## 2 SMOTE  
In this work, cascaded SMOTE is applied to multi-class classification tasks to address class imbalance effectively. This method involved applying SMOTE in two stages, where the output of the first SMOTE served as the input for the second. By progressively oversampling the minority classes in each stage, this technique helped to better balance the class distribution. The enhanced representation of the minority classes improved the model's ability to capture and learn patterns across all classes, resulting in improved accuracy and reliability in multi-class classification performance.  
When given a sample \(X_{I}\) from the minority class, SMOTE creates a synthetic sample by selecting one of its k-nearest neighbors \(X_{zi}\). The new synthetic sample \(X_{new}\) is then created by interpolating between \(X_{I}\) and \(X_{zi}\), as shown in Equation (6) [45].  
\[X_{new} =X_{I}+\sigma\ \times\ (X_{zi}-X_{I}) \tag{6}\]  
where \(\sigma\) is a random number between 0 and 1. This formula ensures that the new sample \(X_{new}\) lies along the line segment between \(X_{I}\) and \(X_{zi}\), effectively creating a synthetic data point that represents the minority class more accurately within the feature space. By focusing on the feature relationships within the minority class, SMOTE balances the dataset, enhancing model performance in multi-class classification tasks.  
The sample distribution for the multi-class classification task in the CICIDS2017 dataset, before and after resampling with SMOTE, is illustrated in Table 9. Initially, the dataset exhibited a considerable imbalance, with certain classes such as Web Attack--Sql Injection and Heartbleed containing as few as 7 and 9 samples, respectively. This imbalance could have led to model bias, as the minority classes would have been underrepresented during training. After applying SMOTE, the sample sizes for these minority classes were significantly increased, with classes like Web Attack--Sql Injection and Heartbleed being resampled to 31,172 instances, ensuring a more balanced representation across all classes. This resampling approach mitigated the risks of class imbalance, allowing more equitable model training and improving overall classification performance by reducing bias towards the majority classes. The enhanced dataset facilitated more robust and reliable predictions for both the majority and minority classes in the multi-class classification tasks.  
\begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Type of Class**} & **Number of Samples Before** & **Number of Samples After** \\  & **Resampling (ADASYN-SMOTE)** & **Resampling (ADASYN-SMOTE)** \\ \hline Normal & 79,112 & 79,296 \\ \hline Attack & 62,497 & 79,296 \\ \hline \hline \end{tabular}
\end{table}
Table 8: Sample distribution in each training class before/after resampling using hybrid ADASYN-SMOTE for binary classification, on the CICIDS2017 dataset.  
\begin{table}
\begin{tabular}{c c c} \hline \hline \multirow{2}{*}{**Type of Class**} & **Number of Samples Before** & **Number of Samples After** \\  & **Resampling (SMOTE)** & **Resampling (SMOTE)** \\ \hline PortScan & 10,080 & 10,080 \\ \hline DDoS & 11,519 & 11,519 \\ \hline DoS Hulk & 31,172 & 31,172 \\ \hline \hline \end{tabular}
\end{table}
Table 9: Sample distribution in each training class before/after resampling using SMOTE for multi-class classification, on the CICIDS2017 dataset.