## 3 Proposed Approach
### Data Preprocessing
#### 3.2.5 Class Balancing  
Class imbalance is a significant challenge in the NF-UNSW-NB15-v2 dataset, potentially reducing the performance of machine learning models. To mitigate this issue, a robust class balancing strategy was implemented, leveraging a combination of oversampling and undersampling techniques, well-established methods for addressing class imbalance [81]. Following this, the training and testing sets were merged, and ADASYN was employed on the combined dataset. This technique enhances learning by allowing the model to benefit from both training and testing data. After generating synthetic samples, the dataset was split again, with the new training set comprising the original training data plus the ADASYN-generated samples, while the test set remained unchanged. ADASYN was applied to oversample both binary and multi-class classification tasks by generating synthetic samples to improve the representation of minority classes. This approach improves model performance by augmenting the dataset with additional samples. Furthermore, ENN was applied to the training dataset for undersampling, removing noisy or redundant instances from the majority class. Class weights were adjusted during model training to balance the influence of each class, ensuring that the models did not become biased toward the majority class. By employing this combination of ADASYN for oversampling, ENN for undersampling, and class weight adjustments, the model's ability to accurately detect and classify minority classes was significantly improved, leading to enhanced performance and reliability. However, despite achieving high accuracy, models can still suffer from the accuracy paradox, where minority class predictions are weak [82]. To counter this, an improved strategy, inspired by [79], was introduced, integrating ADASYN for oversampling, ENN for undersampling, and class weights to provide a more effective solution to class imbalance. This approach ensures more balanced performance across all classes, ultimately improving the model's effectiveness in handling imbalanced datasets. 1. ADASYN  
ADASYN is an advanced technique designed to address the challenges of class imbalance in datasets. By generating synthetic samples for the minority class, ADASYN focuses on regions of the feature space where instances of the minority class are underrepresented. This method enhances the representation of the minority class while preserving the distribution of the majority class, leading to improved model performance. In our approach, an enhanced cascaded ADASYN technique was applied twice for binary classification tasks and nine times for multi-class classification tasks. This approach ensured that the dataset remained balanced at each stage, progressively improving model training by handling class imbalance more effectively in both binary and multi-class scenarios [83]. Let \(X_{i}\) represent the minority class samples, and \(N\) (\(X_{i},k\)) denote the k-nearest neighbors of \(X_{i}\). The number of synthetic samples \(n_{i}\) to generate for each minority instance is defined as presented in Equation (2) [84]. \[n_{i}=\frac{N_{Maj}-N_{Min}}{N_{Min}}.\left(1-\frac{N_{i}}{k}\right) \tag{2}\]  
In this context, \(N_{Maj}\) and \(N_{Min}\) represent the sample counts of the majority and minority classes, respectively, highlighting the imbalance between them. The term \(N_{i}\) denotes the number of minority class samples that fall within the radius defined by the k \begin{table}
\begin{tabular}{c c c} \hline
**Class Type** & **Train** & **Test** \\ \hline Shellcode & 589 & 25 \\ \hline Backdoor & 227 & 16 \\ \hline Analysis & 306 & 10 \\ \hline Worms & 83 & 5 \\ \hline \end{tabular}
\end{table} 
Table 11: _Cont._nearest neighbors, which helps in identifying minority instances near decision boundaries, where synthetic samples are often generated to improve model performance. For each minority instance \(X_{i}\), synthetic samples are generated using the following equation, as presented in Equation (3) [84].