Addressing the Class Imbalance Problem in Network-Based Anomaly Detection

Network anomaly detection systems are vital for identifying malicious activities in computer networks. However, they face a challenge due to class imbalance, where normal traffic outweighs anomalies. This bias leads to models favoring majority classes, neglecting minority anomalies. In this study, we proposed a comprehensive approach to address this issue in network anomaly detection using NSL-KDD and UNSW-NB15 datasets. Our method incorporated techniques like random over-sampling (ROS), random under-sampling (RUS), Synthetic Minority Over-sampling Technique (SMOTE), Adaptive Synthetic Sampling (ADASYN), SMOTE combined with Edited Nearest Neighbors (SMOTEENN), and class reduction. We evaluated our approach on these datasets, showing improved performance metrics for bidirectional long-short memory (Bi-LSTM). Our results highlight the importance of addressing class imbalance for robust network anomaly detection, contributing to cybersecurity in modern networks.