Comparative Analysis of Oversampling Techniques and Feature Selection for Intrusion Detection

Abstract

To accurately detect and defend against ever-evolving cyber-attacks, network security technologies using artificial intelligence are continually advancing. This study analyzed the effective network intrusion detection methods based on the CICIDS2017 dataset, which contains various types of network attacks and has a highly imbalanced class distribution. To enhance detection performance for the minority classes of attacks, five oversampling techniques, including SMOTE, Borderline-SMOTE, ADASYN, GAN, and BiGAN, were applied to the underrepresented Bot and Infiltration classes. Additionally, the impact of feature selection on classification performance was evaluated by selecting features based on the feature importance scores from each machine learning model: Random Forest and XGBoost. The experimental results demonstrated that oversampling with SMOTE and ADASYN improved the recall scores of minority classes. Furthermore, applying feature selection reduced the model's complexity while maintaining or even improving its accuracy.