Impact of Data Balancing and Feature Selection on Machine Learning-based Network Intrusion Detection - research abstract

Aug 3, 2026

Unbalanced datasets in supervised machine learning bias models toward majority classes, reducing recognition of minority classes. Network intrusion detection datasets such as NSL-KDD and UNSW-NB15 show attack composition imbalance, commonly addressed through oversampling and synthetic data generation. This work applies SMOTE and ADASYN to construct balanced minority-class samples and uses recursive feature elimination (RFE) to select informative features. Results indicate SMOTE outperforms ADASYN on highly imbalanced UNSW-NB15, while RFE slightly reduces accuracy but improves training speed. A decision tree classifier achieves higher recognition rates than random forest and KNN.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages8

Reading Time20 min

AccessFree to download

Introduction

Network security and intrusion recognition

Public IDS datasets and class imbalance

Data balancing via resampling and synthetic oversampling

Feature reduction and recursive feature elimination

INTERNATIONAL JOURNAL ON INFORMATICS VISUALIZATION [journal homepage : www.joiv.org/index.php/joiv](journal homepage : www.joiv.org/index.php/joiv) Impact of Data Balancing and Feature Selection on Machine Learning based Network Intrusion Detection Azhari Shouni Barkaha,b,*, Siti Rahayu Selamatb, Zaheera Zainal Abidin b, Rizki Wahyudia a Department of Informatics, Universitas Amikom Purwokerto, Purwokerto Utara, Banyumas, 55127, Indonesia bFakulti Teknologi Maklumat dan Komunikasi (FTMK), Universiti Teknikal Malaysia Melaka, Melaka, Malaysia Corresponding author:*[azhari@amikompurwokerto.ac.id](azhari@amikompurwokerto.ac.id) Abstract—Unbalanced datasets are a common problem in supervised machine learning. It leads to a deeper understanding of the majority of classes in machine learning. Therefore, the machine learning model is more effective at recognizing the majority classes than the minority classes. Naturally, imbalanced data, such as disease data and data networking, has emerged in real life. DDOS is oneof the network intrusions found to happen more often than R2L. There is an imbalance in the composition of network attacks in Intrusion Detection System (IDS) public datasets such as NSL-KDD and UNSW-NB15. Besides, researchers propose many techniques to transform it into balanced data by duplicating the minority class and producing synthetic data. Synthetic Minority Oversampling Technique (SMOTE) and Adaptive Synthetic (ADASYN) algorithms duplicate the data and construct synthetic data for the minority classes. Meanwhile, machine learning algorithms can capture the labeled data's pattern by considering the input features. Unfortunately, not all the input features have an equal impact on the output (predicted class or value). Some features are interrelated and misleading. Therefore, the important features should be selected to produce a good model. In this research, we implement therecursive feature elimination (RFE) technique to select important features from the available dataset. According to the experiment, SMOTE provides a better synthetic dataset than ADASYN for the UNSW-B15 dataset with a high level of imbalance. RFE featureselection slightly reduces the model's accuracy but improves the training speed. Then, the Decision Tree classifier consistently achievesa better recognition rate than Random Forest and KNN. Keywords—Intrusion detection; feature selection; imbalance; SMOTE; ADASYN. Manuscript received 23 Jul. 2022; revised 26 Dec. 2022; accepted 14 Jan. 2023. Date of publication 31 Mar. 2023. International Journal on Informatics Visualization is licensed under a Creative Commons Attribution-Share Alike 4.0 International License. I. INTRODUCTION With the current high level of internet usage, network attacks pose a serious threat. The attacks are evolving in line with the advance of computing capacity. To ensure the safety of data communication, defensive action must be taken. Therefore, researchers in network defense are working hard all the time to encounter new types of attacks. The important task in network security is to recognize the type of attack. The attack dataset is evolving due to the introduction of new attack techniques. Even though the indicator variables (features) are similar, the type of network intrusion is evolving. Network security researchers provide datasets allowing the machine to recognize attack classes automatically. Many researchers provide KDD99 and NSLKDD [1], [2], [3], [4], while other researchers provide UNSW-NB15 [2], [3], [5], [6], [7], [8] and Liu provide CICIDS2017 [3], and others provide CICDDS001 [9], [10]. Based on publicly available datasets, many researchers develop methods and tools to recognize network intrusions, such as random forest, decision tree, logistic regression, KNN, and ANN. The common problems identified in many academic papers are that certain classes of attacks have rarely happened. Therefore, the available data is limited, while othe

FAQs

Why do unbalanced datasets affect machine learning intrusion detection performance?

They cause models to learn majority classes more deeply, leading to weaker recognition of minority attack classes and overall lower classification performance.

How do SMOTE and ADASYN address class imbalance?

They generate synthetic samples for minority classes by duplicating and constructing new data points, improving representation compared with simple duplication.

What is the role of recursive feature elimination (RFE) in this research?

RFE selects more informative features from the dataset; experiments show it slightly reduces accuracy but improves training speed by removing less useful or misleading features.

Aug 3, 2026

Uploaded by Lucas Martin