## 2 Overview of SMOTE Schemes and Ensemble Learning Schemes
### SMOTE Techniques for Imbalanced Data  
An imbalanced data set is one where the minority class is greatly outnumbered by the majority class with respect to their number of data points (Figure 1). This skew in the distributions of classes makes classification for the minority class imprecise. This problem is serious because predictions for the minority class are typically the most crucial [18]. Additionally, such skewness makes training less effective. One approach to addressing this class imbalance is to randomly resample the raw data for training. This approach can be divided into three subapproaches that all involve deleting examples from the majority class. Undersampling, the first subapproach, is where extra examples are screened from the majority class. Oversampling, the second subapproach, is used to duplicate examples from the minority class. For example, the SMOTE scheme [18] balances the minority class of raw threat data, adjusts them to the other categories, and improves the imbalance in the minority classes. Uniform sampling, the third approach, is used to modify the structure of the data for each threat class. For example, the number of data points for each threat category in the UNSW-NB15 data set is detailed in Table 2. The data set has a considerable class imbalance, as illustrated in Table 2. For example, the 'generic' class accounts for 22.81% of the total data, whereas the categories with the smallest number of data points,'shellcode' and 'worms', only account for 0.65% and 0.007% of the total data, respectively. Minority class-like analysis (1.14%), backdoor (1.00%), shellcode (0.65%), and worms (0.07%) have a smaller number of data points, as presented in Table 2. Hence, oversampling is used to increase the number of data points for these classes. In imbalanced data (Table 2), the majority class, a data set class comprising more than half (50%) of the data set's data points, represents the main part of the instances labelled as one class, and the minority classes represent considerably fewer instances labelled \(c_{i}\), where \(i=1,\ldots,r\). The symbol \(c_{i}\) denotes the essential class of samples to be classified, and this class includes behavioral features and class labels. In [19], the imbalance ratio (IR) was defined as follows:  
\[\text{Imbalance Ratio}(c)=\frac{|\text{Instances of Major Class}|}{|\text{ Instances of Mainority Class}|}. \tag{1}\]  
If the IRs of the sample data are high, the model's classification accuracy and prediction reliability are unstable and low [20]. The data points for minority class--represented as a pair (feature set, class label)--should be made to have a strong signal among each threat class. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Threat Category** & **Record No. of Training Data** & **Record No. of Test Data** \\ \hline Normal & 56,000 (31.94\%) & 7000 (44.94\%) \\ Generic & 40,000 (22.81\%) & 8871 (22.92\%) \\ Exploits & 33,393 (19.04\%) & 1132 (13.52\%) \\ Fuzzers & 18,184 (10.37\%) & 6062 (7.36\%) \\ DoS & 12,264 (6.99\%) & 4089 (4.97\%) \\ Reconnaissance & 10,491 (5.98\%) & 3496 (4.25\%) \\ Analysis & 2000 (1.14\%) & 667 (0.81\%) \\ Backdoors & 1746 (1.00\%) & 583 (0.71\%) \\ Shellcode & 1133 (0.65\%) & 387 (0.47\%) \\ Worms & 130 (0.07\%) & 44 (0.05\%) \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Number of data points for each threat category (UNSW-NB15). Figure 1: A case of unbalanced data. SMOTE generates synthetic examples for minority classes to achieve enhanced performance in imbalanced data sets. As presented in Figure 2, the minority class was oversampled by taking each minority class sample and introducing synthetic examples along the line segments that join any of the \(k\) minority class' nearest neighbors. In other words, increased data for minority class are generated by two neighbors from the five nearest neighbors random and one sample is generated in the direction of each [18].