A multi-task learning model with hybrid deep features for network intrusion detection

EG-ConMix: An Intrusion Detection Method based on Graph Contrastive Learning

An integrated intrusion detection framework based on subspace clustering and ensemble learning

Heterogeneous Continual Learning

SOUL: A Semi-supervised Open-world continUal Learning method for Network Intrusion Detection

EmSM: Ensemble Mixed Sampling Method for Classifying Imbalanced Intrusion Detection Data

Error-correcting Ability Based Collaborative Multi-Layer Selective Classifier Ensemble Model for Intrusion Detection

A Self-supervised Adversarial Learning Approach for Network Intrusion Detection System.

HDCBAN: Hybrid Neural Network for Network Intrusion Detection System

Evolving Deep Convolutional Neural Network for Intrusion Detection Based on NEAT.

End-to-End Network Intrusion Detection based on Contrastive Learning

DL-IDS: Extracting Features Using CNN-LSTM Hybrid Network for Intrusion Detection System

A network anomaly detection algorithm based on semi-supervised learning and adaptive multiclass balancing

A Hybrid Spectral Clustering and Deep Neural Network Ensemble Algorithm for Intrusion Detection in Sensor Networks

AdvMix: Adversarial Mixing Strategy for Unsupervised Domain Adaptive Object Detection

Network Security Intrusion Detection Methods Combining Optimization Algorithms and Neural Networks