Resampling imbalanced data for network intrusion detection datasets

Abstract Machine learning plays an increasingly significant role in the building of Network Intrusion Detection Systems. However, machine models trained with imbalanced cybersecurity data cannot recognize minority data, hence attacks, effectively. One way to address this issue is use resampling, which adjusts ratio between different classes, making more balanced. This research looks at resampling’s influence on performance Artificial Neural multi-class classifiers. The resampling methods, random undersampling, oversampling, undersampling and Synthetic Minority Oversampling Technique, Adaptive Sampling Method were used benchmark Cybersecurity datasets, KDD99, UNSW-NB15, UNSW-NB17 UNSW-NB18. Macro precision, macro recall, F1-score evaluate results. patterns found were: First, oversampling increases training time decreases time; second, if extremely imbalanced, both increase recall significantly; third, not will have much impact; fourth, mostly (attacks) detected.