Hybrid Framework for Addressing Class Imbalance and Network Traffic Classification Using Machine Learning

Abstract

There is a need for more research on network traffic classification as it is useful in cybersecurity, intrusion detection, and network management. However, on a real-world level, datasets that record network traffic contain high bias as they reflect a disproportionate number of traffic attacks and a surplus of routine traffic. This research presents a modified network traffic classification framework to tackle class imbalance in multi-network traffic classification. The framework combines in one pipeline data preprocessing, adaptive imbalance correction, and machine learning classification. This was validated on a Wireless Sensor Network dataset with five classes of traffic. Random Forest and Neural Network models were compared for imbalanced and balanced conditions. The proposed hybrid framework shows significant class imbalance improvement and detection of minor classes. The balanced Random Forest classifier, from the baseline implementation, had about 97.43% of correctly identified attacks with a significant increase in the classification metrics, i.e. precision, recall, F1-score. Analysis of the confusion matrix and the ROC curve indicated that the number of falsely identified attacks (< class) is low and that class identification separability improved. The results showed that in the network traffic environment, awareness of class imbalance learning is effective; furthermore, the hybrid framework shows consistent and flexible results.