IML-UTAD: An Integrated Machine Learning Framework with Hybrid Secretary Bird Optimization-Based Feature Selection for Unbalanced Network Traffic Anomaly Detection
Bhausaheb S. Salve, Purushottam R. PatilIntroduction:
The increasing complexity of networked systems and the rapid evolution of cyber threats have created significant challenges for intrusion detection systems (IDS), particularly in environments with highly unbalanced network traffic. This study proposes the IML-UTAD framework to improve intrusion detection performance and enhance detection of minority-class attacks.
Methods and Materials:
The proposed framework incorporates comprehensive data preprocessing, including data cleaning, transformation, and normalization. Adaptive Synthetic Sampling (ADASYN) is employed to address class imbalance by generating synthetic samples for minority attack classes. Hybrid Secretary Bird Optimization (HSBO), integrated with an information-theoretic feature selection approach, is used to identify relevant features, reduce redundancy, and improve feature representation. The selected features are classified using an ensemble model that combines Random Forest, XGBoost, and Support Vector Machine (SVM) via weighted soft voting.
Results:
Experimental evaluation on benchmark intrusion detection datasets demonstrates that IML-UTAD achieves improved accuracy, precision, recall, F1-score, and Matthews Correlation Coefficient (MCC). The framework particularly enhances detection performance for minority-class attacks compared with conventional individual classifiers and other existing approaches.
Discussion:
The integration of ADASYN effectively mitigates the adverse effects of class imbalance, while HSBO improves feature relevance and reduces redundant information. The ensemble model combines the complementary strengths of multiple classifiers, thereby enhancing robustness, classification stability, and generalization across different attack categories.
Conclusion:
The proposed IML-UTAD framework provides an efficient, scalable, and reliable solution for intrusion detection in unbalanced network traffic. By integrating imbalance handling, optimized feature selection, and ensemble learning, the framework demonstrates improved reliable detection performance, supporting its potential application in real-world network security environments.