Increasing Detection Rate for Imbalanced Malicious Traffic Using Generative Adversarial Networks

Intrusion Detection and Prevention Systems aim to detect and prevent malicious activity or policy violations. Anomaly-based models like autoencoders or neural networks have become prominent because they do not rely on pre-defined signatures. In this study, we leverage the generative abilities of a Wasserstein Generative Adversarial Network + Gradient Penalty (WGAN-GP) to create anomalies to combat class imbalance artificially. We compare its performance on the CSE-CIC-IDS2018 data set from the Canadian Institute for Cybersecurity Intrusion Detection System (CIC-IDS) with two other anomaly-based models and one discriminative model. Our model Data-Imbalanced Aware XGBoost (DIAX) excels with an F1 score of 96.90% that shows great performance to combat class imbalances. Additionally, we conduct a detailed analysis using SHapley Additive exPlanations (SHAP) to interpret predictions of the best-performing model. Lastly, we argue that SHAP can help in the task of dimensionality reduction for classifiers.