Siam-IDS: Handling class imbalance problem in Intrusion Detection Systems using Siamese Neural Network

Abstract To tackle new and complex attacks, modern Intrusion Detection Systems (IDSs) are developed using Deep Learning (DL) techniques and are trained on intrusion detection datasets such as KDD and NSL-KDD. These two datasets have a large number of samples in Denial of Service and Probe attack classes besides the Normal class, but the number of samples in Remote to Local (R2L) and User to Root (U2R) attack classes is very less. R2L and U2R attacks represent the minority classes of these two datasets and due to lack of training samples in these minority classes, DL based IDSs are unable to detect them accurately. This leads to class imbalance problem and increases the chances of the network being compromised due to undetected intrusions. To handle this class imbalance problem in IDSs, this paper proposes Siam-IDS which is a novel IDS based on Siamese Neural Network (Siamese-NN). The proposed Siam-IDS is able to detect R2L and U2R attacks without using traditional class balancing techniques such as oversampling and random undersampling. The performance of Siam-IDS was compared with existing IDSs developed using DL techniques namely Deep Neural Network (DNN) and Convolutional Neural Network (CNN). Siam-IDS was able to achieve higher recall values for both R2L and U2R attack classes when compared to its counterparts.