Towards an Effective Intrusion Detection Model Using Focal Loss Variational Autoencoder for Internet of Things (IoT)

Abstract

As the range of security attacks increases across diverse network applications, intrusion detection systems are of central interest. Such detection systems are more crucial for the Internet of Things (IoT) due to the voluminous and sensitive data it produces. However, the real-world network produces imbalanced traffic including different and unknown attack types. Due to this imbalanced nature of network traffic, the traditional learning-based detection techniques suffer from lower overall detection performance, higher false-positive rate, and lower minority-class attack detection rates. To address the issue, we propose a novel deep generative-based model called Class-wise Focal Loss Variational AutoEncoder (CFLVAE) which overcomes the data imbalance problem by generating new samples for minority attack classes. Furthermore, we design an effective and cost-sensitive objective function called Class-wise Focal Loss (CFL) to train the traditional Variational AutoEncoder (VAE). The CFL objective function focuses on different minority class samples and scrutinizes high-level feature representation of observed data. This leads the VAE to generate more realistic, diverse, and quality intrusion data to create a well-balanced intrusion dataset. The balanced dataset results in improving the intrusion detection accuracy of learning-based classifiers. Therefore, a Deep Neural Network (DNN) classifier with a unique architecture is then trained using the balanced intrusion dataset to enhance the detection performance. Moreover, we utilize a challenging and highly imbalanced intrusion dataset called NSL-KDD to conduct an extensive experiment with the proposed model. The results demonstrate that the proposed CFLVAE with DNN (CFLVAE-DNN) model obtains promising performance in generating realistic new intrusion data samples and achieves superior intrusion detection performance. Additionally, the proposed CFLVAE-DNN model outperforms several state-of-the-art data generation and traditional intrusion detection methods. Specifically, the CFLVAE-DNN achieves 88.08% overall intrusion detection accuracy and 3.77% false positive rate. More significantly, it obtains the highest low-frequency attack detection rates for U2R (79.25%) and R2L (67.5%) against all the state-of-the-art algorithms.

Keywords: Class-wise Focal Loss; Deep Neural Network; Internet of Things; Variational AutoEncoder; data imbalance; intrusion detection.

Figure 1

Variational AutoEncoder with CE loss.

Figure 2

Class-wise Focal Loss Variational AutoEncoder (CFLVAE).

Figure 3

Proposed CFLVAE-DNN Framework.

Figure 4

The effects of the training procedure of the CFLVAE and the DNN models. (a) CFLVAE loss; (b) DNN loss; (c) DNN accuracy.

Figure 5

NSL-KDD dataset. (a) Imbalanced original records; (b) Generated records; (c) Balanced dataset.

Figure 6

The intrusion detection performance (in %) of our proposed CFLVAE-DNN model. (a) Overall performance; (b) Class-wise detection rates.

Figure 7

AUC-ROC curve on NSL-KDD test datasets. (a) AUC-ROC curve on the KDDTest+; (b) AUC-ROC curve on the KDDTest-21.

Figure 8

The intrusion detection performance (in %) on different number of hidden layers used in DNN model for KDDTest+ dataset. (a) Overall performance; (b) Class-wise detection rates.

Figure 9

The result of intrusion detection performance with different Gamma ($\gamma$) values of Class-wise Focal Loss.

Figure 10

Comparison of (a) Overall detection rates and (b) Class-wise detection performance of data generation techniques on the KDDTest+ dataset (in %).

Figure 11

Comparison of (a) Overall detection rates and (b) Class-wise detection performance of data generation techniques on the KDDTest-21 dataset (in %).

Figure 12

Comparison of (a) Overall performance and (b) Class-wise detection rates of learning-based classifiers on the NSL-KDD (KDDTest+) dataset (in %).

Figure 13

Comparison of (a) Overall performance and (b) Class-wise detection rates of learning-based classifiers on the NSL-KDD (KDDTest-21) dataset (in %).