Leveraging AI-Driven Realtime Intrusion Detection by Using WGAN and XGBoost
Hoang V. Vo, Duong Huong Nguyen, Tuyen T. Nguyen, Hoa Ngoc Nguyen, Duan V. Nguyen · 2022
Currently, pattern-based detection is difficult to detect new network attacks with signatures. Thus, using machine learning is an approach proposed by many researchers for intrusion detection systems to deal with this issue. This paper presents a hybrid method combining a rule-based inspector with an AI-driven model, namely WGID, to improve intrusion detection performance. In this method, traffic flows that are not triggered by any rule of the rule-based inspector will be deeply analyzed by the WGID-based inspector. WGID comprises the TWGAN algorithm to generate more coherent samples based on the WGAN to tackle the imbalanced dataset. Based on the training dataset augmented by TWGAN, WGID adopts the XGBoost method to perform the deep analysis. To demonstrate the WGID performance, we conduct different rigorous experiments to evaluate WGID using three well-known datasets. The results indicate that the WGID achieves an excellent accuracy of , , and with the CSE-CIC-IDS2018, NSL-KDD, and UGR datasets, respectively. It also performs better than related models using the same datasets. Moreover, the deep inspection time for each traffic flow is also small enough to detect intrusions in the inline mode (i.e., average 1.892μs/flow).