Methodology for the detection of contaminated training datasets for machine learning-based Network Intrusion Detection Systems Medina-Arco, Joaquín Gaspar Magán Carrión, Roberto Rodríguez-Gómez, Rafael Alejandro García Teodoro, Pedro Anomaly detection NIDS Deep learning Autoencoders Methodology Real network datasets Data quality This publication has been partially funded by MICIN/AEI/10.13039/501100011033 under grants PID2020-113462RB-I00 and PID2020-114495RB-I00 and the PPJIA2022-51 and PPJIA2022-52 projects from the University of Granada’s own funding plan. With the significant increase in cyber-attacks and attempts to gain unauthorised access to systems and information, Network Intrusion-Detection Systems (NIDSs) have become essential detection tools. Anomaly-based systems use machine learning techniques to distinguish between normal and anomalous traffic. They do this by using training datasets that have been previously gathered and labelled, allowing them to learn to detect anomalies in future data. However, such datasets can be accidentally or deliberately contaminated, compromising the performance of NIDS. This has been the case of the UGR’16 dataset, in which, during the labelling process, botnet-type attacks were not identified in the subset intended for training. This paper addresses the mislabelling problem of real network traffic datasets by introducing a novel methodology that (i) allows analysing the quality of a network traffic dataset by identifying possible hidden or unidentified anomalies and (ii) selects the ideal subset of data to optimise the performance of the anomaly detection model even in the presence of hidden attacks erroneously labelled as normal network traffic. To this end, a two-step process that makes incremental use of the training dataset is proposed. Experiments conducted on the contaminated UGR’16 dataset in conjunction with the state-of-the-art NIDS, Kitsune, conclude with the feasibility of the approach to reveal observations of hidden botnet-based attacks on this dataset. 2024-04-01T09:42:26Z 2024-04-01T09:42:26Z 2024-01-12 journal article Medina-Arco, J.G.; Magán-Carrión, R.; Rodríguez-Gómez, R.A.; García-Teodoro, P. Methodology for the Detection of Contaminated Training Datasets for Machine Learning-Based Network Intrusion-Detection Systems. Sensors 2024, 24, 479. https://doi.org/10.3390/s24020479 https://hdl.handle.net/10481/90257 10.3390/s24020479 eng http://creativecommons.org/licenses/by-nd/4.0/ open access Attribution-NoDerivatives 4.0 Internacional MDPI