# Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection
## 1 Introduction
Furthermore, it is critical to ensure that the data being analyzed are representative of real-world scenarios in order to improve the performance of ML-based IDSs. This can be accomplished by employing data augmentation techniques, such as the generation of synthetic data or the use of multiple data sources, to produce a more diverse dataset. Intrusion detection typically uses ML techniques, but ML algorithms frequently place a focus on feature selection. Massive invasion data, therefore, present a supervised learning challenge, since high-dimensional data cause feature selection problems that lead to subpar detection performance and other problems [10]. DL has advanced significantly in the fields of computer vision, natural language processing, and other fields, and it is now being utilized more frequently in other AI fields. For example, DL methods for IDS have become more popular lately. Without the requirement for human interaction, DL techniques can autonomously identify high-level latent information. However, the results are not in optimum contrast to chi-square feature selection and PCA, which mainly depend on intelligence, randomness, and artificial feature extraction [11]. Furthermore, traditional ML technology has limited computational complexity because of the high dimension, massive volume, and complex structure of network activity. Therefore, there is still an issue with learning non-linear dynamic correlations in massive data. Figure 1 displays IDS classification methods divided into data sources and detection methods. Anomaly detection, abuse detection, IoT network-based IDS, and host-based IDS are some of the further divisions. Among these source-based methodologies, additional detection techniques are divided as classification components. More broadly, the log-based, flow-based, session-based, and packet-based detection methods all use the ML methodology. Conventional ML methods such as NB, decision trees, SVM, and others try to work past the limitations imposed by detection methods. However, these systems require professional involvement and experience, which significantly improve detection accuracy, in order to interpret enormous amounts of data. These techniques, usually referred to as shallow classifiers, look for algorithms that enable computers to learn on their own without help from humans. However, as more features are added, they may eventually not function as well for multiclass problems. Self-learning intrusion detection systems that recognize and categorize known and zero-day intrusions have evolved due to research; these methods enable proactive efforts to spot and stop malicious IoT network traffic. Finally, deep learning is defined as a complicated model, or an advanced subset, of machine learning techniques that overcomes some of the drawbacks of external IoT networks. Each network leverages the correlation with traffic attributes, and network data are distributed randomly. This work offers a DLNID model that uses ADASYN for feature extraction from unequal datasets and revised stacked auto-encoders for data feature reduction to address the mentioned remaining deficiencies. To retrain and assess the performance of the DLNID model, computational testing using the NSL-KDD dataset is conducted. The major contributions of this study are as follows:  
Figure 1: Framework for IDS system. * It would help to use a DLNID model that combines bi-LSTM and attentional mechanisms. This DLNID model can precisely categorize data about network traffic;
* By employing ADASYN for feature extraction from the minority class of sampling, the concern of unbalanced packet headers is resolved, resulting in a substantially equal distribution of the quantity of each sampling unit and enabling the system to learn successfully;
* To increase information fusion, the complexity of the data is lowered by employing a more compact layer auto-encoder. The structure of this research study is as specified: The introduction is covered in Section 1 of the paper. The relevant work is listed in Section 2.