Balancing Data for Anomaly-based Intrusion Detection Systems (IDS)

Sammanfattning

Intrusion Detection Systems (IDS) are critical for cybersecurity, yet their performance is frequently compromised by class imbalance in datasets, where underrepresented attack classes lead to degraded detection rates. This study rigorously evaluates machine learning-based Network Intrusion Detection Systems (NIDS) using the CICIDS2017 dataset, addressing class imbalance through Synthetic Minority Oversampling Technique (SMOTE). This study systematically evaluates five supervised models Logistic Regression, k-Nearest Neighbors, Naive Bayes, Random Forest, and Deep Neural Networks for binary classification, along with two unsupervised approaches (K-Means and Isolation Forest), across seven randomly selected attack sample instances from the training set. Controlled imbalance experiments, where the attack sample size as a proportion of the normal data in the training set is progressively increased (1%, 5%, 10%, 30%, 60%, 80%, 100%) to analyze their impact on model performance. This study analysis leverages balanced accuracy, precision, recall, F1-score, and Matthews Correlation Coefficient (MCC) to quantify performance. Results reveal that Random Forest dominates supervised methods, achieving near-flawless detection on balanced data. In stark contrast, unsupervised techniques exhibit severe limitations. K-Means and Isolation Forest fail to generalize beyond rare anomalies. This study provides valuable insights into optimizing NIDS with machine learning, emphasizing the importance of data balancing and algorithm selection for robust cybersecurity solutions. The findings suggest that SMOTE-enhanced supervised models, particularly Random Forest, offer the most reliable intrusion detection, while unsupervised techniques require further refinement for practical deployment.