## 1 Introduction
Indeed, data distribution has a great effect on the efficiency of different ML models [11; 12]; thus, it is important to establish data-level strategies in the preprocessing and training stages. To deal with unbalanced datasets, two methods can be applied: resampling, which balances data by sample aggregation or deletion, and unbalanced learning [13] that seeks to improve the detection rate of minority classes. Data resampling can be performed in the following ways:  
* Oversampling: samples from minority classes are duplicated until the amount is compensated with those from majority classes. * Undersampling: samples belonging to majority classes are downsized at random until compensation with respect to the minority class is reached. * Hybrid sampling: a superset is created with samples replicated from minority classes up to the same volume of the majority-class samples. Even though previous research has implemented various resampling techniques, this work focuses on a novel approach named Synthetic Minority Oversampling Technique (SMOTE), a combination of oversampling, undersampling, and \(K\)-Nearest Neighbor (KNN) procedures to create a balanced set by virtue of synthetic generation [14; 15]. KNN randomly selects \(k\)-nearest neighbors according to the magnitude of a majority class towards a minority class, emerging with new synthetic samples between the minority class and its nearest neighbors. Even though data adjustments are important to increase the sensitivity of the classification models, it is important to consider a level of complexity in relation to algorithm performance. In [16], the authors suggested that a key factor for an ideal level is by considering inherent hyperparameters in which algorithms are constrained. In ML, hyperparameters are internal configuration variables used to improve skills at the learning phase, helping to make better generalization of the input information. The conventional scope for hyperparameter tuning is known as the grid search, a brute-force-like procedure that divides hyperparameters into regular grids exploiting the training models until the best grid point for minimizing the cost function is found. In contrast with other state-of-the-art experiments, in this work we developed a deep inspection of botnet- and IDS-related datasets, tackling the unbalancing issues that cause irregular learning rates, and optimizing the training criteria of a set of supervised-learning algorithms, producing strengthened models that can transform data points into actionable knowledge. To achieve this goal, data acquisition must meet the following considerations [17]:  
* Information ought to be from crude network flows as a main source of malicious-packet delivery;
* incorporation of a considerable collection of bot-based malware attacks obtained through environments closest to near-real contexts;
* data should cover requirements from operating cycles found in production deployments (working hours); and
* the proportion of more benign traffic packets must outnumber that of malicious ones since, in near-real-time conditions, only a slight portion of packets arise from infected sources. This article is organized as follows. Section 2 provides an overview of several works related to botnet and intruder detection, the used algorithms, and the proposed balancing techniques for dealing with unbalanced datasets. Section 3 describes the proposed methodology for the following steps: data acquisition and examination, balancing minority-class samples via SMOTE, feature extraction and selection and grid search (hyperparameter tuning) techniques for a proposed algorithm portfolio. Section 4 details the obtained experiment results. Section 6 exemplifies the results discussion Finally, Section 5 concludes this work.