Claim Missing Document
Check
Articles

Found 33 Documents
Search

Improving Intrusion Detection under Extreme Class Imbalance through Class Representation Restructuring and SMOTE Ghozi, Wildanil; Mohamed Yassin, Warusia; Rakhmat Sani, Ramadhan; Rafrastara, Fauzi Adi
ELKHA Vol. 18 No.2 October 2026
Publisher : Faculty of Engineering, Universitas Tanjungpura

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.26418/elkha.v18i2.107677

Abstract

Class imbalance is a major challenge in multi-class network intrusion detection, particularly when extremely underrepresented attack categories provide insufficient samples for effective model learning. Such imbalance can cause machine learning models to favor majority classes, resulting in high overall accuracy but poor detection of minority attacks. This study proposes a data-level imbalance handling strategy that restructures the representation of extremely sparse attack classes before applying the Synthetic Minority Over-sampling Technique (SMOTE). Four experimental conditions were evaluated on the UNSW-NB15 dataset using Decision Tree, Random Forest, and XGBoost classifiers to examine the effects of class representation restructuring and SMOTE separately. The evaluation employed accuracy, macro-precision, macro-recall, and macro-F1-score, complemented by class-wise analysis. The results show that, for XGBoost, class representation restructuring without SMOTE increases macro-recall from 54.44% to 68.56% and macro-F1-score from 57.44% to 68.24%, while accuracy remains nearly unchanged. When SMOTE is subsequently applied to the restructured representation, macro-recall further increases to 78.60% and macro-F1-score to 69.05%. Compared with the original non-SMOTE condition, the combined strategy improves macro-recall by 24.16% and macro-F1-score by 11.61%, while accuracy decreases by only 0.73 %, from 98.30% to 97.57%. Class-wise analysis further indicates substantial recall improvements for several underrepresented attack categories, although precision trade-offs remain for some classes. These findings show that restructuring extreme minority-class representations before oversampling can improve minority-oriented detection performance under severe class imbalance.
Deteksi URL Phishing yang Tangguh Menggunakan Fitur Leksikal yang Disempurnakan dan Model Pembelajaran Mesin Komparatif Rahmawati, Firnanda; Rafrastara, Fauzi Adi; Ghozi, Wildanil; Rakhmat Sani, Ramadhan; Umam, Chaerul; Alomoush, Ashraf
Journal of Applied Informatics and Computing Vol. 10 No. 5 (2026): October 2026
Publisher : Politeknik Negeri Batam

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.30871/jaic.v10i5.14070

Abstract

Phishing URLs continue to evade classical filtering approaches as attackers refine their obfuscation strategies, motivating machine learning-based detection methods that adapt more readily to new patterns. This work compares three classifiers, Random Forest, Extreme Gradient Boosting (XGBoost), and a hybrid CNN-LSTM model, for phishing URL classification using enhanced lexical feature engineering, syntax-aware preprocessing, and systematic component-wise ablation analysis. First, the conventional six-feature lexical representation is extended to fourteen handcrafted features by incorporating cues associated with modern phishing behavior, including suspicious keywords, top-level domain characteristics, hexadecimal encoding, and query-parameter statistics. Second, a syntax-aware preprocessing strategy selectively removes non-structural punctuation while retaining structural URL delimiters. Third, cross-source duplicate URLs are resolved through a two-stage majority-vote deduplication process to reduce redundancy and potential data leakage. Fourth, all classifiers are evaluated under a shared data preparation protocol while retaining model-specific feature representations and configurations. Experiments on the Kaggle Malicious URLs dataset achieved accuracies of 95.47%, 97.86%, and 98.59% for Random Forest, XGBoost, and CNN-LSTM, respectively, with corresponding F1-scores of 92.97%, 96.73%, and 97.89%. CNN-LSTM achieved the highest overall test-set performance with 98.59% accuracy and 99.85% ROC-AUC, while XGBoost provided the strongest performance among the tree-based models. The results indicate that combining syntax-aware preprocessing and expanded lexical features with model-specific representations provides an effective framework for phishing URL classification.
Combining Convolutional Neural Networks and XGBoost for Phishing URL Classification Bagus Nurseto, Muhammad Narendra; Rafrastara, Fauzi Adi; Ghozi, Wildanil; Rakhmat Sani, Ramadhan; Susanto, Ajib; Hamadeh, Emad
Journal of Applied Informatics and Computing Vol. 10 No. 5 (2026): October 2026
Publisher : Politeknik Negeri Batam

Show Abstract | Download Original | Original Source | Check in Google Scholar | DOI: 10.30871/jaic.v10i5.14097

Abstract

Cyber threat detection failures stem from the complexity of psychological exploitation tactics leveraging target anxiety and the limitations of traditional models in analyzing non-linear correlations within the structural features of malicious web URLs. To improve classification performance and computational efficiency in feature engineering, a sequential hybrid framework is developed by combining the spatial feature extraction capabilities of RGB Color Mapping image tensors via a Convolutional Neural Network (CNN) with tree-based boosting classifiers (XGBoost and LightGBM). Experiments are executed using a public dataset containing 11,055 observations, applying an 80:10:10 data splitting schema and isolated MinMaxScaler normalization to eliminate data leakage risks. The evaluation results demonstrate that the hybrid CNN + XGBoost model achieves the highest performance, with a validation accuracy of 97.83% and an F1-score of 98.06%, outperforming the replicated State-of-the-Art Random Forest baseline accuracy (97.38%). The metric stability confirms that the proposed architecture possesses robust generalization capabilities for implementation as a near real-time cyber defense system.