Authors - Anupama Y K., G M Trupti, Arun Kumar N Abstract - Due to the rapid evolution of cyber threats with the growth of the internet and cyber threats, we now live within the cyber domain, which is under great pressure and strain from cyber threats. The rise in popularity of Cloud Infrastructure, which offers customers scalable data storage, has led to development of new vulnerabilities to business owners, as well as a growing shift in the way hackers operate. Traditional methods of detecting cyber attacks, such as IDSs, typically encounter issues when dealing with a large amount of class imbalance and have difficulty adapting to newer attack vectors. This results in an increase in false positives that companies receive when monitoring their systems for cyber attacks, as well as a decreasing ability to detect less frequent, but very high-impact, types of cybersecurity threats. The solution involves developing an AI-based intrusion detection system that combines the use of Borderline SMOTE to balance the classes incorrectly identified, with an ensemble method called maximum vote that combines three classifications methods: Decision Trees, XGBoost and tuned AdaBoost. The system is evaluated using the KDD Cup 1999 benchmark dataset which contains regular traffic as well as different attack types including DoS/DDoS (Neptune, Smurf, Teardrop), Probe (Nmap, Ipsweep, Portsweep, Satan), R2L (Guess password, Back) and U2R (Buffer Overflow, Rootkit, Land). Experimental results show that the max-voting ensemble out performs the individual base models (Decision Tree, AdaBoost, and XGBoost) and standard single classifier IDS methods along with baseline algorithms. This leads to more reliable detection of both minor and major attacks in cloud security scenarios. These findings highlight the effectiveness of combining Borderline-SMOTE with ensemble learning to build a scalable and robust IDS suitable for real-time cloud security monitoring.
Open Zoom