Group & Reweight: A Novel Cost-Sensitive Approach to Mitigating Class Imbalance in Network Traffic Classification

TL;DR

This paper tackles severe class imbalance in network traffic classification by introducing Group & Reweight (GDR-CIL), a group distributionally robust, cost-sensitive learner. The method clusters classes into groups, assigns group-level weights, and optimizes a reweighted loss under a Stackelberg-game interpretation, linking distributional robustness to cost-sensitive learning. The approach is supported by theoretical analysis of a global/local Stackelberg equilibrium and convergence, and demonstrated to improve minority-class performance while preserving overall accuracy across CIC-IDS2017, NSL-KDD, and UNSW-NB15 datasets. Overall, GDR-CIL offers a scalable, principled strategy to mitigate boundary drift caused by imbalance in highly multi-class network traffic tasks, with practical impact for safer and more reliable intrusion detection systems.

Abstract

Internet services have led to the eruption of network traffic, and machine learning on these Internet data has become an indispensable tool, especially when the application is risk-sensitive. This paper focuses on network traffic classification in the presence of severe class imbalance. Such a distributional trait mostly drifts the optimal decision boundary and results in an unsatisfactory solution. This raises safety concerns in the network traffic field when previous class imbalance methods hardly deal with numerous minority malicious classes. To alleviate these effects, we design a group & reweight strategy for alleviating class imbalance. Inspired by the group distributionally optimization framework, our approach heuristically clusters classes into groups, iteratively updates the non-parametric weights for separate classes, and optimizes the learning model by minimizing reweighted losses. We theoretically interpret the optimization process from a Stackelberg game and perform extensive experiments on typical benchmarks. Results show that our approach can not only suppress the negative effect of class imbalance but also improve the comprehensive performance in prediction.

Figures (10)

• Figure 1: Drift of the decision boundary in binary classification. Due to the nature of the class imbalance, the machine learning obtained decision boundary tends to deviate from the optimal one.
• Figure 2: The flow chart of grouping mechanism. We provide a toy example of grouping in the imbalance traffic dataset with ten classes. The grouping mechanism is implemented before the formal classification training. It involves the proxy training phase and the validation phase. We first train an MLP in a standard supervised manner as the proxy training phase. Then, we calculate the F1-scores for the ten classes in the validation phase, denoted as $F_1, \dots, F_{10}$ respectively. Given $F_1$ and $F_2$ 0 and others non-zero, classes 1 and 2 are assigned to groups 1 and 2. For classes $\{3,4,.\dots,10\}$, we employ the K-means algorithm to cluster them into distinct groups based on their instance counts in the training dataset, represented by $N_3, N_4, \ldots, N_{10}$ in this example.
• Figure 3: Data volumes for each class of the three datasets. In panel (a), "Others" contains 11 minority classes, which are DoS GoldenEye, FTP-Patator, DoS slowloris, DoS slowhttptest, SSH-Patator, Bot, Web Attack Brute Force, Web Attack XSS, Infiltration, Web Attack Sql Injection and Heartbleed, each of them accounting for less than 0.5% of CIC-IDS2017 dataset.
• Figure 4: The average Specificities of different methods on three datasets (5 runs with error bars reported).
• Figure 5: ROC curves for each class using different methods on the CIC-IDS2017 dataset. Categories marked with an asterisk ⁎ belong to the minority category.

Theorems & Definitions (4)

• Definition 1: Global Stackelberg Equilibrium
• Proposition 1: Existence of Equilibrium
• Definition 2: Local Stackelberg Equilibrium
• Theorem 4.1: Convergence Rate for the Second Player