# Intrusion Detection Method Based on Preprocessing of Highly Correlated and Imbalanced Data
## 2 Materials and Methods  
Model construction involves several key stages: data collection and preprocessing, feature engineering, model selection, training, and evaluation. Data collection is the process of gathering information from various sources for the purpose of analysis or modeling. Data preprocessing, a critical step in reliable data analysis, typically deals with low-quality data. It is considered a non-trivial task, often accounting for up to 80% of the total effort in intelligent data analysis [19]. Without proper preprocessing, further analysis may be impossible, as analytical algorithms rely on clean and well-structured data to produce accurate results. One of the important stages of preprocessing is data balancing. The situation with imbalanced data is quite common in the context of network intrusion detection, as the amount of benign traffic significantly exceeds the amount of malicious traffic. Imbalanced classifiers create challenges for predictive modeling and lead to the construction of biased models with poor predictive performance, especially for the minority class. The model completely ignores the minority class and labels all objects with the labels of the majority class [20]. One approach to solving this problem is to use various class balancing strategies. The following data balancing approaches are distinguished: Undersampling, Oversampling, and their combination (Over + Undersampling) [21]. The Undersampling technique involves reducing the number of examples in the majority class. The Oversampling technique involves increasing the number of examples in the minority class. One of the best techniques is the SMOTEENN algorithm. This algorithm generates a certain number of artificial observations that would be similar to the observations that are in the minority class, but, at the same time, it does not duplicate them and then remove noisy data. An important component of preprocessing is identifying features that are correlated with each other. The presence of correlated features negatively affects the quality of the model and makes it less effective and less interpretable. In addition, it significantly increases the training time of the model. As previously mentioned, a combination of various methods is used to enhance the effectiveness of intrusion detection. For example, network traffic analysis can be used to detect known attacks, while user behavior analysis can identify new or sophisticated attacks. Previous research has shown that ensemble classifiers are the most effective [22; 23; 24]. The relevance of using ensemble classifiers lies in their ability to improve the accuracy and robustness of models by combining several base classifiers, which helps to reduce the impact of random errors and increase the overall accuracy of predictions [25]. The following approaches are used to collect ensembles: boosting, bagging, and stacking. Stacking is an ensemble method that integrates various classification or regression models using a meta-learner. Initially, base-level models are trained on the full training dataset. Subsequently, a meta-model is trained using the outputs of these base-level models as its input features. This technique commonly utilizes diverse learning algorithms for the base level, resulting in a heterogeneous ensemble [26]. Boosting is an ensemble modeling technique that attempts to build a strong classifier from several weak classifiers and combines them in a series. The base classifiers are trained sequentially. Firstly, a model is built from the training data. Then, the second model is built, which tries to correct the errors present in the first model. This procedure continues, and new classifiers are added to the meta-model until either the complete training dataset is predicted correctly, or the maximum number of base models is added [27]. Bagging or Bootstrap Aggregation is a machine learning ensemble meta-algorithm that combines the base models in parallel [28].