Taesu Kim, Dongkyoo Shin, Dongil Shin, Journal of Internet Computing and Services, Vol. 26, No. 3, pp. 1-7, Jun. 2025
10.7472/jksii.2025.26.3.1, Full Text:  HTML
Keywords: Network intrusion detection, data augmentation

Abstract

Due to the rapid changes in the cyber security landscape, various machine learning models have been developed to detect zero-day attacks, which lack predefined signatures. However, a significant obstacle in developing attack detection or anomaly detection models is the lack of sufficient attack data. To address this issue, this study conducted experiments to augment minority class samples using SMOTE (Synthetic Minority Oversampling Technique), an oversampling method, and Autoencoder, a contrastive learning model. The augmented data were applied to three machine learning models: Random Forest, Logistic Regression, and Light Gradient Boosting Model (LightGBM). The experiments using binary datasets demonstrated that the combination of LightGBM and Autoencoder showed the most significant performance improvement. Accuracy improved from 0.935 to 0.999, the false positive rate (FPR) decreased from 0.065 to 0.001, and the false negative rate (FNR) dropped from 0.064 to 0.001. On the other hand, experiments using multi-class datasets revealed that the combination of Logistic Regression and Autoencoder achieved the best performance. Accuracy increased from 0.849 to 0.960, FPR decreased from 0.151 to 0.040, and FNR dropped from 0.177 to 0.039.

Statistics
Cite this article