Impact of SMOTE for Imbalance Class in DDoS Attack Detection Using Deep Learning MLP - Ilma, Zidni; Ghozi, Wildanil; Rafrastara, Fauzi Adi (Building of Informatics, Technology and Science (BITS), 2025)
DDoS attacks, which are becoming increasingly complex and frequent, pose significant challenges to network security, particularly with the rise of cyber exploitation of infrastructure. A major issue in detecting these attacks is the imbalance between normal traffic and attack data, which causes machine learning models to be biased toward the majority class. To address this, this study proposes the use of the Synthetic Minority Over-sampling Technique (SMOTE) to balance the CIC-DDoS2019 dataset, successfully enhancing the performance of a Multi-Layer Perceptron (MLP) in detecting various types of attacks. Analysis results indicate that, on the original dataset without SMOTE, the model achieved high accuracy but low F1-Score for minority classes, highlighting difficulties in recognizing underrepresented attack patterns. After applying SMOTE, the F1-Score significantly improved for minority classes, demonstrating the model's enhanced ability to identify attack patterns. All dataset subsets showed improved performance across key evaluation metrics, indicating that SMOTE effectively expanded the model's decision boundary for minority classes, enabling MLP to detect DDoS attacks more accurately in previously challenging data patterns. This approach illustrates increased model sensitivity to minority feature distributions without significantly compromising performance on majority classes.