Impact of Hybrid Sampling on ML-based Network Intrusion Detection Systems

The Network Intrusion Detection System (NIDS), a cornerstone in network security, relies heavily on public datasets. These datasets, on the other hand, suffer from imbalanced classes, with more samples of regular network traffic than harmful examples and attacks. Addressing this data imbalance is crucial for designing an effective NIDS, prompting the application of diverse sampling techniques to rectify this issue. In order to resolve data imbalances in the UNSW-NB15 dataset, the effects of hybrid sampling approaches on the accuracy of classic Machine Learning (ML) models for NIDS has been explored. The study used the synthetic minority over sampling and tomek links (SMOTE-Tomek), and synthetic minority oversampling and edited nearest neighbours (SMOTE-ENN) to validate the efficacy of the proposed hybrid sampling on UNSW-NB15 dataset. The results of hybrid sampling in improving detection accuracy and lowering false negatives in attack classification are impressive, with SMOTE-Tomek Link achieving high recall rates as compared to original distribution. This approach provides a robust and effective solution for handling imbalanced data and holds great promise for enhanced network security against constantly changing cyber threats.