Evaluating the Efficacy of Resampling Techniques in Addressing Class Imbalance for Network Intrusion Detection Systems Using Support Vector Machines

Abstract

The objective of this study was to assess the performance of various resampling strategies aimed at mitigating the class imbalance problem in Network Intrusion Detection Systems (NIDS) using machine learning models and imbalanced benchmark datasets. Due to this class imbalance problem, detection of known or unknown attacks in NIDS often results in suboptimal performance. Resampling methods, statistically designed to generate synthetic samples from existing datasets, were employed to rebalance class labels and train the machine learning models. The Support Vector Machine (SVM), a robust supervised classifier, was utilized to classify data by identifying the optimal decision boundary that maximally separates different classes. In this context, efforts were made to enhance the effectiveness of these resampling techniques and consider the potential benefits of hybrid models. No resampling (NR), Synthetic Minority Over-sampling Technique (SMOTE), Random Under Sampling (RUS), Random Under Sampling and Random Over Sampling (RUS+ROS), and Random Under Sampling and SMOTE (RUS+SMOTE) were evaluated. The SVM classifier with Radial Basis Function (RBF) was employed, validated against the imbalanced benchmark dataset CICIDS-2017 (Canadian Institute for Cyber Security Intrusion Detection dataset-2017), to assess the effectiveness of these methods using performance metrics such as Accuracy, Precision, Recall, F1 score, and wall time. The proposed method achieved a remarkable accuracy of 99.63% in intrusion detection, demonstrating impressive results when compared to state-of-the-art methods for detecting network attacks on imbalanced datasets. The findings from this research provide valuable insights into the potential of various resampling methods in tackling class imbalance problems in NIDS.