An intelligent oversampling strategy for rare cyberattack detection
Ritinder Kaur, Neha Gupta · Information Security Journal A Global Perspective · 2025
Intrusion detection systems often struggle with imbalanced datasets, where rare attack samples often get lost within the overwhelming majority of normal network traffic, making their detection difficult. The inability to accurately detect these rare intrusions can leave critical security vulnerabilities unaddressed, leading to severe consequences in real-world cybersecurity applications. To tackle this issue, techniques like SMOTE and ADASYN help balance the dataset by generating synthetic samples. This study introduces a novel resampling approach that enhances adaptive synthetic sampling by leveraging decision tree-based decision boundaries to focus on rare and complex cases. When tested on the NSL-KDD dataset, it significantly improved the detection accuracy of rare attack classes, achieving 42% for U2r and 83% for R2l. Its efficacy was further supported through experiments on the UNSW-NB15 dataset, where it outperformed existing oversampling techniques and proved to be statistically significant, confirming its statistical significance.