A Review of Imbalanced Datasets and Resampling Techniques in Network Intrusion Detection System

The rapid development of network connections and the widespread use of Internet of Things (IoT) devices has increased network traffic. The surge in network traffic has created new vulnerabilities in cyberspace, making it vulnerable to cyber-attacks. To address this challenge, researchers have turned to intelligent techniques, especially machine learning and deep learning, to improve the detection of network traffic attacks. However, a common problem arises: the data imbalance problem, where normal samples occur more often than attack samples, which hurts the performance and classification of machine learning or deep learning models. This study conducted a systematic literature review to identify the imbalanced datasets and the use of resampling techniques for addressing data imbalances in network intrusion detection research. We found four widely-used imbalanced datasets: NSL-KDD, CIC-IDS2017, UNSW-NB15, and KDD-Cup 1999. Researchers used three resampling approaches to tackle the imbalance problem: oversampling, undersampling, and hybrid sampling (combining oversampling and undersampling approaches). Researchers and practitioners can improve the security and efficiency of attack detection across network traffic by applying resampling techniques.