Adaptive TreeHive: Ensemble of trees for enhancing imbalanced intrusion classification

• Published in: PloS one Vol. 20; no. 9; p. e0331307
• Main Authors: Sobhani, Mahbub E., Rodela, Anika Tasnim, Farid, Dewan Md
• Format: Journal Article
• Language: English
• Published: United States Public Library of Science 01.09.2025; Public Library of Science (PLoS)
• Subjects: Algorithms; Bagging; Big Data; Classification; Collaboration; Communication; Communications networks; Cybersecurity; Data sampling; Datasets; Decision Trees; Deep learning; Design; Ensemble learning; Humans; Intrusion; Machine Learning; Malware; Neural networks; Oversampling; Sampling; Sampling methods; Sampling techniques; Supervised learning
• ISSN: 1932-6203; 1932-6203
• DOI: 10.1371/journal.pone.0331307

Imbalanced intrusion classification is a complex and challenging task as there are few number of instances/intrusions generally considered as minority instances/intrusions in the imbalanced intrusion datasets. Data sampling methods such as over-sampling and under-sampling methods are commonly applied for dealing with imbalanced intrusion data. In over-sampling, synthetic minority instances are generated e.g. SMOTE (Synthetic Minority Over-sampling Technique) and on the contrary, under-sampling methods remove the majority-class instances to create balanced data e.g. random under-sampling. Both over-sampling and under-sampling methods have the disadvantages as over-sampling technique creates overfitting and under-sampling technique ignores a large portion of the data. Ensemble learning in supervised machine learning is also a common technique for handling imbalanced data. Random Forest and Bagging techniques address the overfitting problem, and Boosting (AdaBoost) gives more attention to the minority-class instances in its iterations. In this paper, we have proposed a method for selecting the most informative instances that represent the overall dataset. We have applied both over-sampling and under-sampling techniques to balance the data by employing the majority and minority informative instances. We have used Random Forest, Bagging, and Boosting (AdaBoost) algorithms and have compared their performances. We have used decision tree (C4.5) as the base classifier of Random Forest and AdaBoost classifiers and naïve Bayes classifier as the base classifier of the Bagging model. The proposed method Adaptive TreeHive addresses both the issues of imbalanced ratio and high dimensionality, resulting in reduced computational power and execution time requirements. We have evaluated the proposed Adaptive TreeHive method using five large-scale public benchmark datasets. The experimental results, compared to data balancing methods such as under-sampling and over-sampling, exhibit superior performance of the Adaptive TreeHive with accuracy rates of 99.96%, 85.65%, 99.83%, 99.77%, and 95.54% on the NSL-KDD, UNSW-NB15, CIC-IDS2017, CSE-CIC-IDS2018, and CICDDoS2019 datasets, respectively, establishing the Adaptive TreeHive as a superior performer compared to the traditional ensemble classifiers.