Multiclass Imbalance Resampling Techniques for Network Intrusion Detection

Security datasets often exhibit significant imbalances that can introduce bias during model training, diminish sensitivity to actual attacks, and lead to a substantial number of false negatives, potentially overlooking real threats. This is particularly evident in the highly skewed distribution of the UNSW-NB18 Bot-IoT dataset. To mitigate these issues, this study proposes implementing either Random Oversampling (ROS) or Synthetic Minority Oversampling (SMOTE) in conjunction with five ensemble algorithms to develop models for predicting intrusions in the Internet of Things networks. The results show that incorporating these methods with ensemble learners significantly improves model accuracy by 1 % to 4 % across the four algorithms compared to their absence. In addition, there were dramatic increases in precision, recall, and F1-score, achieving values between 95% and 100%.