Comparative Analysis of Machine Learning Techniques for Handling Imbalance in IoT-23 Dataset for Intrusion Detection Systems

Machine learning (ML) has grown increasingly common in the security of Internet of Things (IoT) networks, especially for intrusion detection systems (IDS). When building an appropriate ML model, it is essential to handle the sample data carefully and take care of any issues that could arise up before the training phase. The management of imbalanced data or classes, which might arise from the dynamic nature of data collection or from real-world class distribution, is a crucial and challenging problem. Many approaches were developed to address this problem and get around it. IoT-23 dataset, which is considered a highly imbalanced dataset, has been lunched recently for training ML models in the field of IoT security. This paper provides a comparative analysis of several ML techniques to handle the imbalance issue in IoT-23 dataset. These techniques include Adaptive Synthetic Sampling (ADASYN), Synthetic Minority Oversampling (SMOTE), cost-sensitive learning, and bagging technique. Furthermore, we expanded our study to combine various techniques, seeking to find an appropriate ML-based solution when dealing with the imbalanced classes. The studied models were trained using random forest (RF) and stochastic gradient descent (SGD) algorithms. Our results demonstrate that combining SMOTE with under-sampling techniques achieved the highest accuracy of $\mathbf{9 6. 8 1 \%}$ for all classes classified correctly.