RESEARCH ON THE IMPACT OF SYNTHETIC TRAINING SAMPLE BALANCING ON THE ACCURACY OF DETECTING COMPUTER ATTACKS

Abstract

The article investigates the influence of synthetic balancing of the training set on the accuracy of computer attack detection in intrusion detection system tasks. The relevance of the study is determined by the fact that real network traffic datasets are characterized by a significant class imbalance, due to which machine learning models demonstrate a reduced ability to detect rare and complex attack types. The purpose of the paper is to comparatively evaluate the influence of different approaches to synthetic balancing of training data on the quality of network traffic classification. The study considers a baseline approach without balancing, the classical SMOTENC method, and a signature-preserving adaptive synthetic balancing method aimed at preserving the statistical and structural properties of attack samples. The experimental study was carried out on attack detection data using classification quality metrics, in particular F1-score. The obtained results showed that the use of synthetic balancing improves attack detection quality compared with the baseline variant, while the signature-preserving adaptive approach demonstrates better results than the classical SMOTENC method. The practical significance of the study lies in substantiating the feasibility of using adaptive synthetic balancing to improve the accuracy of computer attack detection systems under conditions of imbalanced training datasets.