# A Robust Intrusion Detection Approach for Imbalanced Network Traffic Using ADASYN-Based Ensemble Learning

Thilagavathi N, Vigneswari T, Farjana Farvin Sahapudeen, Kalaiselvi N

► To cite this version:

Thilagavathi N, Vigneswari T, Farjana Farvin Sahapudeen, Kalaiselvi N. A Robust Intrusion Detection Approach for Imbalanced Network Traffic Using ADASYN-Based Ensemble Learning. 2025. hal-05041761

HAL Id: hal-05041761

https://hal.science/hal-05041761v1

Preprint submitted on 30 Apr 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# A Robust Intrusion Detection Approach for Imbalanced Network Traffic Using ADASYN-Based Ensemble Learning

SAGE

Thilagavathi N¹, T. Vigneswari², Farjana Farvin Sahapudeen³, N.Kalaiselvi ⁴

¹ Department of Information Technology, Sri Manakula Vinayagar Engineering College, Puducherry, India, thilagavathiit@smvec.ac.in

² Department of Computer Science and Engineering, Anjalai Ammal Mahalingam Engineering College, Kovilvenni, Tamil Nadu, India, vigneswarirt@gmail.com

³ Department of Computer Science and Engineering, Sastra Deemed University, Srinivasa Ramanujan Centre, Kumbakonam, Tamil Nadu, India, farjanafarvin@src.sastra.ac.in

⁴ Department of Information Technology, Sri Manakula Vinayagar Engineering College, Puducherry, India, selvimtech29@gmail.com

## Abstract

A critical challenge posed in cybersecurity is detecting intrusions in imbalanced network traffic. Many classical Intrusion detection systems are available to mitigate such threats but employing Machine learning algorithms enhance the accuracy of the same in a significant manner. This article proposes an ensemble consisting of ADASYN, Auto encoder, Random Forest, LightGBM, and Boost to improve the intrusion detection system. The Adaptive Synthetic Sampling (ADASYN) deploys nearest neighbors to adaptively generate synthetic points for handling class imbalance. Auto encoder is included to provide meaningful feature extraction without missing any anomaly. Random Forest, LightGBM, and Boost are employed for classifying attacks with high Precision. We have conducted the experiment on the typical intrusion dataset NSL-KDD and inclusive intrusion dataset CICIDS2018 which includes diverse attack patterns. The dataset is split into imbalanced and balanced sets based on the count of each type of attack and ADASYN improves the fewer instances of certain attack labels sets. We have compared the experiment results of the proposed ADASYN based ensemble with other oversampling techniques such as Random oversampling and Synthetic Minority Over-Sampling Technique (SMOTE). Experimental outcomes exhibit that our proposed framework sampling with the ADASYN algorithm provides a maximum of 99.85% of detection accuracy in all four performance metrics with the LightGBM which is greater than the other algorithms. Additionally, ADASYN demonstrated superior performance in balancing the dataset and improving the model's generalization capabilities, responsiveness, and resilience to adversarial attacks. Thus offering a reliable solution for enhancing the security posture of organizations in real time, dynamic network environments.

## Keywords

Intrusion Detection System, Random Forest, Adaptive Synthetic Sampling, XG Boost, Extreme Gradient Boosting, Light Gradient Boosting Machine

## Introduction

Network intrusion detection system (NIDS) plays an indispensable role in ensuring robust defense in cybersecurity for the modern highly connected global landscape. NIDS is designed with the goal to tirelessly monitor network traffic for any signs of suspicious or unauthorized activity. It operates by analyzing incoming and outgoing packets. NIDS can detect various types of malicious activities, such as unauthorized access attempts, malware infections, and denial-of-service attacks. Its ability to quickly detect and mitigate security breaches makes NIDS a crucial asset for safeguarding sensitive information and maintaining the integrity of network infrastructure. The idea of Intrusion detection was initially introduced by James Anderson in 1980 and in recent days researchers extensively explore the application of machine learning techniques in this field [1].

Intrusion Detection Systems (IDS) have evolved significantly, adapting to the changing landscape of cyber threats. In earlier stages, intrusion detection systems primarily relied on signature-based detection, where known patterns of malicious activity were compared against incoming data. But Nowadays, missing values, class imbalances, and irrelevant features are critical factors that potentially reduce the accuracy of identifying malicious activities and increase the occurrence of false positives within the system [2].

Modern IDS employ advanced methods like anomaly detection, machine learning, and real-time

analysis, bolstered by integration with threat intelligence feeds, enhancing accuracy and responsiveness [3]. Network intrusion detection utilizing machine learning algorithms aims to enhance accuracy and efficiency in identifying and mitigating security threats [4]. In machine learning-based intrusion detection systems, various types of attacks are classified and detected, including benign activity, bot attacks, brute force attacks, and infiltration attacks [5]. Various machine learning techniques, such as support vector machines (SVM), K-means, and logistic regression, have been utilized in network intrusion detection to identify and classify different types of attacks [6]. The effectiveness of this model was validated against all possible metrics, such as accuracy, precision, recall, F1-score, ROC AUC, confusion matrix, cross-validation etc. [7].

Ensemble learning merges predictions from several models to achieve superior performance compared to any single model. By pooling insights from diverse models, each with its own strengths and weaknesses, ensemble learning enhances predictive accuracy and generalization [8].

Malicious cyber-attacks can frequently hide in massive amounts of benign data due to imbalanced network traffic. The great degree of covertness and confusion in cyberspace makes it difficult for NIDS to assure accurate and timely detection. Due to this, Existing IDS suffer from class imbalance, in which attack samples are much less than regular traffic, resulting in poor detection of minority class attacks. To address the challenge of imbalanced network traffic, we propose a novel ensemble machine learning approach using ADASYN algorithm (Adaptive Synthetic Set Sampling).
This algorithm generates synthetic samples for the minority class which effectively reduce imbalance ratio. Incorporating ADASYN into the classification model learning process enhances the ability to learn difficult samples, thereby improving overall performance. Further, the ensemble encompasses prevailing classification techniques such as LightGBM, random forest and XGBoost, for better feature reduction and selection methods. Additionally, it emphasizes the importance of ensemble classifiers in boosting efficiency and performance by combining multiple algorithms. This integrated approach aims to improve the preciseness and fidelity of network intrusion detection systems for detecting and mitigating security threats. We test our proposed framework with NSL-KDD and comprehensive intrusion dataset CICIDS2018 which are known for consisting of highly imbalanced dataset.

The contributions of proposed ADASYN Based Ensemble can be revealed in three folds:

i. This work deploys ADASYN algorithm, focusing on generating synthetic samples for instances that are closer to the decision boundary. Thus preventing classifier being biased towards normal traffic and accurately detecting attacks

ii. Auto encoder ensures that meaningful features are extracted from network traffic and discovers hidden traffic patterns. It identifies all anomalous traffic that are challenging to categories with conventional techniques

iii. The classification model such as Random Forest, XGBoost, LightGBM accurately categories attacks and effectively manages unbalanced classes and missing data.

Remaining content of this article is organized as follows: The second section examines relevant research in the fields of ensemble learning, class imbalance, and intrusion detection. The suggested ADASYN-based ensemble intrusion detection system is briefed in the section that follows. The experimental analysis of the suggested method is then thoroughly discussed. A summary of the results and suggestions for further research conclude the article.

## 2. LITERATURE SURVEY

### A) SYSTEM FOR DETECTING INTRUSIONS (IDS):

In the field of machine learning-driven intrusion detection systems, scholars predominantly differentiate between regular network activity and irregular occurrences. They accomplish this by employing various techniques to condense data, group similar patterns, and categorize instances, all with the ultimate goal of identifying potentially malicious actions

Liu et al. [9] investigated the inherent imbalance between normal and abnormal traffic data in intrusion detection systems (IDS) and proposed the Difficult Set Sampling Technique (DSSTE) to address this issue. DSSTE dynamically adjusts sampling rates based on the complexity and volatility of network traffic patterns, thereby improving intrusion detection accuracy.

Guo Pu et al. [10] proposed a novel Sub-Space Clustering (SSC) which groups similar data points and One

Class Support Vector Machine (OCSVM) identifies outliers within each cluster using OCSVM. These algorithms enhance detection accuracy by capturing diverse intrusion patterns present in complex network environments. Abdallah R. Gad et al. [11] concentrated on improving the Vehicular Ad-hoc Networks (VANETs) security by employing a hybrid approach that integrated machine learning algorithms such as Support Vector Machine (SVM) and Random Forest (RF). The framework aimed to accurately classify malicious activities within VANETs, accounting for dynamic attack strategies and changing network topologies. This approach ensured strong detection performance while keeping false positives to a minimum. Wisanwanichthan et al. [12] introduced a double-layered intrusion detection system based on Naive Bayes and Support Vector Machine (SVM). This two-layered structure first employs Naive Bayes for preliminary classification and then refines the results using SVM for improved accuracy.

Kim et al. [13] discussed about early network intrusion detection system that utilizes machine learning algorithms that analyze network traffic data in real time and promptly detect and mitigate emerging threats. By integrating both anomaly-based and signature-based detection methods, the system ensures comprehensive threat coverage while minimizing potential damage caused by attacks.

Mbona et al. [14] addressed the challenge of finding zero-day attacks using semi-supervised techniques. The approach uses labeled (known attacks) and unlabeled (unknown data) samples to improve resilience against evolving cyber threats, thereby enhancing overall system security. The evaluation of the algorithm's performance involved using publicly available intrusion detection datasets, including those with labeled and unlabeled samples to recreate dynamic situations.

Olewi [15] discussed the pros and cons of various approaches, offering prominent suggestions for researchers in this field. The survey's findings were drawn from the analysis of diverse datasets used in prior research studies, encompassing various intrusion detection scenarios.

Fernando et al. [16] proposed a methodology to enhance intrusion detection in the Internet of Things (IoT) domain using machine learning models aimed at improving model generalization in IoT settings. By considering the resource constraints and heterogeneous nature of IoT environments, the proposed approach ensured robust anomaly detection while minimizing false alarms. The evaluation utilized the newly introduced IDSAI dataset, specifically designed to capture the complexities of IoT traffic and facilitate the assessment of intrusion detection systems tailored for IoT environments

Zou et al. [17] presented HC-DTTSVM, a novel network intrusion detection method that integrates Decision Tree Twin Support Vector Machine (DTTSVM) with hierarchical clustering techniques. In network environments, this kind of hybrid approach aims to improve the accuracy and effectiveness of intrusion detection systems by efficiently handling large-scale datasets with diverse intrusion patterns.

AnaaAttou et al. [18] utilized the Random Forest (RF) algorithm in a cloud-based intrusion detection system. The system leveraged the NSL-KDD dataset for training and
evaluation, showcasing the scalability and reliability of cloud-based intrusion detection architectures. By enabling timely detection and response to potential security threats, the proposed system enhanced the overall security posture of cloud environments.

## B) CLASS IMBALANCING:

Machine learning models are severely hampered in the field of network intrusion detection by imbalanced data, when attack occurrences are substantially fewer than typical traffic. Data imbalances make it difficult for network intrusion detection to identify breaches when routine traffic far outweighs attackers. In order to prevent this, researchers are producing synthetic attack data and exploring alternative methods for managing unbalanced datasets. Even work on intrusion detection for recently established environments with inadequate attack data is occurring.

Gad et al. [19] specifically focuses on intrusion detection systems designed for Vehicular Ad Hoc Networks (VANETs). Utilizing the ToN-IoT dataset, the author explores the complexities of detecting and mitigating intrusions within the distinctive network environment of VANETs.

Manuel Lopez-Martin et al. [20] presented a novel approach to network intrusion detection using an extended neural network (NN) that employs the Radial Basis Function (RBF). The integration of offline reinforcement learning techniques enhances the network's adaptability to evolving threat landscapes across various network environments.

Dina et al. [21] investigated the impact of synthetic data usage in balanced datasets on the performance of machine learning (ML) algorithms for intrusion detection in computer networks. The study aims to enhance classifier effectiveness by addressing data imbalance issues.

Murat Dener [22] introduced STLGBM-DDS, an efficient data-balanced Denial-of-Service (DoS) detection system designed for wireless sensor networks in big data environments. The system is specifically tailored to effectively detect and mitigate DoS attacks while maintaining data balance.

Zhu et al. [23] explored unbalanced data processing and decision-making in network attacks using AEC_GAN. The authors employed Adversarial Encoder-Decoder Generative Adversarial Networks (AEC_GAN), along with machine learning techniques, to enhance decision-making capabilities in the presence of imbalanced data. Bakro et al. [24] Proposed a model for a cloud intrusion detection technique by combining hybrid feature selection methods with machine learning algorithms. The system demonstrates robustness and adaptability in identifying and mitigating intrusion attempts within cloud environments, and also addresses the class imbalance problem in intrusion detection within Software-Defined Networking (SDN).

Mirsadeghi et al. [25] emphasized the importance of learning from limited cyber attack instances to enhance the resilience of intrusion detection systems in Software-Defined Networking (SDN) environments.

Picard et al. [26] introduced a risk-based authentication system that utilizes reinforcement learning

techniques to enhance authentication processes by dynamically adapting to evolving risks and threats.

## C) ENSEMBLE LEARNING

Addressing the need for precise elemental quantitative analysis through Laser-Induced Breakdown Spectroscopy (LIBS), Zeng et al. [27] introduced the Hackem-LIBS ensemble model. This approach combines algorithms such as Random Forest, Gradient Boosting, and Neural Networks to ensure enhanced accuracy and reliability in elemental analysis.

Bandar Alotaib [28] proposes a transportation mode detection system that integrates Decision Trees, Support Vector Machines (SVM), and K-Nearest Neighbors (KNN) algorithms. Decision Tree algorithms are employed for improving interpretability and ability to capture nonlinear relationships between features. SVMs are effective in separating different transportation modes in high-dimensional feature spaces, while KNN relies on similarity measures to classify data points. By combining these algorithms, the system accurately identifies diverse transportation modes, thereby enhancing the efficiency and dependability of transportation monitoring

Mansoor et al. [29] presented a predictive model for crash severity prediction that leverages a two-layer ensemble approach. The model incorporates Random Forest, Gradient Boosting, and Logistic Regression algorithms. Random Forest is utilized for its robustness against overfitting and its ability to handle high-dimensional data; Gradient Boosting sequentially improves model performance by minimizing errors through iterative training; and Logistic Regression provides insights into the relationship between variables and crash severity. By ensembling these algorithms, the model enhances the accuracy of crash severity prediction, facilitating efficient resource allocation and prioritization for emergency responders.

Seth et al. [30] introduced a novel framework for multi-attack classification in Intrusion Detection Systems (IDS). The framework ranks machine learning classifiers—such as Random Forest(RF), Neural Networks (NN), and Gradient Boosting(GB), based on their effectiveness in detecting various types of attacks. Random Forest is familiar for its capacity to handle imbalanced data and provide feature importance rankings, while Gradient Boosting enhances model performance by focusing on misclassified instances through sequential learning. Neural Networks are effective in capturing complex patterns within the data. By leveraging the strengths of these algorithms, the framework improves the detection rate for multi-attack classification, thereby enhancing the overall performance of IDS.

By understanding familiar patterns in large volumes of network traffic, intrusion detection systems can recognize attacks more effectively [31]. Although ensemble methods are widely used in classification tasks, identifying temporal patterns in IDS data is challenging due to the dynamic nature of cyber threats. Yang et al. [32] discussed the challenges of applying ensemble methods to IDS, particularly in identifying temporal patterns. Therefore, algorithms like Random Forest, Gradient Boosting, and Neural Networks may need to be adapted or enhanced to effectively capture temporal patterns in IDS data.

Gau et al. [33] explained the idea of integrating
multiple ML (machine learning) models, as ensemble learners to improve predictive performance. These base learners can vary in nature, including decision trees, neural networks, or support vector machines. The ensemble method aggregates the predictions of these models through techniques such as averaging or voting to produce a final prediction. Each algorithm brings its own strengths to the ensemble, contributing to the collective wisdom of the models and enhancing overall predictive accuracy.

The ensemble method aggregates the predictions of these models, typically through techniques such as averaging or voting, to produce a final prediction that ideally outperforms any individual model. This approach leverages the collective wisdom of diverse models, mitigating weaknesses and enhancing overall predictive accuracy [34].

A unique approach, such as the voting mechanism, enables ensemble methods to excel in reaching a final decision. Even though all the classifiers are independent, if more than half of the base classifiers misclassify the same record, then the final result of ensemble learning may still lead to misclassification. This collective decision-making process improves accuracy by reducing the likelihood of errors [35].

Many researchers employ various techniques such as interpolation of synthesis data, encoding, oversampling the data, and other techniques to balance the training data set, resulting in improved experimental performance. While these methods effectively expand the minority class and

synthesize data closely resembling real data, they may encounter challenges when the test data distribution exceeds the trained range, leading to inaccurate predictions by the classifier.

To address this issue, we propose the ADASYN algorithm. ADASYN stands for Adaptive Synthetic Sampling Approach for Imbalanced Learning. Unlike traditional oversampling methods, ADASYN focuses on various complex samples from the imbalanced training set. It dynamically adjusts the sampling rate based on the density of minority samples, effectively compressing the majority class while zooming in or out on the continuous attributes of the minority class. This adaptive approach not only reduces the data imbalance but also generates synthetic data that better conforms to the true distribution, enhancing the classifiers predictive.

### III. Proposed Ensemble Based Machine Learning Intrusion Detection System:

The proposed Machine learning ensemble for intrusion detection in addressing imbalanced network traffic for intrusion detection employs the following algorithms

* Adaptive Synthetic Sampling (ADASYN) algorithm.

* Random Forest,

* XGBoost,

* LightGBM,

* Auto encoders algorithm

<figure><img src="image_2.png" /><figcaption>Figure 1. Architecture of the Proposed Network Intrusion Detection Model</figcaption></figure>

#### A) Adaptive Synthetic Sampling (ADASYN):

A crucial aspect of data analysis is identifying and addressing class imbalance, where normal traffic significantly outnumbers attacks. In this stage we employ ADASYN, or Adaptive Synthetic Sampling Approach as we are using imbalanced dataset.

ADASYN, or Adaptive Synthetic Sampling Approach [36], is a method designed to address the imbalance problem often encountered in machine learning datasets, with a particular focus on the minority class, which typically has fewer instances. ADASYN generates synthetic data points utilizing k-nearest neighbor's algorithm to assess the density of minority class instances surrounding each data point. Instances located in regions of lower density, indicating underrepresentation of the minority class, receive more attention in the synthetic data generation process. Thus ensuring that the model is exposed to a more balanced representation, leading to improved classification

performance and enable the model to better learn from underrepresented examples.

ADASYN is employed in this IDS rectify imbalance between the normal dataset by generating synthetic data points for underrepresented classes i.e. attacks. This creates a more balanced dataset, allowing the training model for effective learning from all classes.

a) **Data Acquisition:** The process begins with where a dataset is collected to serve as the foundation for model learning. This data is then meticulously preprocessed to ensure its quality and suitability for analysis. Preprocessing tasks involve cleaning inconsistencies, handling missing values, and converting categorical data into a format usable by machine learning algorithms. In this case we test the proposed framework in NSL-KDD and CSE-CIC-IDS2018 which is standard dataset for experiments related to intrusion detection.

b) **Training and Testing Dataset:**
Once preprocessed, the dataset was separated into training and testing datasets. The training dataset, which represents the majority of the data, is used to train the model to recognize patterns associated with both normal and anomalous traffic behavior. The test set, consisting of unseen data, acts as an independent benchmark to evaluate the model's capability to generalize and make precise predictions.

### c) Training

With a balanced dataset, the model undergoes training, often utilizing ensemble learning techniques. Ensemble learning involves training multiple models simultaneously and combining their predictions for a final output. This approach leverages the strengths of diverse models, primary to enhanced accuracy and robustness, especially while handling complex datasets. The proposed model is trained and tested using a machine learning (ML) algorithms such as Random Forest, LightGBM, XGBoost, and deep learning algorithm auto encoders. Each algorithm brings its own set of advantages and is suitable for different types of data and problem domains. By employing a range of algorithms, the model can capture diverse patterns present in the dataset, resulting in a more comprehensive and accurate intrusion detection method.

## B) RANDOM FOREST:

Leo Breiman [37] introduced the Random Forest algorithm in 2009. Random Forest is a supervised learning technique known for its predictive prowess, leveraging decision trees and the Bagging method for training. The Random Forest algorithm follows an ensemble learning methodology that constructs a multitude of decision trees, each trained based on a bootstrap sample of the original dataset [20]. At each node of each tree, a subset of features is considered for splitting, ensuring diversity among the trees and reducing overfitting. During prediction, each tree independently classifies new samples, and the final prediction is determined by aggregating the individual tree predictions. Random Forest is favored for intrusion detection due to its capacity to manage high-dimensional data, resistance to overfitting, and ensemble nature, which allows it to confine a broad range of patterns and anomalies present in network traffic data.

### C) XGBOOST:

Tianqi Chen and Carlos Guestrin [38] proposed extreme gradient boosting (XGBoost), a scalable machine learning framework designed specifically for tree boosting algorithms. XGBoost is an ensemble method that iteratively generates a series of decision trees, where each tree corrects the mistake of the previous ones. Initially, all data points have equal weight, but as the process progresses, the weights are adjusted based on model performance. This iterative improvement process continues until a final classifier is formed, resulting in a powerful predictive model capable of handling complex datasets. XGBoost offers the advantage of supporting linear classifiers and enhancing accuracy through Taylor expansion in the cost function. This expansion involves introducing the second derivative, thereby refining the model's results [39]. XGBoost can effectively learn complex decision boundaries and accurately identify anomalous activities, making it well-suited for detecting various types of cyber threats. Its speed

and scalability enable real-time monitoring and response, crucial for ensuring the security of computer networks.

## D) LIGHT GBM:

Guolin Ke (Microsoft) introduced LightGBM in 2017 [40]. It is a powerful gradient boosting model excel at handling large-scale datasets and achieving high computational efficiency. GOSS addresses the issue of gradient estimation by focusing on the instances with larger gradients, while EFB combines exclusive features to reduce memory consumption and enhance computational efficiency. By constructing decision trees in a leaf-wise, LightGBM significantly reduces the number of nodes while maintaining model performance. Additionally, LightGBM supports parallel and distributed training, changing it as appropriate for big data applications.

## E) AUTOENCODER:

The autoencoder algorithm is a neural network architecture applied for unsupervised learning, particularly in the field of deep learning. It comprises an encoder that analyzes the lower-dimensional data as input and reconstructs the original input using a decoder network. During training, the autoencoder learns to minimize the reconstruction error, effectively capturing the most salient features of the input data. Wenfeng Xu et al. stated compression-decompression process enables the autoencoder to understand the meaningful details of the data, often revealing hidden patterns or structures. Autoencoders find applications in various domains such as data compression, anomaly detection, denoising, and dimensionality reduction. Autoencoders can effectively detect and alert on any deviations or abnormalities, making them valuable for cybersecurity applications.

# IV. EXPERIMENT ANALYSIS AND DISCUSSION

In this study, we utilized traditional machine learning algorithms such as Random Forest (RF), XGBoost, LightGBM, and Auto encoder. We compared these methods with various oversampling techniques, including Adaptive Synthetic Minority Sample (ADASYN), Random Under-sampling (RUS), Random Over-sampling (ROS), and Synthetic Minority Over-Sampling Technique (SMOTE).

## A. BENCHMARK DATASET

CSE-CIC-IDS2018 and NSL-KDD datasets are used as benchmark datasets for the experiments. NSL-KDD is a well-known dataset in intrusion detection, derived from the KDD99 dataset but with improvements. It offers a test set with varying difficulty levels and consists of 41 features per sample. CSE-CIC-IDS2018 offers a test set with varying difficulty levels, allowing researchers to evaluate intrusion detection methods across different levels of complexity in network attacks. The dataset comprises 83 parameters per sample, providing a comprehensive set of features for training and evaluating intrusion detection models. It serves as a valuable benchmark for evaluating different intrusion detection methods. Together, these benchmark datasets offer a robust foundation for exploring and advancing intrusion detection methodologies, addressing various challenges and scenarios encountered in real-world network environments.
<table><caption>Table 1. NSL-KDD Dataset Characteristics</caption><thead><tr><td>Attributes</td><td>Features</td></tr></thead><tbody><tr><td>1-10</td><td>Foundational connection attributes</td></tr><tr><td>11-23</td><td>Data-centric characteristics</td></tr><tr><td>24-30</td><td>Temporal network indicators</td></tr><tr><td>30-41</td><td>Host-specific traffic attributes</td></tr></tbody></table>

In our study, we utilized UMAP for the visualization of network intrusion detection datasets, SL-KDD and CSE-CICIDS2018, employing dimensionality reduction techniques. We categorized the NSL-KDD into five distinct classes: Normal, R2L, Probe, DOS, and U2R. The CSE-CICIDS2018 dataset encompasses classes including BENIGN, Bot, BruteForce, DoS, Infiltration, PortScan, and WebAttack, capturing the diverse range of network traffic patterns and behaviors for comprehensive intrusion detection analysis. Both NSL-KDD and CSE-CICIDS2018 datasets exhibit highly imbalanced distributions, with normal traffic instances vastly outnumbering abnormal ones. Our extensive analysis conducted on various samples, underscores the substantial disparity between normal and abnormal traffic instances, aligning with real-world network traffic distributions. The figure 2 and figure 3 depicts the visualization of both the datasets using UMAP

<table><caption>Table 2. Key Features of the CSE-CIC-IDS2018 Dataset</caption><thead><tr><td>Attributes</td><td>Features</td></tr></thead><tbody><tr><td>1-5</td><td>Core network connection attributes</td></tr><tr><td>5-16</td><td>Packet-level traffic characteristics</td></tr><tr><td>17-22</td><td>Network flow features</td></tr><tr><td>23-45</td><td>Flow statistics</td></tr><tr><td>46-63</td><td>Content-based traffic indicators</td></tr><tr><td>64-67</td><td>Sub flow characteristics</td></tr><tr><td>68-80</td><td>General network attributes</td></tr><tr><td>81-83</td><td>General characteristics of system interconnections</td></tr><tr><td>46-63</td><td>Content-based traffic indicators</td></tr></tbody></table>

<figure><img src="image_3.png" /><figcaption>ALGORITHM 1: ADASYN ALGORITHM</figcaption></figure>

<figure><img src="image_4.png" /><figcaption>Figure 2. Visual Representation of the NSL-KDD Dataset Using UMAP</figcaption></figure>
<figure><img src="image_5.png" /><figcaption>Figure 3. Visualizing the CSE-CIC-IDS2018 Dataset
(B) Using UMAP</figcaption></figure>

To ensure the balance of our datasets for effective training and testing, we followed an 80-20 split, with 80% of the data allocated for training and 20% for testing purposes. This partitioning strategy allows for robust model training while providing a reliable evaluation of model performance on unseen data.

## B. DATA PREPROCESSING:

Upon extraction of the dataset, various issues such as noisy data, duplicate values, missing values, and infinity values may be present due to extraction or input errors. Certain features are deleted or transformed based on the dataset. For the CSE-CIC IDS2018 dataset, features like 'Timestamp', 'Destination Address', 'Source Address', and 'Source Port' are deleted. Additionally, if features 'Init Bwd Win Byts' and 'Init Fwd Win Byts' have a value of -1, two check dimensions are added, marking -1 as 1 and 0 otherwise. In NSL-KDD, one-hot encoding is used to transform categorical features like protocol types ('TCP', 'UDP', 'ICMP') into binary vectors. This increases the dimensionality of the feature vector.

Numerical standardization is applied to eliminate dimensional differences between features and facilitate gradient descent and model convergence. This involves transforming each feature to have a mean of 0 and a standard deviation of 1, creating a standard normal distribution.

## C. EXPERIMENTAL SETUP AND CONDITIONS

The proposed approach experiments are conducted using the Google Colab platform, under the Scikit-learn and TensorFlow frameworks. In machine learning, Random Forest, XGBoost, and LightGBM algorithms are used. Random Forest, XGBoost and LightGBM utilizes CPU calculations. For machine learning algorithms, Random Forest, XGBoost, and LightGBM, we utilize techniques such as shallow trees and appropriate learning rates to prevent

overfitting. For deep learning with the Auto encoder model, we use TPU acceleration and choose larger batch sizes with increased epochs. Overfitting is further mitigated by monitoring accuracy and other errors in training, adjusting learning rates based on the learning.

For Random Forest, XGBoost, and LightGBM, we use the respective classifiers provided by Sklearn with specific parameters outlined in Table 3. For the Autoencoder deep learning model, a 1D sequence (144 × 1) from the learning dataset is used uniformly. Adam's optimizer with a learning rate of 0.001 is adopted, and 100 epochs are performed during training. The batch size is set to 1024 specified in Table 4.

<table><caption>Table 3. Parameters Related to Machine Learning Models</caption><thead><tr><th colspan="4">Autoencoders</th></tr><tr><th>Input Size</th><th>INPUT<br>(144,1)</th><th>INPUT<br>(144,1)</th><th>INPUT<br>(144,1)</th></tr></thead><tbody><tr><th>Layers</th><td>Dense-128</td><td>Dense-64</td><td>Dense-10</td></tr><tr><th>Dropout</th><td>0.5</td><td>0.5</td><td>0.5</td></tr><tr><th>Activation</th><td>Relu</td><td>Relu</td><td>Softmax</td></tr></tbody></table>

<table><caption>Table 4. Parameters Related to Deep Learning Models</caption><thead><tr><th>Classifier</th><th>Parameters</th></tr></thead><tbody><tr><td>Random Forest</td><td>n_estimators = 71, min Samples leaf = 1, max_depth = 46, min Samples split = 9, max_features = 20, criterion = 'entropy'</td></tr><tr><td>XGBoost</td><td>learning_rate= 0.192, n_estimators = 30, max_depth = 36</td></tr><tr><td>LightGBM</td><td>Learning_rate = 0.734, n_estimators=70, max_depth=14</td></tr></tbody></table>

## D. EVALUATION METRICS

We evaluate the performance of our experimental models using several metrics: Accuracy, Precision, Recall, and F1-Score. These evaluation metrics provide insights into the accuracy of flow recognition and false alarm rates in our intrusion detection system. By comparing the model's predictions with the true labels, we categorize the results into four types: False Negatives (FN), where positive samples are incorrectly classified as negative; False Positives (FP), where negative samples are incorrectly classified as positive; True Negatives (TN), where negative samples are correctly classified as negative; and True Positives (TP), where positive samples are correctly classified as positive. These metrics shown in Equations (1-4) are calculated using specific formulas to assess the overall performance of the model.

$$ Accuracy = \frac{TP+TN}{TP+TN+FP+FN} \qquad (1) $$
$$Precision = \frac{TP}{TP + FP} \qquad (2)$$

$$Recall = \frac{(TP)}{TP + FN} \qquad (3)$$

$$F1_{Score} = \frac{(2 * Precision * Recall)}{Precision + Recall} \qquad (4)$$

## E. EXPERIMENTAL RESULTS:

In our experiment, we delved into investigating the functionality of the ADASYN (Adaptive Synthetic Sampling) algorithm in mitigating class imbalance within the NSL-KDD and CSE CICIDS2018 datasets. ADASYN operates by dynamically generating synthetic samples for minority class instances, aiming to improve classifier performance. The algorithm begins by assessing the imbalance within the dataset, calculating the ratio between minority, majority class instances which is described in Table 5. It then identifies regions where the density of minority class samples is lower than majority class samples through local density estimation. Imbalance ratio is calculated as displayed in Equation 5.

$$Imbalance ratio = \frac{Majority class instance}{Minority class instance} \qquad (5)$$

<table><caption>Table 5. Distribution of the benchmark datasets</caption><thead><tr><th>Datasets</th><th>Type Name</th><th>Total</th><th>Unbiased ratio</th><th>Training Set</th><th>Testin g Set</th></tr></thead><tbody><tr><td rowspan="5">NSL-KDD</td><td>Normal</td><td>80792</td><td>-</td><td>64742</td><td>16050</td></tr><tr><td>DoS</td><td>55161</td><td>1.46</td><td>44064</td><td>11097</td></tr><tr><td>Probe</td><td>13945</td><td>5.83</td><td>11104</td><td>2841</td></tr><tr><td>R2L</td><td>1203</td><td>66.53</td><td>973</td><td>230</td></tr><tr><td>U2R</td><td>64</td><td>1321.26</td><td>49</td><td>15</td></tr><tr><td rowspan="6">CSECICIDS2018</td><td>Benign</td><td>39136</td><td>-</td><td>31307</td><td>7829</td></tr><tr><td>Bot</td><td>2882</td><td>13.5</td><td>2316</td><td>566</td></tr><tr><td>BruteForce</td><td>2075</td><td>18.9</td><td>1652</td><td>423</td></tr><tr><td>Infiltration</td><td>72</td><td>549.24</td><td>57</td><td>25</td></tr><tr><td>PortScan</td><td>2075</td><td>72.46</td><td>432</td><td>114</td></tr><tr><td>WebAttack</td><td>4286</td><td>9.02</td><td>3468</td><td>818</td></tr></tbody></table>

Next, ADASYN generates synthetic samples in these regions by interpolating between existing minority class instances. Unlike traditional oversampling techniques, ADASYN adjusts the number of synthetic samples based on the degree of imbalance in the local neighborhood. This adaptive approach ensures that instances in regions with higher imbalance receive more synthetic samples, leading to a more effective sampling strategy.

<table><caption>Table 6. Class Distribution of the New Training Set by ADASYN Algorithm.</caption><thead><tr><th>DataSet</th><th>Type</th><th>Training Set</th><th>New Training Set</th></tr></thead><tbody><tr><td rowspan="5">NSL-KDD</td><td>Normal</td><td>64742</td><td>64742</td></tr><tr><td>DoS</td><td>44064</td><td>44064</td></tr><tr><td>Probe</td><td>11104</td><td>11104</td></tr><tr><td>R2L</td><td>973</td><td>8754</td></tr><tr><td>U2R</td><td>49</td><td>442</td></tr><tr><td rowspan="7">CSECICIDS2018</td><td>Benign</td><td>31307</td><td>31307</td></tr><tr><td>Bot</td><td>2316</td><td>20852</td></tr><tr><td>BruteForce</td><td>1652</td><td>14859</td></tr><tr><td>DoS</td><td>15258</td><td>15258</td></tr><tr><td>Infiltration</td><td>57</td><td>505</td></tr><tr><td>PortScan</td><td>432</td><td>3861</td></tr><tr><td>WebAttack</td><td>3468</td><td>3468</td></tr></tbody></table>

We processed the training and testing sets of NSL-KDD and CSE-CICIDS2018 using four classifiers with different methods such as RUS, ROS, SMOTE, DSSTE, and ADASYN and performance was evaluated using the average F1-score of each classifier, as displayed in Figure 3.

<figure><img src="image_6.png" /><figcaption>Figure 4. Performance of CSE-CIC-IDS2018 Dataset (A).</figcaption></figure>
<figure><img src="image_7.png" /><figcaption>Figure 5. Performance of NSL-KDD Dataset (B).</figcaption></figure>

The Figure 4 and 5 illustrates the performance obtained from a series of experiments conducted to validate the efficiency of the proposed model. With the experiment number plotted across the x-axis and the matching F1-score across the y-axis, each data point represents the F1-score attained in a particular experiment.

The F1-score is crucial in assessing the effectiveness of classification algorithms, particularly in scenarios where class imbalance is prevalent. In this context, higher F1-scores indicate better performance in accurately predicting both positive and negative instances. Notably, our experiments reveal that utilizing the ADASYN algorithm in combination with other classifiers consistently yields superior performance compared to other algorithm combinations in both the dataset. Table 7 summarizes the comparison between the ADASYN algorithm and other sampling methods such as RUS, ROS, SMOTE, and DSSTE in NSL-KDD data set. Similarly, Table 8 provides the comparison with CSE-CICIDS2018 dataset using four classifiers. The ADASYN algorithm outperforms other methods in NSL-KDD and CSE-CIC-IDS2018. With The NSL-KDD dataset (Table 7), Random Forest achieved the highest accuracy and recall of 92%, with precision and an F1-score of 91% in the original dataset. Following sampling with RUS, Random Forest achieved a precision of 90%, while the Autoencoder achieved an accuracy, recall, and F1-score of 89%. Upon sampling with ROS, the random forest attained an accuracy of 78%, precision of 90%, and an F1-score of 82%. Similarly it achieved the highest precision of 89% and an F1-score of 79% with SMOTE sampling, while XGBoost demonstrated the highest accuracy and recall rates of 89%.

Following sampling with DSSTE, Random Forest achieved the highest accuracy and recall rates of 92%, with a precision and an F1-score of 91%. After sampling with ADASYN, the Autoencoder demonstrated the highest accuracy, recall, and F1-score of 95%, while XGBoost exhibited the highest precision of 97%, which is comparatively greater than other methods.

With the CSE-CIC-IDS2018 dataset in the proposed model, Random Forest outperformed in all four metrics: accuracy, precision, recall, and F1-score, with 98% score. After sampling with RUS, XGBoost achieved 85% accuracy, 91% precision, 85% recall, and 87% F1-score. Following sampling with ROS, LightGBM achieved the highest accuracy, recall, and F1-score rates of 97%, which are higher than the previous ones along with the highest precision of 98%. After applying the SMOTE algorithm for sampling, Random Forest achieved high rates in all four metrics: accuracy, precision, recall, and F1-score, with scores of 97%. Upon sampling with the DSSTE algorithm, XGBoost achieved a recall rate of 96%, 93% accuracy, and an F1-score with precision of 92%. After sampling with the ADASYN algorithm, LightGBM achieved the highest accuracy of 99.8% in all four metrics, which is greater than the other algorithms. Additionally, ADASYN demonstrated superior performance in balancing the dataset and improving the model's generalization capabilities.

1
0.9
0.8
0.7
0.6
0.5
0.4
0.3
0.2
0.1
0

Original RUS ROS SMOTE DSSTE ADASYN
NSL-KDD Acc 0.7581 0.8466 0.704 0.7293 0.7829 0.919
NSL-KDD F1 0.6293 0.8659 0.6966 0.7007 0.7305 0.9266
CSECICIDS2018 Acc 0.844 0.808 0.8915 0.8638 0.8133
0.9508 CSECICIDS2018 F1 0.8017 0.8129 0.8736 0.8319
0.7721 0.9459

<caption>Figure 6 performance measurement of sampling methods(accuracy and F1-score)</caption>
<table><caption>Table 7. Comparative Performance analysis of ADASYN and other methods in NSL-KDD dataset.</caption><thead><tr><th rowspan="2">MODELS</th><th colspan="4">NSL-KDD DATASET</th></tr><tr><th>Accuracy</th><th>Precision</th><th>Recall</th><th>F1-Score</th></tr></thead><tbody><tr><td>Random forest</td><td><strong>0.9234</strong></td><td><strong>0.9198</strong></td><td><strong>0.9234</strong></td><td><strong>0.9167</strong></td></tr><tr><td>XGBoost</td><td>0.8796</td><td>0.8742</td><td>0.8796</td><td>0.8579</td></tr><tr><td>LightGBM</td><td>0.5337</td><td>0.2848</td><td>0.5337</td><td>0.3714</td></tr><tr><td>Autoencoder</td><td>0.6959</td><td>0.2849</td><td>0.5337</td><td>0.3715</td></tr><tr><td>RUS + Randomforest</td><td>0.8291</td><td><strong>0.9045</strong></td><td>0.8291</td><td>0.8536</td></tr><tr><td>RUS + XGBoost</td><td>0.8437</td><td>0.8923</td><td>0.8437</td><td>0.8633</td></tr><tr><td>RUS + LightGBM</td><td>0.8147</td><td>0.9045</td><td>0.8147</td><td>0.8474</td></tr><tr><td>RUS + Autoencoder</td><td><strong>0.8989</strong></td><td>0.8994</td><td><strong>0.8989</strong></td><td><strong>0.8996</strong></td></tr><tr><td>ROS + Randomforest</td><td><strong>0.7854</strong></td><td><strong>0.9040</strong></td><td>0.7854</td><td><strong>0.8226</strong></td></tr><tr><td>ROS + XGBoost</td><td>0.7453</td><td>0.8841</td><td>0.7453</td><td>0.7905</td></tr><tr><td>ROS + LightGBM</td><td>0.7518</td><td>0.9034</td><td>0.7518</td><td>0.8019</td></tr><tr><td>ROS + Autoencoder</td><td>0.5337</td><td>0.2848</td><td>0.5337</td><td>0.3714</td></tr><tr><td>SMOTE + Random forest</td><td>0.7455</td><td><strong>0.8961</strong></td><td>0.7455</td><td><strong>0.7920</strong></td></tr><tr><td>SMOTE + XGBoost</td><td><strong>0.8940</strong></td><td>0.7438</td><td><strong>0.8940</strong></td><td>0.6591</td></tr><tr><td>SMOTE + LightGBM</td><td>0.7443</td><td>0.8052</td><td>0.7443</td><td>0.6178</td></tr><tr><td>SMOTE + Autoencoder</td><td>0.7684</td><td>0.7656</td><td>0.7683</td><td>0.7339</td></tr><tr><td>DSSTE + Random forest</td><td><strong>0.9228</strong></td><td><strong>0.9195</strong></td><td><strong>0.9228</strong></td><td><strong>0.9170</strong></td></tr><tr><td>DSSTE + XGBoost</td><td>0.8519</td><td>0.8586</td><td>0.8519</td><td>0.8377</td></tr><tr><td>DSSTE + LightGBM</td><td>0.5722</td><td>0.3274</td><td>0.5722</td><td>0.4165</td></tr><tr><td>DSSTE + Autoencoder</td><td>0.7847</td><td>0.7480</td><td>0.7847</td><td>0.7509</td></tr><tr><td><strong>ADASYN + Random forest</strong></td><td>0.9208</td><td>0.9635</td><td>0.9208</td><td>0.9371</td></tr><tr><td><strong>ADASYN + XGBoost</strong></td><td>0.9378</td><td><strong>0.9717</strong></td><td>0.9378</td><td>0.9511</td></tr><tr><td><strong>ADASYN + LightGBM</strong></td><td>0.8622</td><td>0.8846</td><td>0.8622</td><td>0.8647</td></tr><tr><td><strong>ADASYN + Autoencoder</strong></td><td><strong>0.9553</strong></td><td>0.9543</td><td><strong>0.9553</strong></td><td><strong>0.9536</strong></td></tr></tbody></table>

As depicted in Figure 6, the average accuracy and F1-Score of the classifiers for all the sampling methods is calculated. In the NSL-KDD dataset, the performance of the sampling algorithms employing RUS and DSSTE has performed comparatively better than the original algorithm.

RUS increased the accuracy by about 12% and the F1-score by about 38.71%. DSSTE increased the accuracy by about 4% and the F1-score by about 17.74%. Utilizing the ADASYN algorithm significantly improved both metrics, with the accuracy increasing by 21.33% and the F1-Score by 48.39%. In the CSE-CIC-IDS2018 dataset, the performance of the sampling algorithms using ROS and SMOTE has improved compared to the original algorithms. ROS increased the accuracy by about 5.95% and the F1-score by up to 8.75%. SMOTE increased the accuracy by 2.38% and the F1-score by up to 3.75%. Utilizing the ADASYN algorithm significantly improved both metrics, with the accuracy increasing by 13.10% and the F1-Score by 17.5%.

Figure 7 illustrates the confusion matrix of the CIC-IDS-2018 dataset generated by the ADASYN+LightGBM algorithm. The confusion matrix displays the number of data points for each combination of predicted and actual labels. The labels 0 through 6 represent the classes BENIGN, Bot, BruteForce, DoS, Infiltration, PortScan, and WebAttack, respectively.

<figure><img src="image_8.png" /><figcaption>Figure 7: Confusion matrix of CIC-IDS-2018 by ADASYN+LightGBM.</figcaption></figure>

Each highlighted diagonal cell represents a class that was correctly classified by the model, which is indicative of True Positives(TP). True Positives(TP) are instances through which the model correctly predicts a positive class. Similarly, other cells calculate True Negative (TN), False Positive (FP), and False Negative (FN). True Negatives (TN) represent instances where the model correctly predicts a negative class.
<table><caption>Table 8.Comparitive performance between ADASYN and other methods in CSECICIDS2018 dataset.</caption><thead><tr><th rowspan="2">MODELS</th><th colspan="4">CSECICIDS2018 DATASET</th></tr><tr><th>Accuracy</th><th>Precision</th><th>Recall</th><th>F1-Score</th></tr></thead><tbody><tr><td>Random forest</td><td><strong>0.9851</strong></td><td><strong>0.9854</strong></td><td><strong>0.9853</strong></td><td><strong>0.9851</strong></td></tr><tr><td>XGBoost</td><td>0.9368</td><td>0.9387</td><td>0.9368</td><td>0.9353</td></tr><tr><td>LightGBM</td><td>0.9628</td><td>0.9628</td><td>0.9628</td><td>0.9625</td></tr><tr><td>Autoencoder</td><td>0.4915</td><td>0.2415</td><td>0.4915</td><td>0.3239</td></tr><tr><td>RUS + Randomforest</td><td>0.8235</td><td>0.8988</td><td>0.8235</td><td>0.8454</td></tr><tr><td>RUS + XGBoost</td><td><strong>0.8542</strong></td><td><strong>0.9148</strong></td><td><strong>0.8542</strong></td><td><strong>0.8745</strong></td></tr><tr><td>RUS + LightGBM</td><td>0.8428</td><td>0.8997</td><td>0.8428</td><td>0.8608</td></tr><tr><td>RUS + Autoencoder</td><td>0.7116</td><td>0.6716</td><td>0.7116</td><td>0.6712</td></tr><tr><td>ROS + Randomforest</td><td>0.9670</td><td>0.9730</td><td>0.9670</td><td>0.9691</td></tr><tr><td>ROS + XGBoost</td><td>0.9413</td><td>0.9562</td><td>0.9413</td><td>0.9464</td></tr><tr><td>ROS + LightGBM</td><td><strong>0.9788</strong></td><td><strong>0.9818</strong></td><td><strong>0.9788</strong></td><td><strong>0.9788</strong></td></tr><tr><td>ROS + Autoencoder</td><td>0.6791</td><td>0.5950</td><td>0.6790</td><td>0.5991</td></tr><tr><td>SMOTE + Random forest</td><td><strong>0.9762</strong></td><td><strong>0.9781</strong></td><td><strong>0.9762</strong></td><td><strong>0.9765</strong></td></tr><tr><td>SMOTE + XGBoost</td><td>0.8373</td><td>0.9086</td><td>0.8373</td><td>0.8506</td></tr><tr><td>SMOTE + LightGBM</td><td>0.8958</td><td>0.9256</td><td>0.8958</td><td>0.9014</td></tr><tr><td>SMOTE + Autoencoder</td><td>0.7458</td><td>0.7178</td><td>0.7457</td><td>0.5991</td></tr><tr><td>DSSTE + Random Forest</td><td>0.8852</td><td>0.9375</td><td>0.8850</td><td>0.8866</td></tr><tr><td>DSSTE + XGBoost</td><td><strong>0.9394</strong></td><td><strong>0.9200</strong></td><td><strong>0.9617</strong></td><td><strong>0.9399</strong></td></tr><tr><td>DSSTE + LightGBM</td><td>0.9370</td><td>0.9157</td><td>0.9617</td><td>0.9381</td></tr><tr><td>DSSTE + Autoencoder</td><td>0.4915</td><td>0.2415</td><td>0.4915</td><td>0.3239</td></tr><tr><td><strong>ADASYN + Random forest</strong></td><td>0.9869</td><td>0.9902</td><td>0.9896</td><td>0.9896</td></tr><tr><td><strong>ADASYN + XGBoost</strong></td><td>0.9974</td><td>0.9975</td><td>0.9974</td><td>0.9974</td></tr><tr><td><strong>ADASYN + LightGBM</strong></td><td><strong>0.9985</strong></td><td><strong>0.9985</strong></td><td><strong>0.9985</strong></td><td><strong>0.9985</strong></td></tr><tr><td><strong>ADASYN + Autoencoder</strong></td><td>0.8204</td><td>0.8075</td><td>0.8204</td><td>0.7981</td></tr></tbody></table>

False Positives (FP) incidents when the model incorrectly predicts a positive class, and False Negatives (FN) happen when the model incorrectly predicts a negative class. The metrics discussed above aids in evaluating the model's performance by assessing its ability to accurately classify instances into different classes

## V. CONCLUSION

The dynamic nature of network intrusion poses an ever-growing challenge for intrusion detection systems. The inherent imbalance in network traffic complicates the prediction of malicious attack patterns, underscoring significant threats to cyber security. In this paper we have proposed an ensemble where ADASYN algorithm plays a major role as its effectively handles class imbalance. The ensemble also includes Auto encoder, Random Forest, LightGBM, and Boost to improve the intrusion detection system which aid in provide meaningful feature extraction and classify attacks with high precision in an IDS. The efficiency of the ensemble is tested by using NSL-KDD and comprehensive intrusion dataset CICIDS2018 which are known for consisting of highly imbalanced dataset and compared against SMOTE and random over sampling. The detection accuracy of the framework is upto 98.5 % which proves the enhanced resilience to adversarial attacks and generalization. In future we would like to adapt this model for live streaming data in edge or IoT devices with optimal latency and responsiveness.

**Funding Statement:** This research received no specific grant from any funding agency in the public, commercial, or not-for-profit sectors.

**Conflicts of Interest:** The authors declare that they have no conflicts of interest to report regarding the present study.

## References

[1] Neupane, S., Ables, J., Anderson, W., Mittal, S., Rahimi, S., Banicescu, I., & Seale, M. (2022). Explainable intrusion detection systems (x-ids): A survey of current methods, challenges, and opportunities. *IEEE Access, 10*, 112392-112415.

[2] Lin, Y. D., Liu, Z. Q., Hwang, R. H., Nguyen, V. L., Lin, P. C., & Lai, Y. C. (2022). Machine learning with variational autoencoder for imbalanced datasets in intrusion detection. *IEEE Access, 10*, 15247-15260.

[3] Kumar, S., Gupta, S., & Arora, S. (2021). Research trends in network-based intrusion detection systems: A review. *Ieee Access, 9*, 157761-157779.

[4] Halbouni, A., Gunawan, T. S., Habaebi, M. H., Halbouni, M., Kartiwi, M., & Ahmad, R. (2022). Machine learning and deep learning approaches for cybersecurity: A review. *IEEE Access, 10*, 19572-19585.

[5] Azam, Z., Islam, M. M., & Huda, M. N. (2023). Comparative analysis of intrusion detection systems and
machine learning-based model analysis through decision tree. *IEEE Access*, 11, 80348-80391.

[6] Vinayakumar, R., Alazab, M., Soman, K. P., Poornachandran, P., Al-Nemrat, A., & Venkatraman, S. (2019). Deep learning approach for intelligent intrusion detection system. *IEEE Access*, 7, 41525-41550.

[7] Kumar, G., Thakur, K., & Ayyagari, M. R. (2020). MLEsIDSs: machine learning-based ensembles for intrusion detection systems—a review. *The Journal of Supercomputing*, 76(11), 8938-8971.

[8] Hossain, M. A., & Islam, M. S. (2023). Ensuring network security with a robust intrusion detection system using ensemble-based machine learning. *Array*, 19, 100306.

[9] Liu, L., Wang, P., Lin, J., & Liu, L. (2020). Intrusion detection of imbalanced network traffic based on machine learning and deep learning. *IEEE Access*, 9, 7550-7563.

[10] Pu, G., Wang, L., Shen, J., & Dong, F. (2020). A hybrid unsupervised clustering-based anomaly detection method. *Tsinghua Science and Technology*, 26(2), 146-153.

[11] Gad, A. R., Nashat, A. A., & Barkat, T. M. (2021). Intrusion detection system using machine learning for vehicular ad hoc networks based on ToN-IoT dataset. *IEEE Access*, 9, 142206-142217.

[12] Wisanwanichthan, T., & Thammawichai, M. (2021). A double-layered hybrid approach for network intrusion detection system using combined naive bayes and SVM. *IEEE Access*, 9, 138432-138450.

[13] Kim, T., & Pak, W. (2022). Robust network intrusion detection system based on machine-learning with early classification. *IEEE Access*, 10, 10754-10767.

[14] Mbona, I., & Eloff, J. H. (2022). Detecting zero-day intrusion attacks using semi-supervised machine learning approaches. *Ieee Access*, 10, 69822-69838.

[15] Oleiwi, H. W., Mhawi, D. N., & Al-Raweshidy, H. (2022). MLTs-ADCNs: Machine learning techniques for anomaly detection in communication networks. *IEEE Access*, 10, 91006-91017.

[16] Fernando, G. P., Brayan, A. A. H., Florina, A. M., Liliana, C. B., Héctor-Gabriel, A. M., & Reinel, T. S. (2023). Enhancing intrusion detection in iot communications through ml model generalization with a new dataset (idsai). *IEEE Access*, 11, 70542-70559.

[17] Zou, L., Luo, X., Zhang, Y., Yang, X., & Wang, X. (2023). HC-DTTSVM: A network intrusion detection method based on decision tree twin support vector machine and hierarchical clustering. *IEEE Access*, 11, 21404-21416.

[18] Attou, H., Guezzaz, A., Benkirane, S., Azrour, M., & Farhaoui, Y. (2023). Cloud-based intrusion detection approach using machine learning techniques. *Big Data Mining and Analytics*, 6(3), 311-320.

[19] Gad, A. R., Nashat, A. A., & Barkat, T. M. (2021). Intrusion detection system using machine learning for vehicular ad hoc networks based on ToN-IoT dataset. *IEEE Access*, 9, 142206-142217.

[20] Lopez-Martin, M., Sanchez-Esguevillas, A., Arribas, J. I., & Carro, B. (2021). Network intrusion detection based on extended RBF neural network with offline reinforcement learning. *IEEE Access*, 9, 153153-153170.

[21] Dina, A. S., Siddique, A. B., & Manivannan, D. (2022). Effect of balancing data using synthetic data on the performance of machine learning classifiers for intrusion detection in computer networks. *Ieee Access*, 10, 96731-96747.

[22] Dener, M., Al, S., & Orman, A. (2022). STLGBM-DDS: an efficient data balanced DoS detection system for

wireless sensor networks on big data environment. *IEEE Access*, 10, 92931-92945.

[23] Zhu, N., Zhao, G., Yang, Y., Yang, H., & Liu, Z. (2023). Aec_gan: unbalanced data processing decision-making in network attacks based on ACGAN and machine learning. *IEEE Access*, 11, 52452-52465.

[24] Bakro, M., Kumar, R. R., Alabrah, A., Ashraf, Z., Ahmed, M. N., Shameem, M., & Abdelsalam, A. (2023). An improved design for a cloud intrusion detection system using hybrid features selection approach with ML classifier. *IEEE Access*, 11, 64228-64247.

[25] Mirsadeghi, S. M. H., Bahsi, H., Vaarandi, R., & Inoubli, W. (2023). Learning From Few Cyber-Attacks: Addressing the Class Imbalance Problem in Machine Learning-Based Intrusion Detection in Software-Defined Networking. *IEEE Access*, 11, 140428-140442.

[26] Picard, C., & Pierre, S. (2023). RLAuth: A risk-based authentication system using reinforcement learning. *IEEE Access*, 11, 61129-61143.

[27] Zeng, J., Xu, H., Gong, G., Xu, C., Tian, C., Lu, T., & Jiang, R. (2020). Hackem-LIBS: An heterogeneous stacking ensemble model for laser-induced breakdown spectroscopy elemental quantitative analysis. *Ieee Access*, 8, 136141-136150.

[28] Alotaibi, B. (2020). Transportation mode detection by embedded sensors based on ensemble learning. *IEEE Access*, 8, 145552-145563.

[29] Mansoor, U., Ratrout, N. T., Rahman, S. M., & Assi, K. (2020). Crash severity prediction using two-layer ensemble machine learning model for proactive emergency management. *IEEE Access*, 8, 210750-210762.

[30] Seth, S., Chahal, K. K., & Singh, G. (2021). A novel ensemble framework for an intelligent intrusion detection system. *IEEE access*, 9, 138451-138467.

[31] Lucas, T. J., de Figueiredo, I. S., Tojeiro, C. A. C., de Almeida, A. M. G., Scherer, R., Brega, J. R. F., ... & da Costa, K. A. P. (2023). A comprehensive survey on ensemble learning-based intrusion detection approaches in computer networks. *IEEE Access*, 11, 122638-122676.".

[32] Yang, J., Sheng, Y., & Wang, J. (2020). A GBDT-paralleled quadratic ensemble learning for intrusion detection system. *IEEE Access*, 8, 175467-175482.

[33] Gao, X., Shan, C., Hu, C., Niu, Z., & Liu, Z. (2019). An adaptive ensemble machine learning model for intrusion detection. *Ieee Access*, 7, 82512-82521.

[34] Mananayaka, A. K., & Chung, S. S. (2023). Network intrusion detection with two-phased hybrid ensemble learning and automatic feature selection. *IEEE Access*, 11, 45154-45167.

[35] Tama, B. A., Nkenyereye, L., Islam, S. R., & Kwak, K. S. (2020). An enhanced anomaly detection in web traffic using a stack of classifier ensemble. *IEEE Access*, 8, 24120-24134.

[36] He, H., Bai, Y., Garcia, E. A., & Li, S. (2008, June). ADASYN: Adaptive synthetic sampling approach for imbalanced learning. In *2008 IEEE international joint conference on neural networks (IEEE world congress on computational intelligence)* (pp. 1322-1328). Ieee.

[37] Breiman, L. (2001). Random forests. statistics department. University of California, Berkeley, CA, 4720.

[38] Chen, T., & Guestrin, C. (2016, August). Xgboost: A scalable tree boosting system. In *Proceedings of the 22nd acm sigkdd international conference on knowledge discovery and data mining* (pp. 785-794).

[39] Jiang, H., He, Z., Ye, G., & Zhang, H. (2020). Network
intrusion detection based on PSO-XGBoost model. *IEEE Access*, 8, 58392-58401.

[40] Ke, G., Meng, Q., Finley, T., Wang, T., Chen, W., Ma, W., ... & Liu, T. Y. (2017). Lightgbm: A highly efficient gradient boosting decision tree. *Advances in neural information processing systems*, 30.