Commenced in January 2007
Frequency: Monthly
Edition: International
Paper Count: 32718
A Survey in Techniques for Imbalanced Intrusion Detection System Datasets

Authors: Najmeh Abedzadeh, Matthew Jacobs


An intrusion detection system (IDS) is a software application that monitors malicious activities and generates alerts if any are detected. However, most network activities in IDS datasets are normal, and the relatively few numbers of attacks make the available data imbalanced. Consequently, cyber-attacks can hide inside a large number of normal activities, and machine learning algorithms have difficulty learning and classifying the data correctly. In this paper, a comprehensive literature review is conducted on different types of algorithms for both implementing the IDS and methods in correcting the imbalanced IDS dataset. The most famous algorithms are machine learning (ML), deep learning (DL), synthetic minority over-sampling technique (SMOTE), and reinforcement learning (RL). Most of the research use the CSE-CIC-IDS2017, CSE-CIC-IDS2018, and NSL-KDD datasets for evaluating their algorithms.

Keywords: IDS, intrusion detection system, imbalanced datasets, sampling algorithms, big data.

Procedia APA BibTeX Chicago EndNote Harvard JSON MLA RIS XML ISO 690 PDF Downloads 942


[1] Vaibhav Jayaswal, "Dealing with Imbalanced dataset”,, Oct 18, 202
[2] K. Scarfone, “Guide to intrusion detection and prevention systems (idps),” Comput. Secur. Res. Center, 2012.
[3] L. Dali et al., "A survey of intrusion detection system," 2015 2nd World Symposium on Web Applications and Networking (WSWAN), 2015, pp. 1-6, doi: 10.1109/WSWAN.2015.7210351.
[4] S. Seeber and G.D. Rodosek, "Towards an adaptive and effective IDS using OpenFlow", IFIP International Conference on Autonomous Infrastructure Management and Security, pp. 134-139, 2015, June.
[5] A.K. Sharma, S.K. Saroj and P. Kumar, "Distributed intrusion detection system for wireless sensor networks", IOSR Journal of Computer Engineering, vol. 14, no. 4, pp. 61-70, 2013.
[6] Zachary Hill, John Hale, Mauricio Papa, and Peter J. Hawrylak, “Using Bro with a Simulation Model to Detect Cyber-Physical Attacks in a Nuclear Reactor” 2019 2nd International Conference on Data Intelligence and Security (ICDIS), 2019
[7] C. Huang, Y. Wu, Y. Zuo, K. Pei, and G. Min, “Towards experienced anomaly detector through reinforcement learning,” in Proc. Thirty-Second AAAI Conf. Artif. Intell. (AAAI-18), (Hilton New Orleans Riverside, USA), 2018.
[8] Pratik Satam, Hamid Alipour, Youssif Al-Nashif, and Salim Hariri, “DNS-IDS: Securing DNS in the Cloud Era” 2015 International Conference on Cloud and Autonomic Computing 2015.
[9] Samson Ho, Saleh Al Jufout, Khalil Dajani, and Mohammad Mozumdar, “A Novel Intrusion Detection Model for Detecting Known and Innovative Cyberattacks using Convolutional Neural Network “. IEEE Open Journal of the Computer Society, 2021.
[10] Ahmim, Ahmed, et al. "A novel hierarchical intrusion detection system based on decision tree and rules-based models," In Proceedings of IEEE 15th International Conference on Distributed Computing in Sensor Systems, pp. 228-233, 2019.
[11] M. D. Gregorio and M. Giordano, “An experimental evaluation of weightless neural networks for multi-class classification,” Applied Soft Computing, vol. 72, pp. 338–354, 2018.
[12] M. N. Adnan and M. Z. Islam, “Forest PA: Constructing a decision forest by penalizing attributes used in previous trees,” Expert Systems with Applications, vol. 89, pp. 389–403, 2017.
[13] C.-C. Chang and C.-J. Lin, “LIBSVM: A library for support vector machines,” ACM Transactions on Intelligent Systems and Technology, vol. 2, no. 3, pp. 1–27, 2011.
[14] Zhang Xueqin, Chen Jiahao, Zhou Yue, Han, Liangxiu, Lin Jiajun, “A Multiple-layer Representation Learning Model for Network-Based Attack Detection,” IEEE Access, pp. 1-1. 2019.
[15] Tommaso Zoppi, Andrea Ceccarelli, Andrea Bondavalli, “Into the Unknown: Unsupervised Machine Learning Algorithms for Anomaly-Based Intrusion Detection “. 2020 50th Annual IEEE/IFIP International Conference on Dependable Systems and Networks - Supplemental Volume (DSN-S), 2020.
[16] Zoppi, T., Ceccarelli, A., & Bondavalli, A. (2019, October). “Evaluation of Anomaly Detection algorithms made easy with RELOAD” In Proceedings of the 30th Int. Symposium on Software Reliability Engineering (ISSRE), pp 446-455, IEEE
[17] Tahir Mehmood and Helmi B Md Rais, “Machine Learning Algorithms In Context Of Intrusion Detection” 2016 3rd International Conference On Computer And Information Sciences (ICCOINS), 2016.
[18] D. A. Cieslak, N. V. Chawla, and A. Striegel, ‘‘Combating imbalance in network intrusion datasets,’’ in Proc. IEEE Int. Conf. Granular Comput., May 2006, pp. 732–737.
[19] M. Zamani and M. Movahedi, ‘‘Machine learning techniques for intrusion detection,’’ 2013, arXiv:1312.2177. (Online). Available: http://arxiv. org/abs/1312.2177
[20] M. S. Pervez and D. M. Farid, ‘‘Feature selection and intrusion classification in NSL-KDD cup 99 dataset employing SVMs,’’ in Proc. 8th Int. Conf. Softw., Knowl., Inf. Manage. Appl. (SKIMA), Dec. 2014, pp. 1–6.
[21] H. Shapoorifard and P. Shamsinejad, ‘‘Intrusion detection using a novel hybrid method incorporating an improved KNN,’’ Int. J. Comput. Appl., vol. 173, no. 1, pp. 5–9, Sep. 2017.
[22] S. Bhattacharya, P. K. R. Maddikunta, R. Kaluri, S. Singh, T. R. Gadekallu, M. Alazab, and U. Tariq, ‘‘A novel PCA-firefly based XGBoost classification model for intrusion detection in networks using GPU,’’ Electronics, vol. 9, no. 2, p. 219, Jan. 2020.
[23] P. Parkar and A. Bilimoria, "A Survey on Cyber Security IDS using ML Methods," 2021 5th International Conference on Intelligent Computing and Control Systems (ICICCS), 2021, pp. 352-360, doi: 10.1109/ICICCS51141.2021.9432210.
[24] D. Gümüşbaş, T. Yıldırım, A. Genovese and F. Scotti, "A Comprehensive Survey of Databases and Deep Learning Methods for Cybersecurity and Intrusion Detection Systems," in IEEE Systems Journal, vol. 15, no. 2, pp. 1717-1731, June 2021, doi: 10.1109/JSYST.2020.2992966.
[25] Y. Zhang, X. Chen, L. Jin, X. Wang and D. Guo, "Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data," in IEEE Access, vol. 7, pp. 37004-37016, 2019, doi: 10.1109/ACCESS.2019.2905041.
[26] Matthew Stewart, "Guide to Classification on Imbalanced Datasets”,, December 1, 2020.
[27] C. Vij and H. Saini, "Intrusion Detection Systems: Conceptual Study and Review," 2021 6th International Conference on Signal Processing, Computing and Control (ISPCC), 2021, pp. 694-700, doi: 10.1109/ISPCC53510.2021.9609481.
[28] Ziadoon Kamil Maseer, Robiah Yusof, Nazrulazhar Bahaman, Salama A. Mostafa, and Cik Feresa Mohd Foozy, “Benchmarking of Machine Learning for Anomaly Based Intrusion Detection Systems in the CICIDS2017 Dataset,” IEEE, VOLUME 9, February 3, 2021.
[29] Subiksha Srinivasa Gopalan1, Dharshini Ravikumar1, Dino Linekar, Ali Raza1, Maheen Hasib, “Balancing Approaches towards ML for IDS: A Survey for the CSE-CIC IDS Dataset,” 2020 International Conference on Communications, Signal Processing, and their Applications (ICCSPA), IEEE, 2021.
[30] Lan Liu, Pengcheng Wang, Jun Lin, and Langzhou Liu, “Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning,” vol. 9, December 2021
[31] Moustafa, Nour, and Jill Slay. "UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)." Military Communications and Information Systems Conference (MilCIS), 2015. IEEE, 2015.
[32] C. Kolias et al. “Intrusion Detection in 802.11 Networks”, IEEE communication surveys & tutorials, vol. 18, no. 1, first quarter 2016
[33] Laurens D'hooge (UGent), Tim Wauters (UGent), Bruno Volckaert (UGent) and Filip De Turck (UGent) “Classification Hardness for Supervised Learners on 20 Years of Intrusion Detection Data.” IEEE ACCESS, vol. 7, 2019, pp. 167455–69.
[34] A Realistic Cyber Defense Dataset (CSE-CIC-IDS2018) was accessed on 01/01/2022 from
[35] Mbow, M., Koide, H., & Sakurai, K. (2021). An Intrusion Detection System for Imbalanced Dataset Based on Deep Learning. In Proceedings - 2021 9th International Symposium on Computing and Networking, CANDAR 2021 (pp. 38-47). (Proceedings - 2021 9th International Symposium on Computing and Networking, CANDAR 2021). Institute of Electrical and Electronics Engineers Inc.
[36] G. Karatas, O. Demir and O. K. Sahingoz, "Increasing the Performance of Machine Learning-Based IDSs on an Imbalanced and Up-to-Date Dataset," in IEEE Access, vol. 8, pp. 32150-32162, 2020, doi: 10.1109/ACCESS.2020.2973219.
[37] Xiangyu Ma and Wei Shi, “AESMOTE: Adversarial Reinforcement Learning with SMOTE for Anomaly Detection”, IEEE Transactions on Network Science and Engineering, vol. 8, no. 2, April-June 2021
[38] Fadi Aloul, Imran Zualkernan, Nada Abdalgawad, Lana Hussain, Dara Sakhnini, “Network Intrusion Detection on the IoT Edge Using Adversarial Autoencoders,” 2021 International Conference on Information Technology (ICIT).
[39] M Lopez-Martin, B. Carro and A Sanchez-Esguevillas, “Variational data generative model for intrusion detection”. Knowledge and Information Systems (2018).
[40] X. Jiao and J. Li, "An Effective Intrusion Detection Model for Class-imbalanced Learning Based on SMOTE and Attention Mechanism," 2021 18th International Conference on Privacy, Security and Trust (PST), 2021, pp. 1-6, doi: 10.1109/PST52912.2021.9647756.
[41] J. L. Leevy, T. M. Khoshgoftaar, B. R. A., and S. N., “A survey on addressing high-class imbalance in big data,” J. Big Data, vol. 5, no. 42, 2018.
[42] K. Simonyan and A. Zisserman, “Very deep convolutional networks for large-scale image recognition,” in Int. Conf. Learn. Represent., 2015.
[43] K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. IEEE Conf. Comput. Vision Pattern Recognit., 2016, pp. 770–778.
[44] N. Shone, T. N. Ngoc, V. D. Phai, and Q. Shi, “A deep learning approach to network intrusion detection,” IEEE Trans. Emerg. Top. Comput. Intell., vol. 2, no. 1, pp. 41–50, 2018.
[45] T. A. Tang, L. Mhamdi, D. McLernon, S. A. R. Zaidi, and M. Ghogho, “Deep learning approach for network intrusion detection in software defined networking,” in Proc. Int. Conf. Wirel. Netw. Mob. Commun., 2016, pp. 258–263.
[46] “NSL-KDD dataset,”, Canadian Institute of Cybersecurity
[47] M. Tavallaee, E. Bagheri, W. Lu, and A. Ghorbani, “A Detailed Analysis of the KDD CUP 99 Data Set,” Submitted to Second IEEE Symposium on Computational Intelligence for Security and Defense Applications (CISDA), 2009.
[48] H. Hota and A. Shrivas, “Data Mining Approach for Developing Various Models Based on Types of Attack and Feature Selection as Intrusion Detection Systems (IDS),” Intelligent Computing, Networking, and Informatics, 845–851, 2014.
[49] R. Abdulhammed, M. Faezipour, A. Abuzneid, and A. Abu Mallouh, ``Deep and machine learning approaches for anomaly-based intrusion detection of imbalanced network traffic,'' IEEE sensors Lett., vol. 3, no. 1, Art. no. 7101404, Jan. 2019.
[50] P.-J. Chuang and D.-Y.Wu, ``Applying deep learning to balancing network intrusion detection datasets,'' in Proc. IEEE 11th Int. Conf. Adv. Infocomm Technol. (ICAIT), pp. 213_217, Oct. 2019.
[51] P. Bedi, N. Gupta, and V. Jindal, ``Siam-IDS: Handling class imbalance problem in intrusion detection systems using siamese neural network,'' Procedia Comput. Sci., vol. 171, pp. 780_789, 2020.
[52] A. Ali, S. M. Shamsuddin, and A. L. Ralescu, “Classification with class imbalance problem: A review,” Int. J. Adv. Soft Comput. Its Appl., vol. 7, no. 3, pp. 176–204, 2015.
[53] R. Qaddoura, A. M. Al-Zoubi, I. Almomani and H. Faris, "Predicting Different Types of Imbalanced Intrusion Activities Based on a Multi-Stage Deep Learning Approach," 2021 International Conference on Information Technology (ICIT), 2021, pp. 858-863, doi: 10.1109/ICIT52682.2021.9491634.
[54] Hasan Ersan YAĞCI, “,” Jul 15, 2021
[55] S. J. Yen and Y. S. Lee, “Under-sampling approaches for improving prediction of the minority class in an imbalanced dataset,” Intell. Control Automat., vol. 344, pp. 731–740, 2006.
[56] L. Bao, C. Juan, J. Li, and Y. Zhang, “Boosted near-miss under-sampling on svm ensembles for concept detection in large-scale imbalanced datasets,” Neurocomputing, vol. 172, pp. 198–206, 2016.
[57] Y. Kamei, A. Monden, S. Matsumoto, T. Kakimoto, and K. Matsumoto, “The effects of over and under sampling on fault-prone module detection,” in Proc. First Int. Symp. Empirical Softw. Eng. Meas., (Madrid, Spain), 2007.
[58] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, ‘‘SMOTE: Synthetic minority over-sampling technique,’’ J. Artif. Intell. Res., vol. 16, pp. 321–357, Jun. 2002
[59] R. Blagus and L. Lusa, “Smote for high-dimensional class-imbalanced data,” Blagus Lusa BMC Bioinf., vol. 14, p. 106, 2013.
[60] Nitesh V. Chawla, Kevin W. Bowyer, Lawrence O. Hall, W. Philip Kegelmeyer, “SMOTE: Synthetic Minority Over-sampling Technique”, Journal of Artificial Intelligence Research 16 (2002) 321–357
[61] Sornxayya Phetlasy, Satoshi Ohzahata, Celimuge Wu, and Toshihito Kato, “Applying SMOTE for a Sequential Classifiers Combination Method to Improve the Performance of Intrusion Detection System,” IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress, 2019
[62] N. Qazi, and K. Raza, “Effect of feature selection, synthetic minority over-sampling (SMOTE) and under-sampling on class imbalance classification,” 14th International conference on modelling and simulation, pp. 145-150, 2012.
[63] A. Tesfahun, and D. L. Bhaskari, “Intrusion detection using random forests classifier with SMOTE and feature reduction,” International conference on cloud & ubiquitous computing & emerging technologies, pp. 127-132, 2013
[64] Y. Sun, and F. Liu, “SMOTE-NCL: A re-sampling method with filter for network intrusion detection,” 2nd IEEE International conference on computer and communications, pp. 1157-1161, 2016.
[65] P. Jeatrakul, K. W. Wong, and C. C. Fung, ‘‘Classification of imbalanced data by combining the complementary neural network and smote algorithm,’’ in Proc. Int. Conf. Neural Inf. Process. Springer, 2010, pp. 152–159.
[66] B. Yan and G. Han, ‘‘LA-GRU: Building combined intrusion detection model based on imbalanced learning and gated recurrent unit neural network,’’ Secur. Commun. Netw., vol. 2018, pp. 1–13, Aug. 2018.
[67] A. R. Gad, A. A. Nashat and T. M. Barkat, "Intrusion Detection System Using Machine Learning for Vehicular Ad Hoc Networks Based on ToN-IoT Dataset," in IEEE Access, vol. 9, pp. 142206-142217, 2021, doi: 10.1109/ACCESS.2021.3120626.
[68] T N Varunram, Shivaprasad M B, Aishwarya K H, Anush Balraj, Savish S V, and Ullas S, " Analysis of Different Dimensionality Reduction Techniques and Machine Learning Algorithms for an Intrusion Detection System," 2021 IEEE 6th International Conference on Computing, Communication and Automation (ICCCA).
[69] G. Batista, B. Bazzan, M. Monard, “Balancing Training Data for Automated Annotation of Keywords: A Case Study,” In WOB, 10-18, 2003
[70] K. Matsuda and K. Murase, "Single-Layered Complex-Valued Neural Network with SMOTE for Imbalanced Data Classification," 2016 Joint 8th International Conference on Soft Computing and Intelligent Systems (SCIS) and 17th International Symposium on Advanced Intelligent Systems (ISIS), 2016, pp. 349-354, doi: 10.1109/SCIS-ISIS.2016.0079.
[71] B. Yan, G. Han, M. Sun and S. Ye, "A novel region adaptive SMOTE algorithm for intrusion detection on imbalanced problem," 2017 3rd IEEE International Conference on Computer and Communications (ICCC), 2017, pp. 1281-1286, doi: 10.1109/CompComm.2017.8322749.
[72] T. E. Tallo and A. Musdholifah, "The Implementation of Genetic Algorithm in Smote (Synthetic Minority Oversampling Technique) for Handling Imbalanced Dataset Problem," 2018 4th International Conference on Science and Technology (ICST), 2018, pp. 1-4, doi: 10.1109/ICSTC.2018.8528591.
[73] Erwin Kurniawan, Fhira Nhita, Annisa Aditsania, and Deni Saepudin, “C5.0 Algorithm and Synthetic Minority Oversampling Technique (SMOTE) for Rainfall Forecasting in Bandung Regency,” 2019 7th International Conference on Information and Communication Technology (ICoICT).
[74] Ilyas Adeleke Jimoh, Idris Ismaila, and Morufu Olalere, “Enhanced Decision Tree - J48 With SMOTE Machine Learning Algorithm for Effective Botnet Detection in Imbalance Dataset,” 15th International Conference on Electronics Computer and Computation (ICECCO 2019).
[75] T. Lu, Y. Huang, W. Zhao and J. Zhang, "The Metering Automation System based Intrusion Detection Using Random Forest Classifier with SMOTE+ENN," 2019 IEEE 7th International Conference on Computer Science and Network Technology (ICCSNT), 2019, pp. 370-374, doi: 10.1109/ICCSNT47585.2019.8962430.
[76] C. Andrieu, N. de Freitas, A. Doucet, and M. I. Jordan, “An introduction to MCMC for machine learning,” Mach. Learn., vol. 50, no. 1-2, pp. 5–43, 2003.
[77] N. Metropolis and S. Ulam, “The Monte Carlo method,” J. Am. Stat. Assoc., vol. 44, no. 247, pp. 335–341, 1949.
[78] S. Geman and D. Geman, “Stochastic relaxation, Gibbs distributions, and the Bayesian restoration of images,” IEEE Trans. Pattern Anal. Mach. Intell., vol. 6, no. 5-6, pp. 721–741, 1984.
[79] K. P. Murphy, Machine learning: A probabilistic perspective, The MIT Press., 2012.
[80] G. C. Wei and M. A. Tanner, “A Monte Carlo implementation of the EM algorithm and the poor man’s data augmentation algorithms,” J. Am. Stat. Assoc., vol. 85, no. 411, pp. 699–704, 1990.
[81] N. Abedzadeh, M. Jacobs, “Using Markov Chain Monte Carlo Algorithm for Sampling Imbalance IDS Datasets”, The 31st International Conference on Computer Communications and Networks (ICCCN 2022), July 25 - July 28, 2022, Submitted for review.
[82] He Zhang, Xingtui Yu, Han Xiao, Peng Ren, Chunbo Luo, and Geyong Min, “Deep Adversarial Learning in Intrusion Detection: A Data Augmentation Enhanced Framework” draft paper, January 2019. Preprint available in link ““ downloaded January 2022.
[83] A. Servin, “Multi-Agent Reinforcement Learning for Intrusion Detection”. PhD thesis, University of York. 2009.
[84] K. Malialis, “Distributed Reinforcement Learning for Network Intrusion Response”, PhD thesis, University of York. 2014.
[85] M. Li, Y. Sun, H. Lu, S. Maharjan, and Z. Tian, “Deep reinforcement learning for partially observable data poisoning attack in crowdsensing systems,” IEEE Internet Things J., 2020.
[86] M. A. Wiering et al., "Reinforcement learning algorithms for solving classification problems,” IEEE Symposium on Adaptive Dynamic Programming and Reinforcement Learning (ADPRL), Paris, 2011, pp. 91-96.
[87] M. G. Lagoudakis and R. Parr, “Reinforcement Learning as Classification: Leveraging Modern Classifiers” In Proceedings of the 20th International Conference on Machine Learning (ICML-03), 424–431, 2003, Washington, DC, USA.
[88] K. H. Quah, C. Quek and G. Leedham, "Pattern classification using fuzzy adaptive learning control network and reinforcement learning," Proceedings of the 9th International Conference on Neural Information Processing. ICONIP '02., Singapore, 2002, pp. 1439-1443 vol.3. 2002.
[89] G. Caminero and B. Lopez-Martin, M. Carro, “Adversarial environment reinforcement learning algorithm for intrusion detection,” Comput. Netw., vol. 159, pp. 96–109, 2019.
[90] R. Elderman et al., “Adversarial Reinforcement Learning in a Cyber Security Simulation” International Conference on Agents and Artificial Intelligence (ICAART 2017).
[91] M. Zhu, Z. Hu and P. Liu, “Reinforcement Learning Algorithms for Adaptive Cyber Defense against Heartbleed” Proceedings of the First ACM Workshop on Moving Target Defense, Pages 51-58, 2014.
[92] I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y. Bengio, “Generative adversarial nets,” in Proc. Adv. Neural Inf. Process. Syst., 2014, pp. 2672–2680.
[93] H. Zhang, C. Luo, X. Yu, and P. Ren, “Mcmc based generative adversarial networks for handwritten numeral augmentation,” in Proc. Int. Conf. Commun. Signal Process. Syst., 2017, pp. 2702–2710.
[94] J. Wu, C. Zhang, T. Xue, B. Freeman, and J. Tenenbaum, “Learning a probabilistic latent space of object shapes via 3d generative-adversarial modeling,” in Proc. Adv. Neural Inf. Process. Syst., 2016, pp. 82–90
[95] M. Arjovsky, S. Chintala, and L. Bottou, “Wasserstein generative adversarial networks,” in Proc. Int. Conf. Mach. Learn., 2017, pp. 214– 223.
[96] M. Arjovsky and L. Bottou, “Towards principled methods for training generative adversarial networks,” in Int. Conf. Learn. Represent., 2017.
[97] Peng Shi, Xuebing Chen, Xiangying Kong, and Xianghui Cao, “SE-IDS: A Sample Equalization Method for Intrusion Detection in Industrial Control System,” 36th Youth Academic Annual Conference of Chinese Association of Automation (YAC), 2021.
[98] A. Makhzani, J. Shlens, N. Jaitly, I. Goodfellow, and B. Frey, “Adversarial Autoencoders,” ArXiv151105644 Cs, May 2016. Available at:
[99] Fadi Aloul, Imran Zualkernan, Nada Abdalgawad, Lana Hussain, Dara Sakhnini, “Network Intrusion Detection on the IoT Edge Using Adversarial Autoencoders,” 2021 International Conference on Information Technology (ICIT)