Enhancing network intrusion detection with SMOTE: A performance analysis

Abstract

Network Intrusion Detection Systems (NIDS) play a vital role in safeguarding computer networks against malicious activities. However, a significant challenge in developing effective NIDS is the inherent class imbalance in datasets, where normal traffic vastly outnumbers malicious instances. This study investigates the impact of the Synthetic Minority Over-sampling Technique (SMOTE) on machine learning models for network intrusion detection. The performance of seven popular algorithms (KNN, Naive Bayes, SVM, XGBoost, Logistic Regression, Random Forest, and Multi-Layer Perceptron) were evaluated on two benchmark datasets: UNSW-NB15 and NSL-KDD. These datasets represent different levels of class imbalance in network traffic data. The model's performance was evaluated using accuracy, precision, recall, and F1-score metrics, both with and without the application of SMOTE. The Naive Bayes (NB) classifier exhibited the most significant change, with precision increasing from 0.83 to approximately 1.00 after applying SMOTE, but at the cost of decreased recall and F1-score. The overall findings reveal that the effectiveness of SMOTE varies significantly depending on the dataset's inherent class distribution and the specific machine learning algorithm used. This study provides insights into when and how SMOTE should be applied in NIDS to enhance performance.