GAN-AHR: A GAN-Based Adaptive Hybrid Resampling Algorithm for Imbalanced Intrusion Detection

With the recent proliferation of the Internet and the ever-evolving threat landscape, developing a reliable and effective intrusion detection system (IDS) has become an urgent need. However, one of the key challenges hindering the success of IDS development is class imbalance, which often leads to biased models and poor detection rates. To address this challenge, this paper proposes a GAN-AHR algorithm which adaptively balances the dataset by augmenting minority classes using CGAN or BSMOTE, based on class-specific characteristics such as compactness and density. By leveraging BSMOTE to oversample classes with high compactness and high density, we can exploit its simplicity and effectiveness. However, the quality of BSMOTE-generated data is significantly lower when the classes are sparse and lacking clear boundaries. In such cases, CGAN is better suited in this scenario given its ability to capture complex data distributions. We present empirical results on the NF-UNSW-NB15 dataset using a Random Forest (RF) classifier, reporting a significant improvement in the precision, recall, and F1-score of several minority classes. Specifically, a remarkable increase in the F1-score for the Shellcode and DoS classes was reported, reaching 0.90 and 0.51, respectively.