An Innovative Binary Model Framework for Cyberattack Detection and Classification in Imbalanced Domains

Cyberattacks have increased in frequency and complexity in recent years, resulting in significant consequences for organizations. The negative consequences of cyberattacks force organizations to implement adequate cybersecurity measures to prevent and mitigate the impact of these attacks. Analysis of network traffic is essential for determining whether a cyberattack has been conducted. Intrusion detection systems (IDS) are used to detect malicious actions or irregularities in information systems. In conjunction with artificial intelligence (AI), they enable the development of intelligent intrusion detection systems. This paper presents an intelligent method of network traffic classification for securing systems with multiple connected devices. A proposed method combines several binary models, one for each type of cyberattack, in a two-step framework. The final system predicts whether new incoming traffic is legitimate or potentially malicious. In the first step, attacks are detected. In the second one, cyberattacks are classified into several categories. The proposal also addresses class imbalance by oversampling minority classes during binary model generation. The method was tested on four datasets related to intrusion detection in order to validate its effectiveness. Compared to classical machine learning models and state-of-the-art approaches, this model showed a significant gain in F1 scores, reaching an F1-score of 0.7213, 0.7754, 0.9340, and 0.9793 for NSL-KDD, UNSW-NB15, CSE-CICIDS2018, and ToN-IoT, respectively.