{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,20]],"date-time":"2026-05-20T16:42:32Z","timestamp":1779295352990,"version":"3.51.4"},"reference-count":33,"publisher":"MDPI AG","issue":"10","license":[{"start":{"date-parts":[[2023,10,11]],"date-time":"2023-10-11T00:00:00Z","timestamp":1696982400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/100009226","name":"National Security Agency","doi-asserted-by":"publisher","award":["H98230-21-1-0170"],"award-info":[{"award-number":["H98230-21-1-0170"]}],"id":[{"id":"10.13039\/100009226","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Machine Learning is widely used in cybersecurity for detecting network intrusions. Though network attacks are increasing steadily, the percentage of such attacks to actual network traffic is significantly less. And here lies the problem in training Machine Learning models to enable them to detect and classify malicious attacks from routine traffic. The ratio of actual attacks to benign data is significantly high and as such forms highly imbalanced datasets. In this work, we address this issue using data resampling techniques. Though there are several oversampling and undersampling techniques available, how these oversampling and undersampling techniques are most effectively used is addressed in this paper. Two oversampling techniques, Borderline SMOTE and SVM-SMOTE, are used for oversampling minority data and random undersampling is used for undersampling majority data. Both the oversampling techniques use KNN after selecting a random minority sample point, hence the impact of varying KNN values on the performance of the oversampling technique is also analyzed. Random Forest is used for classification of the rare attacks. This work is done on a widely used cybersecurity dataset, UNSW-NB15, and the results show that 10% oversampling gives better results for both BMSOTE and SVM-SMOTE.<\/jats:p>","DOI":"10.3390\/computers12100204","type":"journal-article","created":{"date-parts":[[2023,10,11]],"date-time":"2023-10-11T08:07:12Z","timestamp":1697011632000},"page":"204","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":23,"title":["Determining Resampling Ratios Using BSMOTE and SVM-SMOTE for Identifying Rare Attacks in Imbalanced Cybersecurity Data"],"prefix":"10.3390","volume":"12","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1886-4582","authenticated-orcid":false,"given":"Sikha S.","family":"Bagui","sequence":"first","affiliation":[{"name":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0106-3890","authenticated-orcid":false,"given":"Dustin","family":"Mink","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6140-5384","authenticated-orcid":false,"given":"Subhash C.","family":"Bagui","sequence":"additional","affiliation":[{"name":"Department of Mathematics and Statistics, University of West Florida, Pensacola, FL 32514, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Sakthivel","family":"Subramaniam","sequence":"additional","affiliation":[{"name":"Department of Computer Science, University of West Florida, Pensacola, FL 32514, USA"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2023,10,11]]},"reference":[{"key":"ref_1","unstructured":"Cisco (2023). What Is a Cyberattack?\u2014Most Common Types, Cisco. Available online: https:\/\/www.cisco.com\/c\/en\/us\/products\/security\/common-cyberattacks.html#~how-cyber-attacks-work."},{"key":"ref_2","unstructured":"What Is a Cyberattack?, IBM. Available online: https:\/\/www.ibm.com\/topics\/cyber-attack."},{"key":"ref_3","unstructured":"Delplace, A., Hermoso, S., and Anandita, K. (2020). Cyber Attack Detection thanks to Machine Learning Algorithms. arXiv, Available online: https:\/\/arxiv.org\/abs\/2001.06309."},{"key":"ref_4","unstructured":"Alencar, R. (2017). Resampling Strategies for Imbalanced Datasets, Kaggle. Available online: https:\/\/www.kaggle.com\/code\/rafjaa\/resampling-strategies-for-imbalanced-datasets."},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"e820","DOI":"10.7717\/peerj-cs.820","article-title":"Network intrusion detection using oversampling technique and machine learning algorithms","volume":"8","author":"Ahmed","year":"2022","journal-title":"PeerJ. Comput. Sci."},{"key":"ref_6","doi-asserted-by":"crossref","unstructured":"Moustafa, N., and Slay, J. (2015, January 10\u201312). UNSW-NB15: A Comprehensive Data Set for Network Intrusion Detection Systems (UNSW-NB15 network data set). Proceedings of the 2015 Military Communications and Information Systems Conference (MilCIS), Canberra, Australia.","DOI":"10.1109\/MilCIS.2015.7348942"},{"key":"ref_7","unstructured":"Brownlee, J. (2023, April 17). Random Oversampling and Undersampling for Imbalanced Classification. Available online: https:\/\/machinelearningmastery.com\/random-oversampling-and-undersampling-for-imbalanced-classification\/."},{"key":"ref_8","unstructured":"Branco, P.S., Torgo, L., and Ribeiro, R.A. (2015). A Survey of Predictive Modelling under Imbalanced Distributions. arXiv, Available online: http:\/\/export.arxiv.org\/pdf\/1505.01658."},{"key":"ref_9","unstructured":"Patwardhan, S. (2023, April 25). Simple Understanding and Implementation of KNN Algorithm! Analytics Vidhya, Gurgaon, New Delhi, India. Available online: https:\/\/www.analyticsvidhya.com\/blog\/2021\/04\/simple-understanding-and-implementation-of-knn-algorithm\/."},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"878","DOI":"10.1007\/11538059_91","article-title":"Borderline-smote: A new over-sampling method in imbalanced data sets learning","volume":"3644","author":"Han","year":"2005","journal-title":"Lect. Notes Comput. Sci."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"4","DOI":"10.1504\/IJKESDP.2011.039875","article-title":"Borderline over-sampling for Imbalanced Data Classification","volume":"3","author":"Nguyen","year":"2011","journal-title":"Int. J. Knowl. Eng. Soft Data Paradig."},{"key":"ref_12","unstructured":"Brownlee, J. (2020). Bagging and Random Forest for Imbalanced Classification, Machine Learning Mastery. Available online: https:\/\/machinelearningmastery.com\/bagging-and-random-forest-for-imbalanced-classification\/."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Dini, P., and Saponara, S. (2021). Analysis, design, and comparison of machine-learning techniques for networking intrusion detection. Designs, 5.","DOI":"10.3390\/designs5010009"},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"67910","DOI":"10.1109\/ACCESS.2022.3186026","article-title":"Design and testing novel one-class classifier based on polynomial interpolation with application to networking security","volume":"10","author":"Dini","year":"2022","journal-title":"IEEE Access"},{"key":"ref_15","unstructured":"Elhanashi, A., Gasmi, K., Begni, A., Dini, P., Zheng, Q., and Saponara, S. (2022). International Conference on Applications in Electronics Pervading Industry, Environment and Society, Springer Nature."},{"key":"ref_16","first-page":"1","article-title":"Imbalanced dataset classification and solutions: A review","volume":"5","author":"Ramyachitra","year":"2014","journal-title":"Int. J. Comput. Bus. Res. (IJCBR)"},{"key":"ref_17","first-page":"42","article-title":"An overview of classification algorithms for imbalanced datasets","volume":"2","author":"Ganganwar","year":"2012","journal-title":"Int. J. Emerg. Technol. Adv. Eng."},{"key":"ref_18","unstructured":"Chawla, N.V. (2010). Data Mining and Knowledge Discovery Handbook, Springer."},{"key":"ref_19","unstructured":"Nguyen, G.H., Bouzerdoum, A., and Phung, S.L. (2009). Learning pattern classification tasks with imbalanced data sets. Pattern Recognit., 193\u2013208."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"10611","DOI":"10.1007\/s11227-023-05073-x","article-title":"Addressing the class imbalance problem in network intrusion detection systems using data resampling and deep learning","volume":"79","author":"Abdelkhalek","year":"2023","journal-title":"J. Supercomput."},{"key":"ref_21","first-page":"13","article-title":"Handling minority class problem in threats detection based on heterogeneous ensemble learning approach","volume":"11","author":"Eke","year":"2020","journal-title":"Int. J. Syst. Softw. Secur. Prot."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"10755","DOI":"10.1007\/s00500-018-3629-4","article-title":"TLUSBoost algorithm: A boosting solution for class imbalance problem","volume":"23","author":"Kumar","year":"2019","journal-title":"Soft Comput."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"178","DOI":"10.3389\/fpubh.2020.00178","article-title":"Over- and Under-sampling Approach for Extremely Imbalanced and Small Minority Data Problem in Health 860 Record Analysis","volume":"8","author":"Fujiwara","year":"2020","journal-title":"Front. Public Health"},{"key":"ref_24","doi-asserted-by":"crossref","unstructured":"Hasanin, T., and Khoshgoftaar, T. (2018, January 6\u20139). The Effects of Random Undersampling with Simulated Class Imbalance for Big Data. Proceedings of the 2018 IEEE International Conference on Information Reuse and Integration (IRI), Salt Lake City, UT, USA.","DOI":"10.1109\/IRI.2018.00018"},{"key":"ref_25","unstructured":"Weiss, G., and Provost, F. (2001). The Effect of Class Distribution on Classifier Learning: An Empirical Study, Rutgers University."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Silva, E.J.R., and Zanchettin, C. (2015, January 9\u201312). On the Existence of a Threshold in Class Imbalance Problems. Proceedings of the 2015 IEEE International Conference on Systems, Man, and Cybernetics, Hong Kong, China.","DOI":"10.1109\/SMC.2015.474"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Joshi, A., Kanwar, K., Vaidya, P., and Sharma, S. (2022, January 8). A Principal Component Analysis, Sampling and Classifier strategies for dealing with concerns of class imbalance in datasets with a ratio greater than five. Proceedings of the 2022 Second International Conference on Computer Science, Engineering and Applications (ICCSEA), Gunupur, India.","DOI":"10.1109\/ICCSEA54677.2022.9936162"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"6","DOI":"10.1186\/s40537-020-00390-x","article-title":"Resampling imbalanced data for network intrusion detection datasets","volume":"8","author":"Bagui","year":"2021","journal-title":"J. Big Data"},{"key":"ref_29","unstructured":"Sikorski, M., and Honig, A. (2012). Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software, No Starch Press."},{"key":"ref_30","unstructured":"Erickson, J. (2008). Hacking: The Art of Exploitation, No Starch Press."},{"key":"ref_31","doi-asserted-by":"crossref","unstructured":"Bagui, S.S., Mink, D., Bagui, S.C., Subramaniam, S., and Wallace, D. (2023). Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks. Future Internet, 15.","DOI":"10.3390\/fi15040130"},{"key":"ref_32","unstructured":"Han, J., Kamber, M., and Pei, J. (2022). Data Mining: Concepts and Techniques, Morgan Kaufmann."},{"key":"ref_33","first-page":"37","article-title":"Evaluation: From Precision, Recall and F-Measure to ROC, Informedness, Markedness & Correlation","volume":"2","author":"Powders","year":"2011","journal-title":"J. Mach. Learn. Technol."}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/12\/10\/204\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,10]],"date-time":"2025-10-10T21:04:56Z","timestamp":1760130296000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/12\/10\/204"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2023,10,11]]},"references-count":33,"journal-issue":{"issue":"10","published-online":{"date-parts":[[2023,10]]}},"alternative-id":["computers12100204"],"URL":"https:\/\/doi.org\/10.3390\/computers12100204","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2023,10,11]]}}}