Host-based intrusion detection systems developed using ADFA-LD and AWSCTD datasets

Various intrusion detection systems (IDSs) and host-based intrusion detection systems (HIDSs) are proposed to detect attacks. In this study, several stacking ensemble-based XGBoost models/HIDSs incorporating machine learning (ML) models are developed. First, n-gram and standard bag-of-words (BoW) methods are applied to the ADFA-LD and AWSCTD datasets, and BoW datasets are obtained. Subsequently, synthetic data samples are generated using the SMOTE to augment the number of minority class samples in the BoW datasets. Thus, balanced synthetic BoW datasets are created. After the BoW datasets are constructed, optimal features from these datasets are selected. Following the feature selection, individual ML models are designed using BoW datasets with or without synthetic data samples. Afterward, several stacking ensemble-based XGBoost models/HIDSs, which utilize the outputs of the developed individual models, are constructed. As a result of the experiments, the XGBoost developed on the synthetic BoW dataset achieves an accuracy of 0.9750 for the ADFA-LD dataset. In the experiments based on the AWSCTD dataset, the XGBoost trained using the synthetic BoW dataset demonstrates a performance with an accuracy of 0.9945. Furthermore, a review of prior studies employing generative AI methods is also provided to highlight alternative approaches for addressing data imbalance in intrusion detection.