Enhanced Intrusion Detection via Hybrid Data Resampling and Feature Optimization

Network security is increasingly challenged by sophisticated and evolving cyber threats, underscoring the need for efficient and robust intrusion detection systems (IDS). Although researchers have extensively studied intrusion detection, they have made limited progress in effectively detecting zero-day attacks, particularly those caused by subtle variations. Existing approaches often tackle class imbalance and feature selection independently, with minimal exploration of their combined impact as a unified preprocessing strategy. Moreover, researchers have shown that inconsistencies and artifacts in the widely used CICIDS2017 dataset impair model generalization and stability. This study proposes a systematic pipeline that employs a unified framework, integrating hybrid data balancing with advanced feature selection to enhance anomaly detection performance. By leveraging Extra Trees-based feature selection alongside a strategic combination of SMOTE and targeted undersampling, the approach effectively addresses critical challenges such as class imbalance and feature redundancy. Evaluated on the CICIDS2017 dataset, the framework demonstrates strong generalization across both machine learning and deep learning models. Notably, XGBoost and Decision Tree achieved balanced accuracy and F1-scores of up to 99.99% and 99.96%, respectively, in multiclass classification. The evaluation framework reports comprehensive metrics beyond accuracy, including Precision, Recall, F1-score, Matthews Correlation Coefficient (MCC), and ROC-AUC, ensuring robust assessment under class imbalance conditions. These results highlight the effectiveness of the approach for real-time anomaly detection. The study contributes a robust and efficient pipeline for improving the accuracy and reliability of anomaly-based intrusion detection systems.