{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,6]],"date-time":"2026-03-06T01:51:01Z","timestamp":1772761861378,"version":"3.50.1"},"reference-count":21,"publisher":"MDPI AG","issue":"4","license":[{"start":{"date-parts":[[2021,12,6]],"date-time":"2021-12-06T00:00:00Z","timestamp":1638748800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["BDCC"],"abstract":"<jats:p>Classifier ensembles have been utilized in the industrial cybersecurity sector for many years. However, their efficacy and reliability for intrusion detection systems remain questionable in current research, owing to the particularly imbalanced data issue. The purpose of this article is to address a gap in the literature by illustrating the benefits of ensemble-based models for identifying threats and attacks in a cyber-physical power grid. We provide a framework that compares nine cost-sensitive individual and ensemble models designed specifically for handling imbalanced data, including cost-sensitive C4.5, roughly balanced bagging, random oversampling bagging, random undersampling bagging, synthetic minority oversampling bagging, random undersampling boosting, synthetic minority oversampling boosting, AdaC2, and EasyEnsemble. Each ensemble\u2019s performance is tested against a range of benchmarked power system datasets utilizing balanced accuracy, Kappa statistics, and AUC metrics. Our findings demonstrate that EasyEnsemble outperformed significantly in comparison to its rivals across the board. Furthermore, undersampling and oversampling strategies were effective in a boosting-based ensemble but not in a bagging-based ensemble.<\/jats:p>","DOI":"10.3390\/bdcc5040072","type":"journal-article","created":{"date-parts":[[2021,12,6]],"date-time":"2021-12-06T22:18:42Z","timestamp":1638829122000},"page":"72","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":25,"title":["Exploring Ensemble-Based Class Imbalance Learners for Intrusion Detection in Industrial Control Networks"],"prefix":"10.3390","volume":"5","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8274-0990","authenticated-orcid":false,"given":"Maya Hilda Lestari","family":"Louk","sequence":"first","affiliation":[{"name":"Department of Informatics Engineering, University of Surabaya, Surabaya 60293, Indonesia"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1821-6438","authenticated-orcid":false,"given":"Bayu Adhi","family":"Tama","sequence":"additional","affiliation":[{"name":"Data Science Group, Institute for Basic Science (IBS), Daejeon 34141, Korea"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2021,12,6]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Zhou, Z.H. (2012). Ensemble Methods: Foundations and Algorithms, CRC Press.","DOI":"10.1201\/b12207"},{"key":"ref_2","doi-asserted-by":"crossref","first-page":"4046","DOI":"10.1016\/j.csda.2009.07.017","article-title":"Taxonomy for characterizing ensemble methods in classification tasks: A review and annotated bibliography","volume":"53","author":"Rokach","year":"2009","journal-title":"Comput. Stat. Data Anal."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Kuncheva, L.I. (2014). Combining Pattern Classifiers: Methods and Algorithms, John Wiley & Sons.","DOI":"10.1002\/9781118914564"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"100357","DOI":"10.1016\/j.cosrev.2020.100357","article-title":"Ensemble learning for intrusion detection systems: A systematic mapping study and cross-benchmark evaluation","volume":"39","author":"Tama","year":"2021","journal-title":"Comput. Sci. Rev."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"1729","DOI":"10.1587\/transinf.2016ICP0018","article-title":"HFSTE: Hybrid feature selections and tree-based classifiers ensemble for intrusion detection system","volume":"100","author":"Tama","year":"2017","journal-title":"IEICE Trans. Inf. Syst."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"659","DOI":"10.1109\/TKDE.2002.1000348","article-title":"An instance-weighting method to induce cost-sensitive trees","volume":"14","author":"Ting","year":"2002","journal-title":"IEEE Trans. Knowl. Data Eng."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"412","DOI":"10.1002\/sam.10061","article-title":"Roughly balanced bagging for imbalanced data","volume":"2","author":"Hido","year":"2009","journal-title":"Stat. Anal. Data Min. Asa Data Sci. J."},{"key":"ref_8","doi-asserted-by":"crossref","unstructured":"Wang, S., and Yao, X. (2009, January 11\u201315). Diversity analysis on imbalanced data sets by using ensemble models. Proceedings of the 2009 IEEE Symposium on Computational Intelligence and Data Mining, Paris, France.","DOI":"10.1109\/CIDM.2009.4938667"},{"key":"ref_9","doi-asserted-by":"crossref","first-page":"185","DOI":"10.1109\/TSMCA.2009.2029559","article-title":"RUSBoost: A hybrid approach to alleviating class imbalance","volume":"40","author":"Seiffert","year":"2009","journal-title":"IEEE Trans. Syst. Man Cybern.-Part A Syst. Hum."},{"key":"ref_10","doi-asserted-by":"crossref","unstructured":"Chawla, N.V., Lazarevic, A., Hall, L.O., and Bowyer, K.W. (2003). SMOTEBoost: Improving prediction of the minority class in boosting. Proceedings of the European Conference on Principles of Data Mining and Knowledge Discovery, Cavtat-Dubrovnik, Croatia, 22\u201326 September 2003, Springer.","DOI":"10.1007\/978-3-540-39804-2_12"},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"3358","DOI":"10.1016\/j.patcog.2007.04.009","article-title":"Cost-sensitive boosting for classification of imbalanced data","volume":"40","author":"Sun","year":"2007","journal-title":"Pattern Recognit."},{"key":"ref_12","first-page":"539","article-title":"Exploratory undersampling for class-imbalance learning","volume":"39","author":"Liu","year":"2008","journal-title":"IEEE Trans. Syst. Man Cybern. Part B"},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Alimi, O.A., Ouahada, K., Abu-Mahfouz, A.M., Rimer, S., and Alimi, K.O.A. (2021). A Review of Research Works on Supervised Learning Algorithms for SCADA Intrusion Detection and Classification. Sustainability, 13.","DOI":"10.3390\/su13179597"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"103770","DOI":"10.1016\/j.engappai.2020.103770","article-title":"Boosting algorithms for network intrusion detection: A comparative evaluation of Real AdaBoost, Gentle AdaBoost and Modest AdaBoost","volume":"94","author":"Shahraki","year":"2020","journal-title":"Eng. Appl. Artif. Intell."},{"key":"ref_15","doi-asserted-by":"crossref","unstructured":"Anton, S.D.D., Sinha, S., and Schotten, H.D. (2019, January 19\u201321). Anomaly-based intrusion detection in industrial data with SVM and random forests. Proceedings of the 2019 International Conference on Software, Telecommunications and Computer Networks (SoftCOM), Split, Croatia.","DOI":"10.23919\/SOFTCOM.2019.8903672"},{"key":"ref_16","doi-asserted-by":"crossref","first-page":"89507","DOI":"10.1109\/ACCESS.2019.2925838","article-title":"HML-IDS: A hybrid-multilevel anomaly prediction approach for intrusion detection in SCADA systems","volume":"7","author":"Khan","year":"2019","journal-title":"IEEE Access"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"2559","DOI":"10.1109\/TNSE.2021.3099371","article-title":"Intrusion Detection in SCADA Based Power Grids: Recursive Feature Elimination Model with Majority Vote Ensemble Algorithm","volume":"8","author":"Upadhyay","year":"2021","journal-title":"IEEE Trans. Netw. Sci. Eng."},{"key":"ref_18","doi-asserted-by":"crossref","first-page":"100341","DOI":"10.1016\/j.softx.2019.100341","article-title":"IRIC: An R library for binary imbalanced classification","volume":"10","author":"Zhu","year":"2019","journal-title":"SoftwareX"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"227","DOI":"10.1111\/j.1468-0394.2010.00573.x","article-title":"An empirical comparison of cost-sensitive decision tree induction algorithms","volume":"28","author":"Lomax","year":"2011","journal-title":"Expert Syst."},{"key":"ref_20","doi-asserted-by":"crossref","unstructured":"Jeni, L.A., Cohn, J.F., and De La Torre, F. (2013, January 2\u20135). Facing imbalanced data\u2013recommendations for the use of performance metrics. Proceedings of the 2013 Humaine Association Conference on Affective Computing and Intelligent Interaction, Geneva, Switzerland.","DOI":"10.1109\/ACII.2013.47"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"216","DOI":"10.1016\/j.patcog.2019.02.023","article-title":"The impact of class imbalance in classification performance metrics based on the binary confusion matrix","volume":"91","author":"Luque","year":"2019","journal-title":"Pattern Recognit."}],"container-title":["Big Data and Cognitive Computing"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2504-2289\/5\/4\/72\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,11]],"date-time":"2025-10-11T07:40:08Z","timestamp":1760168408000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2504-2289\/5\/4\/72"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2021,12,6]]},"references-count":21,"journal-issue":{"issue":"4","published-online":{"date-parts":[[2021,12]]}},"alternative-id":["bdcc5040072"],"URL":"https:\/\/doi.org\/10.3390\/bdcc5040072","relation":{},"ISSN":["2504-2289"],"issn-type":[{"value":"2504-2289","type":"electronic"}],"subject":[],"published":{"date-parts":[[2021,12,6]]}}}