A Hybrid Intrusion Detection System Approach Using PCA and SMOTE with Advanced Ensemble Models

A persistent issue of class imbalance in intrusion detection systems (IDS) is addressed in this research, particularly in the context of cyber-physical systems and IoT devices. Current IDS approaches often struggle to detect rare attack patterns due to the dominance of normal traffic in imbalanced datasets. To address this, we present a unique strategy that combines Principal Component Analysis (PCA) for selecting features with the Synthetic Minority Oversampling Technique (SMOTE) to deal with class imbalance, applied to four powerful classifiers: Random Forest (RF), Decision Trees (DT), XGBoost (XGB), and AdaBoost. By reducing the feature space with PCA and balancing the dataset with SMOTE, our methodology significantly enhances model performance. Evaluating on the KDDCup ’99 dataset, we observe notable improvements: for instance, Random Forest achieves 96.42% accuracy, 98.52% precision, 94.68% recall 96.55% F1-score, and 93.87% MCC. Similarly, XGBoost achieves 94.78% accuracy, 96.72% precision, 92.94% recall, 94.81% F1-score, and 92.36% MCC. These results demonstrate that the integration of SMOTE and PCA effectively addresses class imbalance and enhances the detection of minority class attacks. Our findings contribute to the advancement of machine learning techniques in IDS and provide a foundation for further research into combining oversampling methods and dimensionality reduction for robust cybersecurity solutions. Future work will focus on exploring alternative oversampling methods, incorporating deep learning models, and assessing the practical deployment of the proposed methodology in real-time network environments.