Network intrusion detection systems (NIDS) are critical for maintaining cybersecurity. However, due to the complexity of network traffic data and the issue of class imbalance, existing detection models often exhibit high false alarm rates and insufficient detection accuracy for different types of attacks. To address these challenges, an imbalanced learning method for network intrusion detection, based on topological data analysis (TDA) and named TopoSMOTE, was proposed. This method aims to balance the training dataset by generating new minority class samples. The core of TopoSMOTE lied in constructing topological graphs to synthesize new samples. Firstly, the method used TDA to map the spatial relationships and connection patterns in network traffic data, forming a topological graph. Then, based on the topological graph, a minority class sample selection strategy was designed, which synthesized new data by selecting the nearest neighbor samples with topological relationships in a low-dimensional mapped space. Experiments were conducted on two imbalanced datasets. The experimental results show that the TopoSMOTE method achieves higher detection accuracy and lower false alarm rates compared to advanced oversampling methods and intrusion detection models.
| 科 Family | 属数 Number of genus | 种数 Number of species | 占总种数比例 Percentage of total species (%) | 属 Genus | 种数 Number of species | 占总种数比例 Percentage of total species (%) |
|---|---|---|---|---|---|---|
| 鹅膏菌科Amanitaceae | 2 | 11 | 5.26 | 鹅膏菌属 Amanita | 10 | 4.78 |
| 小菇科 Mycenaceae | 2 | 12 | 5.74 | 丝盖伞属 Inocybe | 5 | 2.39 |
| 多孔菌科 Polyporaceae | 8 | 14 | 6.70 | 蜡蘑属 Laccaria | 5 | 2.39 |
| 红菇科 Russulaceae | 3 | 23 | 11.00 | 小皮伞属 Marasmius | 6 | 2.87 |
| 小菇属 Mycena | 11 | 5.26 | ||||
| 光柄菇属 Pluteus | 5 | 2.39 | ||||
| 红菇属 Russula | 17 | 8.13 | ||||
| 栓菌属 Trametes | 5 | 2.39 |