TAHEDD-DL: A Feature Transformer–LightGBM Hybrid with SMOTE Embedding Imputation for High-Precision Network Intrusion Detection

Abstract

There is a dire need for an intruder detection model that can tackle all three challenging aspects, namely, high class imbalance, traffic evolution, and cross-feature dependencies, in one single solution. State-of-the-art deep learning intrusion detection models using either temporal convolutions or recurrent neural networks necessarily imply sequence dependence, leading to important distribution assumptions being violated during training and restricting the usability of such approaches to the real-world network traffic datasets. We propose a two-step hybrid approach called TAHEDD-DL, which leverages the power of both the Row-Wise Feature Transformer and LightGBM boosting algorithm while augmenting the latter with our proposed SMOTE embedding imputation technique and adaptive drift detector based on ADWIN. In particular, the Feature Transformer makes use of self-attention over the features of each network flow record resulting in a latent embedding vector of size 64, which captures the intricate interaction patterns among different features impossible to detect with traditional tabular techniques. On the benchmark CICIDS 2018 dataset, TAHEDD-DL yields a ROC-AUC of 0.9081, a sensitivity of 0.9706 on max-F1 threshold, and balanced accuracy of 0.8940.