Improving machine learning model performance on detection of network infiltration

Network Intrusion Detection research datasets concentrate on recognition of malignant traffic and often present benign traffic as one class. Some classes with extremely low representation of flows in intrusion detection datasets can still be learned and discovered with high precision. However the Infiltration class, comprising 1% in CSE-CIC-IDS2018 dataset, was found to partially overlap with the Benign class. Whereas benign internet traffic can be classified into sub-classes using machine learning. A question is asked in this research whether it is possible to be more specific using machine learning methods to discover which Benign sub-classes are overlapping with Infiltration. This research indicates an overlap with social networking and browsing.In this research a method, for classification of a second level of granularity of traffic is proposed, and an experiment is designed to find a class instance space subset overlap in an imbalanced dataset with temporal aggregate statistics features of major classes. It allows for further indication of features, where oversampling could have a positive impact towards predicting the rare class in a search of decision boundary criteria which can be added from information of other classes by overlap analysis.