# Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction

arXiv: https://arxiv.org/abs/2401.12262 · HTML: https://mlsanity.com/paper/2401.12262/

## Key facts

- Cited by 16 papers in the map (data through 14 Oct 2026).
- Builds on 7 of its 65 references that are in the map.
- First posted on arXiv 22 Jan 2024.

## Builds on (most cited first, 7 of 7)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [Machine Learning in IoT Security: Current Solutions and Future Challenges](https://mlsanity.com/paper/1904.05735/) (2019)
- [Machine Learning-based Lung and Colon Cancer Detection using Deep Feature Extraction and Ensemble Learning](https://mlsanity.com/paper/2206.01088/) (2022)
- [A Dependable Hybrid Machine Learning Model for Network Intrusion Detection](https://mlsanity.com/paper/2212.04546/) (2022)
- [A Novel Hierarchical Intrusion Detection System based on Decision Tree and Rules-based Models](https://mlsanity.com/paper/1812.09059/) (2018)
- [Securing the Digital World: Protecting smart infrastructures and digital industries with Artificial Intelligence (AI)-enabled malware and intrusion detection](https://mlsanity.com/paper/2401.01342/) (2023)
- [An Optimized Ensemble Deep Learning Model For Brain Tumor Classification](https://mlsanity.com/paper/2305.12844/) (2023)

## Built on by (most cited first, 16 of 16)

- [MLSTL-WSN: Machine Learning-based Intrusion Detection using SMOTETomek in WSNs](https://mlsanity.com/paper/2402.13277/) (2024)
- [Securing Transactions: A Hybrid Dependable Ensemble Machine Learning Model using IHT-LR and Grid Search](https://mlsanity.com/paper/2402.14389/) (2024)
- [usfAD Based Effective Unknown Attack Detection Focused IDS Framework](https://mlsanity.com/paper/2403.11180/) (2024)
- [Preliminary study on artificial intelligence methods for cybersecurity threat detection in computer networks based on raw data packets](https://mlsanity.com/paper/2407.17339/) (2024)
- [Neuromorphic Cybersecurity with Semi-supervised Lifelong Learning](https://mlsanity.com/paper/2508.04610/) (2025)
- [Exploring Gene Regulatory Interaction Networks and predicting therapeutic molecules for Hypopharyngeal Cancer and EGFR-mutated lung adenocarcinoma](https://mlsanity.com/paper/2402.17807/) (2024)
- [A Dual-Tier Adaptive One-Class Classification IDS for Emerging Cyberthreats](https://mlsanity.com/paper/2403.13010/) (2024)
- [A Survey for Deep Reinforcement Learning Based Network Intrusion Detection](https://mlsanity.com/paper/2410.07612/) (2024)
- [An Evaluation Framework for Network IDS/IPS Datasets: Leveraging MITRE ATT&CK and Industry Relevance Metrics](https://mlsanity.com/paper/2511.12743/) (2025)
- [Hybridized Convolutional Neural Networks and Long Short-Term Memory for Improved Alzheimer's Disease Diagnosis from MRI Scans](https://mlsanity.com/paper/2403.05353/) (2024)
- [An Integrated Deep Learning Model for Skin Cancer Detection Using Hybrid Feature Fusion Technique](https://mlsanity.com/paper/2410.14489/) (2024)
- [MULTI-LF: A Continuous Learning Framework for Real-Time Malicious Traffic Detection in Multi-Environment Networks](https://mlsanity.com/paper/2504.11575/) (2025)
- [Forecasting Future DDoS Attacks Using Long Short Term Memory (LSTM) Model](https://mlsanity.com/paper/2509.02076/) (2025)
- [SD-CGAN: Conditional Sinkhorn Divergence GAN for DDoS Anomaly Detection in IoT Networks](https://mlsanity.com/paper/2512.00251/) (2025)
- [Threat Detection in Social Media Networks Using Machine Learning Based Network Analysis](https://mlsanity.com/paper/2601.02581/) (2026)
- [MI2DAS: A Multi-Layer Intrusion Detection Framework with Incremental Learning for Securing Industrial IoT Networks](https://mlsanity.com/paper/2602.23846/) (2026)

## Abstract (arXiv)

Cybersecurity has emerged as a critical global concern. Intrusion Detection Systems (IDS) play a critical role in protecting interconnected networks by detecting malicious actors and activities. Machine Learning (ML)-based behavior analysis within the IDS has considerable potential for detecting dynamic cyber threats, identifying abnormalities, and identifying malicious conduct within the network. However, as the number of data grows, dimension reduction becomes an increasingly difficult task when training ML models. Addressing this, our paper introduces a novel ML-based network intrusion detection model that uses Random Oversampling (RO) to address data imbalance and Stacking Feature Embedding based on clustering results, as well as Principal Component Analysis (PCA) for dimension reduction and is specifically designed for large and imbalanced datasets. This model's performance is carefully evaluated using three cutting-edge benchmark datasets: UNSW-NB15, CIC-IDS-2017, and CIC-IDS-2018. On the UNSW-NB15 dataset, our trials show that the RF and ET models achieve accuracy rates of 99.59% and 99.95%, respectively. Furthermore, using the CIC-IDS2017 dataset, DT, RF, and ET models reach 99.99% accuracy, while DT and RF models obtain 99.94% accuracy on CIC-IDS2018. These performance results continuously outperform the state-of-art, indicating significant progress in the field of network intrusion detection. This achievement demonstrates the efficacy of the suggested methodology, which can be used practically to accurately monitor and identify network traffic intrusions, thereby blocking possible threats.