# Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection
## 3 Material & Methods
### Data Pre-Processing
#### 3.2.4 Target Balancing  
It can be seen in Figure 4 that the dataset is quite unbalanced, which poses a significant challenge for the model's training because it prevents the model from accurately detecting minority classes such as R2L, probe, and U2R. Classes were balanced to address this problem. These methods alter the dataset's distribution of the label categories by either undersampling majority classes, oversampling minority classes, or using a combination of the two methods such as SMOTE and ADASYN. 1. SMOTE  
SMOTE [50] is a synthetic oversampling technique that generates synthetic samples for the minority class in order to balance imbalanced datasets. It works by generating synthetic examples along the line segments that connect neighboring instances of the minority class. This is accomplished by selecting a minority class instance at random, determining its k nearest neighbors, and generating synthetic samples by interpolating between the selected instance and its neighbors. The desired level of oversampling determines the number of synthetic samples generated. The SMOTE technique helps in increasing the representation of the minority class, thereby mitigating the impact of class imbalance. By introducing synthetic samples, SMOTE enhances the learning process by providing a more balanced training set for the classifier. To tackle the issue of class imbalance in the dataset, the minority class was identified, which had fewer instances than the majority class. The imbalance ratio was computed to determine the proportion of instances between the two classes. The SMOTE algorithm was utilized to overcome this problem. This approach involved selecting a random instance from the minority class and determining its k nearest neighbors. By interpolating between the chosen instance and its neighbors, synthetic samples were generated. The number of synthetic samples produced depended on the desired level of oversampling required to balance the classes. These synthetic samples were then added to the training set, augmenting the representation of the minority class. The process was repeated until the desired level of class balance was achieved, resulting in an enhanced training set for the machine learning models. 1. ADASYN  
ADASYN [51] is an adaptive synthetic oversampling technique based on SMOTE principles. ADASYN focuses on creating synthetic samples for minority class instancesthat are more difficult to learn. It accomplishes this by adjusting the distribution of synthetic samples adaptively based on the density distribution of the instances. The density distribution of minority class instances is estimated in ADASYN, and instances with lower densities are prioritized for generating synthetic samples. This means that the generation of synthetic samples is more focused on difficult-to-learn instances, effectively emphasizing the areas that require more attention. ADASYN addresses the limitations of SMOTE by adaptively adjusting sample synthesis in cases where the class imbalance is more severe or the minority class instances are distributed in complex patterns. ADASYN seeks to strike a better balance between oversampling the minority population and avoiding overfitting. The implementation of ADASYN followed a similar approach to SMOTE by identifying the minority class and calculating the imbalance ratio. However, ADASYN required an extra step, to consider the density distribution of the minority class instances. To estimate this distribution, the number of minority class instances within a certain radius around each instance was measured. Instances with lower densities, indicating regions that were more challenging to learn, were given higher importance for generating synthetic samples. The number of synthetic samples to be generated for each instance was determined based on these importance values. The SMOTE algorithm was then applied with adjusted synthesis of samples based on the importance values.