Augmentasi Moderat untuk Peningkatan Kemampuan Deteksi Anomali Serangan pada Dataset UNSW-NB15

Abstract

Class imbalance remains a persistent challenge in intrusion detection because infrequent attacks may carry substantial security impact while being poorly represented during model training. This study evaluates a moderate augmentation strategy for UNSW-NB15 by selectively limiting synthetic data growth instead of forcing every class to match the majority class. Four extremely underrepresented classesAnalysis, Backdoor, Shellcode, and Wormswere augmented using the target T_k = min(10,000, 15 x n_k). Network records were first mapped into a latent representation using a Stacked Denoising Autoencoder (SDAE), followed by five generative scenarios: Hybrid SDAE-GAN, SDAE Feature Extraction, SDAE Dimensionality Reduction, SDAE-WGAN-GP, and SDAE-CTGAN. No-augmentation and SMOTE baselines were included for comparison. S5-CTGAN achieved the highest macro F1-score of 0.4135, a 5.9% improvement over the no-augmentation baseline (0.3906), with an MCC of 0.5897. The most visible class-level gains were obtained for Analysis (F1 from 0.018 to 0.105) and DoS (0.206 to 0.375). S2-Feature Extraction produced the closest synthetic distribution with a mean Wasserstein Distance of 0.0172. A one-way ANOVA confirmed highly significant differences among experimental setups (p = 4.37 x 10^-41; eta-squared = 0.957), supported by Friedman and Tukey HSD tests. The results indicate that generating more synthetic samples is not inherently beneficial: aggressive full balancing can cause over-amplification, whereas controlled latent-space augmentation provides more stable gains while preserving the role of genuine observations.