Addressing Imbalanced Data in Network Intrusion Detection: A Review and Survey

Abstract

The proliferation of internet-connected devices, including smartphones, smartwatches, and computers, has led to an unprecedented surge in data generation. The rapid rise in device connectivity points to an urgent need for robust cybersecurity measures to counter the mounting wave of cyber threats. Among the strategies aimed at establishing efficient network intrusion detection systems, the integration of machine learning techniques is a prominent avenue. However, the application of machine learning models to imbalanced intrusion detection datasets, such as NSL-KDD, CICIDS2017, and UGR'16, presents challenges. In such intricate scenarios, accurately distinguishing network intrusions poses a formidable challenge. The term "imbalance" refers to the imbalanced distribution of data across classes, which adversely affects the precision of machine learning algorithm classifications. This comprehensive survey embarks on a thorough exploration of the spectrum of methodologies proposed to address the challenge of imbalanced data. Simultaneously, it assesses the efficacy of these methodologies within the realm of network intrusion detection. Moreover, by shedding light on the potential consequences of not effectively tackling imbalanced data, this study aims to provide a holistic understanding of the intricate interplay between machine learning and intrusion detection in imbalanced settings.