## 3 Proposed Methodology
### Synthetic Minority Oversampling  
After feature examination, the number of benign samples was greater than that of malicious ones, a condition described on Sections 1 and 2 upon which flows generated by botnets or intrusion attacks can be masked within the network. As a consequence, the aforementioned security appliances were unable to correctly record their activity, leading to insufficient proof of malicious activity. As an example, benign traces clearly prevailed in a great part of the observations owing to large connections between safe client-server architectures. Conversely, the malicious ones were not frequently spotted, requiring more thorough inspection. This is explained by unusual botnets and C and C conversations, odd targeted attacks exploiting some vulnerability, passive scanning, unfamiliar Denial of Service attempts, and brute-force attacks that are rarely experienced. Eventually, this problem sometimes causes ML-based sensors to deteriorate in learning potential, tending to mislead the detection of suspicious objects. To tackle the absence of malicious patterns, this works pursued to resample \begin{table}
\begin{tabular}{l l l} \hline \hline  & **Feature** & **Description** \\ \hline
1 & Src ip & Source IP Address \\
2 & Src port & Source Port \\
3 & Dest ip & Destination IP Address \\
4 & Dest port & Destination Port \\
5 & Duration & Duration of the flow \\
6 & Bytes & Number of transmitted bytes \\
7 & Packets & Number of transmitted packets \\
8 & Class & Class label (normal, attacker, victim, suspicious, or unknown) \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Features used in CIDDS-001 dataset. \begin{table}
\begin{tabular}{l l l} \hline \hline  & **Feature** & **Description** \\ \hline
1 & Src\_ip & Source IP Address \\
2 & Src\_port & Source Port \\
3 & Dst\_ip & Destination IP Address \\
4 & Dst\_port & Destination Port \\
5 & Out\_packets & Number of output packets \\
6 & Out\_bytes & Output byte number \\
7 & Income\_packets & Number of input packets \\
8 & Income\_bytes & Number of input bytes \\
9 & Total\_packets & Total number of transmitted packets \\
10 & Total\_bytes & Total number of transmitted bytes \\
11 & Duration & Flow duration \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Features examined in ISCX-Bot-2014 dataset. previously studied datasets by applying SMOTE; in this section, we describe the steps considered develop the technique. Consider each dataset as representation of \(n\) samples \(X\in\mathbb{R}^{n\times m}\) mapped with \(y_{i}\in\{1,2,\ldots,C\}\) labels. The unbalanced subsets are defined as \(X_{min}\subset X\) for minority-class samples and \(X_{maj}\subset X_{train}\) for majority observations, respectively; so, \(X_{min}\cup X_{maj}=X;\forall X_{min}<X_{maj}\). Depending upon the amount of oversampling based on the extent of \(X_{maj}\), synthetic data are generated by pointing to a space of similar features between instances belonging to \(x_{i}\in X_{min}\) from a certain neighborhood. Then, \(k\)-nearest neighbors are computed by considering the smallest Euclidean distance between the neighbor and the rest of \(X_{min}\) instances; the closest \(k\) neighbors serve as reference points to create new in-between samples. The interpolation of those observations is described in Equation (1):  
\[X_{syn}=X+(X_{k}-X)\cdot e, \tag{1}\]  
where \(X_{k}\in X_{min}\) is one of K-nearest neighbors \((k=1,2,3,\ldots,K)\) from selected samples \(x_{i}\), \(e\) is a random number belonging to the range of \([0,1]\) that represent the number of instances between \(x_{i}\) and \(X_{k}\), and \(X_{syn}\) is the new synthetic sample. In this way, SMOTE balanced both datasets as follows:  
* CIDDS-001: comprised 248,134 samples, where 50% corresponded to benign and the rest to malicious.