Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI)
Intrusion Detection Systems, specifically Network Anomaly Detection Systems (NADSs) are vital tools in network security. The NADSs are affected by data imbalance issues in classifying minority classes. Also, designing an efficient detection framework is sought after to achieve a higher detection rat...
| Main Authors: | , , , , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Elsevier
2024-05-01
|
| Series: | Alexandria Engineering Journal |
| Subjects: | |
| Online Access: | http://www.sciencedirect.com/science/article/pii/S1110016824002850 |
| _version_ | 1797203070925406208 |
|---|---|
| author | Mohammad Kazim Hooshmand Manjaiah Doddaghatta Huchaiah Ahmad Reda Alzighaibi Hasan Hashim El-Sayed Atlam Ibrahim Gad |
| author_facet | Mohammad Kazim Hooshmand Manjaiah Doddaghatta Huchaiah Ahmad Reda Alzighaibi Hasan Hashim El-Sayed Atlam Ibrahim Gad |
| author_sort | Mohammad Kazim Hooshmand |
| collection | DOAJ |
| description | Intrusion Detection Systems, specifically Network Anomaly Detection Systems (NADSs) are vital tools in network security. The NADSs are affected by data imbalance issues in classifying minority classes. Also, designing an efficient detection framework is sought after to achieve a higher detection rate for minority classes, especially when utilizing ensemble learning methods. To solve the issue of imbalanced data, a hybrid method of sampling techniques is proposed. This imbalance processing tool integrates the Synthetic Minority Oversampling Technique (SMOTE) and the K-means clustering algorithm (SKM). SMOTE over-samples the minority class, and K-means is used to perform a cluster-based under-sampling. We use Denoising Autoencoder (DAE) to select the top 15 features to reduce data dimensionality based on their higher weights. For anomaly detection, the XGBoost algorithm is deployed and the SHapley Additive exPlanation (SHAP) approach is deployed to provide explanations of the proposed techniques. The performance of the SKM-XGB model is assessed using the NSL-KDD and UNSW-NB15 datasets. A comparative analysis and series of experiments were carried out using several ensemble models with multiple base classifiers. The experimental findings indicate that the model's detection rate for binary classification and multiclass classification using the UNSW-NB15 dataset is 99.01% and 97.49%, respectively. The model achieves a 99.37% detection rate for binary classification and a 99.22% detection rate for multiclass classification on the NSL-KDD dataset. We conducted a comparative analysis of various ensemble models with multiple base classifiers. The results indicate that SKM-XGB outperforms the other investigated models and outperforms the performance of state-of-the-art models. |
| first_indexed | 2024-04-24T08:13:30Z |
| format | Article |
| id | doaj.art-06154773b1ae4c3eb694a004117a9346 |
| institution | Directory Open Access Journal |
| issn | 1110-0168 |
| language | English |
| last_indexed | 2024-04-24T08:13:30Z |
| publishDate | 2024-05-01 |
| publisher | Elsevier |
| record_format | Article |
| series | Alexandria Engineering Journal |
| spelling | doaj.art-06154773b1ae4c3eb694a004117a93462024-04-17T04:48:40ZengElsevierAlexandria Engineering Journal1110-01682024-05-0194120130Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI)Mohammad Kazim Hooshmand0Manjaiah Doddaghatta Huchaiah1Ahmad Reda Alzighaibi2Hasan Hashim3El-Sayed Atlam4Ibrahim Gad5Department of Computer Science, Kabul Education University, Kabul, Afghanistan; Department of Computer Science, Mangalore University, Mangalore, IndiaDepartment of Computer Science, Mangalore University, Mangalore, IndiaCollege of Computer Science and Engineering, Taibah University, Yanbu, Saudi ArabiaCollege of Computer Science and Engineering, Taibah University, Yanbu, Saudi ArabiaCollege of Computer Science and Engineering, Taibah University, Yanbu, Saudi Arabia; Department of Computer Science, Faculty of Science, Tanta University, Egypt; Corresponding author.Department of Computer Science, Faculty of Science, Tanta University, EgyptIntrusion Detection Systems, specifically Network Anomaly Detection Systems (NADSs) are vital tools in network security. The NADSs are affected by data imbalance issues in classifying minority classes. Also, designing an efficient detection framework is sought after to achieve a higher detection rate for minority classes, especially when utilizing ensemble learning methods. To solve the issue of imbalanced data, a hybrid method of sampling techniques is proposed. This imbalance processing tool integrates the Synthetic Minority Oversampling Technique (SMOTE) and the K-means clustering algorithm (SKM). SMOTE over-samples the minority class, and K-means is used to perform a cluster-based under-sampling. We use Denoising Autoencoder (DAE) to select the top 15 features to reduce data dimensionality based on their higher weights. For anomaly detection, the XGBoost algorithm is deployed and the SHapley Additive exPlanation (SHAP) approach is deployed to provide explanations of the proposed techniques. The performance of the SKM-XGB model is assessed using the NSL-KDD and UNSW-NB15 datasets. A comparative analysis and series of experiments were carried out using several ensemble models with multiple base classifiers. The experimental findings indicate that the model's detection rate for binary classification and multiclass classification using the UNSW-NB15 dataset is 99.01% and 97.49%, respectively. The model achieves a 99.37% detection rate for binary classification and a 99.22% detection rate for multiclass classification on the NSL-KDD dataset. We conducted a comparative analysis of various ensemble models with multiple base classifiers. The results indicate that SKM-XGB outperforms the other investigated models and outperforms the performance of state-of-the-art models.http://www.sciencedirect.com/science/article/pii/S1110016824002850IDSNetwork anomaly detection systemsEnsemble learningXGBoostSMOTEOversampling |
| spellingShingle | Mohammad Kazim Hooshmand Manjaiah Doddaghatta Huchaiah Ahmad Reda Alzighaibi Hasan Hashim El-Sayed Atlam Ibrahim Gad Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI) Alexandria Engineering Journal IDS Network anomaly detection systems Ensemble learning XGBoost SMOTE Oversampling |
| title | Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI) |
| title_full | Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI) |
| title_fullStr | Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI) |
| title_full_unstemmed | Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI) |
| title_short | Robust network anomaly detection using ensemble learning approach and explainable artificial intelligence (XAI) |
| title_sort | robust network anomaly detection using ensemble learning approach and explainable artificial intelligence xai |
| topic | IDS Network anomaly detection systems Ensemble learning XGBoost SMOTE Oversampling |
| url | http://www.sciencedirect.com/science/article/pii/S1110016824002850 |
| work_keys_str_mv | AT mohammadkazimhooshmand robustnetworkanomalydetectionusingensemblelearningapproachandexplainableartificialintelligencexai AT manjaiahdoddaghattahuchaiah robustnetworkanomalydetectionusingensemblelearningapproachandexplainableartificialintelligencexai AT ahmadredaalzighaibi robustnetworkanomalydetectionusingensemblelearningapproachandexplainableartificialintelligencexai AT hasanhashim robustnetworkanomalydetectionusingensemblelearningapproachandexplainableartificialintelligencexai AT elsayedatlam robustnetworkanomalydetectionusingensemblelearningapproachandexplainableartificialintelligencexai AT ibrahimgad robustnetworkanomalydetectionusingensemblelearningapproachandexplainableartificialintelligencexai |