METHOD FOR REDUCING FALSE ACCOUNTS IN INTRUDER DETECTION SYSTEMS BASED ON THRESHOLD FILTERING AND GRADIENT BOOSTING

Abstract

The increasing number and complexity of cyber threats necessitates the need to improve the efficiency of intrusion detection systems. The practical use of such systems is significantly complicated by the high level of false positives, which leads to an overload of security professionals. The aim of the work is to develop a method for reducing false positives in network intrusion detection systems that provides an optimal balance among classification accuracy, computational efficiency, and practical suitability for deployment in real network environments. The proposed method combines the LightGBM gradient boosting algorithm with an adaptive threshold filtering mechanism and a fallback class. A microservice architecture for the system based on Docker containerization has been developed, comprising five main components: CICFlowMeter for flow generation, Converter for format conversion, Agent for event batching, API Server for classification, and Dashboard for results visualization. The key scientific novelty is the adaptive threshold filtering algorithm, which uses individual threshold values for each attack class and a mechanism for automatically returning to the BENIGN class when model confidence is insufficient. Experimental studies on the public CIC-IDS2017 dataset showed that the proposed method achieves an F1-score = 0.949 and a false positive rate of 2.1 %, a 74 % reduction compared to the basic LightGBM model without post-processing. Compared to the MLP multilayer neural network, the proposed solution achieves higher accuracy with a fourfold reduction in training time and inference that is almost twice as fast. The contribution of each component of the proposed system to the accuracy of cyberattack detection was also investigated. Testing across different attack types showed the best detection efficiency for DDoS, PortScan, and DoS attacks. The practical significance of the work lies in the ability to apply the proposed method in real intrusion detection systems without the need for graphics accelerators, making it suitable for organizations with limited computing resources.