Effect of Balancing Data Using Synthetic Data on the Performance of
  Machine Learning Classifiers for Intrusion Detection in Computer Networks
  Attacks on computer networks have increased significantly in recent days, due
in part to the availability of sophisticated tools for launching such attacks
as well as thriving underground cyber-crime economy to support it. Over the
past several years, researchers in academia and industry used machine learning
(ML) techniques to design and implement Intrusion Detection Systems (IDSes) for
computer networks. Many of these researchers used datasets collected by various
organizations to train ML models for predicting intrusions. In many of the
datasets used in such systems, data are imbalanced (i.e., not all classes have
equal amount of samples). With unbalanced data, the predictive models developed
using ML algorithms may produce unsatisfactory classifiers which would affect
accuracy in predicting intrusions. Traditionally, researchers used
over-sampling and under-sampling for balancing data in datasets to overcome
this problem. In this work, in addition to over-sampling, we also use a
synthetic data generation method, called Conditional Generative Adversarial
Network (CTGAN), to balance data and study their effect on various ML
classifiers. To the best of our knowledge, no one else has used CTGAN to
generate synthetic samples to balance intrusion detection datasets. Based on
extensive experiments using a widely used dataset NSL-KDD, we found that
training ML models on dataset balanced with synthetic samples generated by
CTGAN increased prediction accuracy by up to $8\%$, compared to training the
same ML models over unbalanced data. Our experiments also show that the
accuracy of some ML models trained over data balanced with random over-sampling
decline compared to the same ML models trained over unbalanced data.
