A Comparative Analysis of Cross-Classifiers with Resampled Datasets for Exfiltration Attacks

Imbalanced datasets pose a significant challenge in intrusion detection, often reducing model performance in classifying attacks. This study evaluates the impact of three resampling techniques, BorderlineSMOTE, SMOTEENN, and SMOTETomek, on the performance of three popular classifiers: Random Forest, XGBoost, and SupportVector Machine (SVM). Using a dataset of over 2.5 million attack records generated by the BSSN honeynet targeting government networks, we assess accuracy, precision, recall, F1-score, specificity, and geometric mean. Results reveal that SMOTEENN consistently delivers superior performance across all classifiers, with notable efficiency in balancing data and enhancing detection accuracy. These findings underscore the importance of selecting the proper resampling technique and classifier for improving intrusion detection in imbalanced datasets.