## 3 Methodology
### Data Preprocessing
#### 3.2.5 Class Balancing  
Class imbalance is a prominent issue in the CICIDS2017 dataset and can impact the effectiveness of machine learning models. To address this, a comprehensive class-balancing strategy was employed, combining both oversampling and undersampling techniques, a widely recognized solution to tackle class imbalance [41]. For binary classification, the enhanced hybrid ADASYN-SMOTE technique was utilized during training to oversample the minority class, while for multi-class classification, enhanced SMOTE was applied during training to generate synthetic samples and balance the class distribution. For both tasks, ENN was employed during training for undersampling, removing noisy or redundant instances from the majority class to improve data quality. This balanced approach enhanced the model's ability to accurately identify and classify minority classes, improving overall \begin{table}
\begin{tabular}{c c c} \hline \hline
**Class Type** & **Train** & **Test** \\ \hline Normal & 79,112 & 13,941 \\ \hline Attack & 62,497 & 11,049 \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Sample distribution of the CICIDS2017 dataset for binary classification. \begin{table}
\begin{tabular}{c c c} \hline \hline
**Class Type** & **Train** & **Test** \\ \hline PortScan & 10,080 & 1812 \\ \hline DDoS & 11,519 & 2025 \\ \hline DoS Hulk & 31,172 & 5468 \\ \hline DoS GoldenEye & 3018 & 536 \\ \hline FTP-Patator & 1658 & 306 \\ \hline SSH-Patator & 735 & 133 \\ \hline DoS Slowloris & 1312 & 228 \\ \hline DoS Slowhttptest & 943 & 156 \\ \hline Bot & 539 & 99 \\ \hline Web Attack—Brute Force & 373 & 63 \\ \hline Web Attack—XSS & 288 & 52 \\ \hline Infiltration & 13 & 2 \\ \hline Web Attack—Sql Injection & 7 & 2 \\ \hline Heartbleed & 9 & 1 \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Sample distribution of the CICIDS2017 dataset for multi-class classification. performance and reliability. However, the accuracy paradox may be encountered, where a model achieves high accuracy but fails to effectively predict minority class instances [42]. To mitigate this, an enhanced method combining oversampling techniques such as hybrid ADASYN-SMOTE for binary classification and SMOTE for multi-class classification with undersampling using ENN during model training was implemented, based on previous research [43]. This integrated approach effectively addressed class imbalance, leading to more reliable predictions across all classes. 1. Hybrid ADASYN-SMOTE  
In this work, hybrid ADASYN-SMOTE was applied for the binary classification task to address class imbalance effectively. This technique combined the strengths of both ADASYN and SMOTE in a two-stage process. First, ADASYN was used to generate synthetic samples for the minority class, focusing on difficult-to-learn instances. The output from ADASYN then served as the input for the second stage, where SMOTE further enhanced the minority class by creating additional synthetic samples along the line segments between existing instances. This hybrid approach not only improved the class balance but also strengthened the model's ability to learn from challenging examples, resulting in better performance in binary classification tasks. Let \(X_{i}\) denote the samples from the minority class and \(N(X_{i},K)\) represent the k-nearest neighbors of \(X_{i}\). The number of synthetic samples \(n_{i}\) to be generated for each minority sample is determined as outlined in Equation (3) [44]. \[n_{i}=\frac{N_{Maj}-N_{Min}}{N_{Min}}\times(1-\frac{N_{i}}{k}) \tag{3}\]  
where \(N_{Maj}\) and \(N_{Min}\) represent the sample sizes of the majority and minority classes, respectively, emphasizing the class imbalance. The term \(N_{i}\) refers to the number of minority class samples within the radius defined by the k-nearest neighbors, to assist in identifying minority instances located near decision boundaries where synthetic samples are typically generated, thereby enhancing the model's performance. For each minority instance \(X_{i}\), synthetic samples are generated using Equation (4) [44].