# Intrusion Detection Method Based on Preprocessing of Highly Correlated and Imbalanced Data
## 1 Introduction
### State of the Art  
The need to enhance intrusion detection methods in computer systems and networks is driven by their increasing complexity, which makes them more vulnerable to attackers. Additionally, attackers continuously develop more sophisticated and complex methods, leading to data breaches, financial losses, or even disruptions of critical infrastructure. In this context, intrusion detection systems (IDSs) play a crucial role in network protection and system attack identification. IDSs are designed to detect malicious activity not only within the network but also at the system and file system levels. The task of intrusion detection can be conventionally divided into two main directions: misuse detection and anomaly detection. Misuse detection is the process of identifying and preventing unauthorized or malicious activities in computer systems and networks. It involves the use of attack signatures. Systems that engage in misuse detection analyze user actions and network traffic to detect previously known patterns of information attacks. Anomaly detection is the process of identifying deviations from the \"normal\" or expected behavior of a system. An anomaly detection system generates a baseline template (profile) of normal behavior using training data. This template can include various activity characteristics, such as the use of system resources, the execution of potentially harmful actions, unauthorized data transmission events to external servers, and more. Any deviation from the profile is considered an attack. The main advantage of such systems is the ability to detect new attacks. Successfully identifying the state of computer systems and networks requires effective detection technologies, continuous monitoring, adaptation to new threats, and ongoing improvements in data analysis methods. All these aspects are urgent tasks and emphasize the need for the development, implementation, or improvement of modern intrusion identification systems. A large number of processes occurring in computer systems, including those caused by malware, are analyzed using complex mathematical algorithms based on machine learning techniques [2; 3; 4]. K-nearest neighbors (k-NN) is a widely used classification technique due to its straightforward implementation and adaptability to various data formats. It classifies new data points by examining the classes of their closest neighbors, determined by a distance metric. Despite its simplicity, k-NN is computationally expensive with large datasets, and its accuracy is heavily dependent on the chosen 'k' value [5; 6]. Support Vector Machines (SVMs) offer an alternative approach by constructing a hyperplane that optimally separates data classes. SVM's ability to handle both linear and non-linear data, coupled with strong generalization capabilities, makes it powerful. However, similar to k-NN, SVM encounters computational challenges with large datasets and requires careful parameter selection, particularly for the kernel function [7]. The naive Bayes classifier uses probabilistic methods for classifying objects, assuming the independence of features. The main advantage of the naive Bayes classifier is its simplicity of implementation and its ability to handle high-dimensional data. The limitations include the assumption of feature independence and potential unsuitability for data with complex relationships [8]. Logistic regression is one of the most widely used classification methods. It can work with continuous and categorical variables, allowing for the assessment of their importance. However, it can be unstable to data outliers and insensitive to non-linear relationships between input variables [9]. Decision trees are also widely used in intrusion detection. The main advantage of decision trees is their ability to handle both categorical and numerical features, as alongwith their ease of interpretability. A limitation of decision trees is their tendency to overfit the training data [10, 11].