K-Nearest Neighbor Performance Optimization for Multiclass Imbalance of Intrusion Detection Data Using SMOTE and Distance Variation-Based Parameter Tuning
DOI:
https://doi.org/10.29207/resti.v10i3.7489Keywords:
intrusion detection system, KNN method, multi class imbalance, SMOTE, tuning parameterAbstract
The increasing use of computer networks and internet-based services has made cybersecurity threats more complex. Intrusion Detection Systems (IDS) play a crucial role in identifying network attacks; however, conventional signature- or rule-based approaches are limited in handling novel attacks and dynamically changing attack patterns. Therefore, machine learning approaches are applied to enhance the adaptive capabilities of IDS. Nevertheless, the use of machine learning in IDS still faces a major challenge: data imbalance, where normal traffic significantly outweighs attack traffic. This condition biases models toward the majority class, leading to suboptimal detection of minority attacks. Based on this issue, this study aims to improve the performance of the K-Nearest Neighbor (KNN) method in network attack detection by applying the Synthetic Minority Over-sampling Technique (SMOTE) and parameter tuning. The study employs KNN with parameter tuning and SMOTE to address multiclass data imbalance in network attack detection. Parameter tuning is conducted to determine the optimal value of k and distance functions, including Euclidean, Manhattan, and Cosine Similarity. The results show that KNN with k = 3 and Manhattan distance on SMOTE-balanced data achieves the highest accuracy of 96.51%, outperforming Euclidean and Cosine Similarity distances. These findings conclude that applying SMOTE and appropriately selecting k and distance metrics significantly improve KNN performance in network attack detection and increase overall detection accuracy.
Downloads
References
H. Fawareh and M. Saeed, “The Complex Dynamics of Network Security Threats that Effects Persons and Organizations Security,” in Artificial Intelligence for Sustainable Innovation Management and Risk Management: A Systems (and Network) Perspective, A. Sarea, A. Echchabi, M. A. Salami, and A. Mahmood, Eds., Cham: Springer Nature Switzerland, 2026, pp. 2093–2113. doi: 10.1007/978-3-031-95310-1_151.
L. Diana, P. Dini, and D. Paolini, “Overview on Intrusion Detection Systems for Computers Networking Security,” Computers, vol. 14, no. 3, pp. 1–44, 2025, doi: 10.3390/computers14030087.
S. ur Rehman, H. Alhulayyil, T. Alzahrani, H. AlSagri, M. U. Khalid, and V. Gruhn, “Intrusion detection system framework for cyber-physical systems,” Egypt. Informatics J., vol. 30, no. June, pp. 1–9, 2025, doi: https://doi.org/10.1016/j.eij.2024.100600.
U. Ahmed et al., “Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering,” Sci. Rep., vol. 15, no. 1, pp. 1–33, 2025, doi: 10.1038/s41598-025-85866-7.
Y. Zhang, R. C. Muniyandi, and F. Qamar, “A Review of Deep Learning Applications in Intrusion Detection Systems: Overcoming Challenges in Spatiotemporal Feature Extraction and Data Imbalance,” Appl. Sci., vol. 15, no. 3, pp. 1–20, 2025, doi: 10.3390/app15031552.
V. Z. Mohale and I. C. Obagbuwa, “Evaluating machine learning-based intrusion detection systems with explainable AI: enhancing transparency and interpretability,” Front. Comput. Sci., vol. 7, no. May, pp. 1–23, 2025, doi: 10.3389/fcomp.2025.1520741.
A. A. Khan, O. Chaudhari, and R. Chandra, “A review of ensemble learning and data augmentation models for class imbalanced problems: Combination, implementation and evaluation,” Expert Syst. Appl., vol. 244, no. November 2023, p. 122778, 2024, doi: 10.1016/j.eswa.2023.122778.
O. Alnasser, J. Al Muhtadi, K. Saleem, and S. Shrestha, “Signature and anomaly based intrusion detection system for secure IoTs and V2G communication,” Alexandria Eng. J., vol. 125, no. June, pp. 424–440, 2025, doi: https://doi.org/10.1016/j.aej.2025.03.068.
M. A. Talukder et al., “Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction,” J. Big Data, vol. 11, no. 1, 2024, doi: 10.1186/s40537-024-00886-w.
C. Lu, Y. Cao, and Z. Wang, “Research on Intrusion Detection Based on an Enhanced Random Forest Algorithm,” Appl. Sci., vol. 14, no. 2, 2024, doi: 10.3390/app14020714.
S. Bagui and K. Li, “Resampling imbalanced data for network intrusion detection datasets,” J. Big Data, vol. 8, no. 1, 2021, doi: 10.1186/s40537-020-00390-x.
M. Sajid et al., “Enhancing intrusion detection: a hybrid machine and deep learning approach,” J. Cloud Comput., vol. 13, no. 1, 2024, doi: 10.1186/s13677-024-00685-x.
H. M. Khasanah, A. Aminuddin, F. F. Abdulloh, M. Rahardi, and H. Hairani, “Optimizing mushroom classification through machine learning and hyperparameter tuning,” Eng. Appl. Sci. Res., vol. 51, no. 5, pp. 651–660, 2024, doi: 10.14456/easr.2024.61.
M. A. Saare, S. A. Lashari, S. A. Abbas, M. A. Al-Shareeda, M. A. Almaiah, and R. Shehab, “An Interpretable ANN-Based Intrusion Detection System Using SMOTE and Bayesian Optimization,” J. Robot. Control, vol. 7, no. 1, pp. 3322–3332, Feb. 2026, doi: 10.18196/jrc.v7i1.26715.
H. M. Dinh, W. Zong, and Y. Chow, “Investigating Oversampling Techniques to Mitigate Class Imbalance in Network Intrusion Detection Datasets,” Pragmatic Cybersecurity, vol. 1, no. 1, pp. 1–24, 2026, doi: https://doi.org/10.53941/pc.2026.100004.
O. P. Barus, F. Billie, Jusin, J. J. Pangaribuan, and A. Maulana, “Obesity Prediction: K-Nearest Neighbor vs. Support Vector Machine,” in 2024 2nd International Conference on Technology Innovation and Its Applications (ICTIIA), 2024, pp. 1–5. doi: 10.1109/ICTIIA61827.2024.10761704.
Network Intrusion Detection Dataset (UNR-IDD), “Kaggle,” https://www.kaggle.com/datasets/mostafanofal/network-intrusion-detection-dataset-unr-idd/data.
K. Maharana, S. Mondal, and B. Nemade, “A review: Data pre-processing and data augmentation techniques,” Glob. Transitions Proc., vol. 3, no. 1, pp. 91–99, 2022, doi: 10.1016/j.gltp.2022.04.020.
N. V Chawla, K. W. Bowyer, and L. O. Hall, “SMOTE : Synthetic Minority Over-sampling TEchnique,” J. Artif. Intell. Res., vol. 16, pp. 341–378, 2002, doi: https://doi.org/10.1613/jair.953.
H. He and E. A. Garcia, “Learning from imbalanced data,” IEEE Trans. Knowl. Data Eng., vol. 21, no. 9, pp. 1263–1284, Sep. 2009, doi: 10.1109/TKDE.2008.239.
T. Widiyaningtyas, H. Hairani, D. D. Prasetya, U. Pujianto, and W. Caesarendra, “A Modified SMOTE with Noise Filtering and Manhattan Distance Metric Approach to Address Imbalanced Health Datasets,” Eng. Technol. Appl. Sci. Res., vol. 15, no. 4, pp. 25452–25459, Aug. 2025, doi: 10.48084/etasr.11925.
V. Teodorescu and L. Obreja Brașoveanu, “Assessing the Validity of k-Fold Cross-Validation for Model Selection: Evidence from Bankruptcy Prediction Using Random Forest and XGBoost,” Computation, vol. 13, no. 5, pp. 1–22, 2025, doi: 10.3390/computation13050127.
R. K. Halder, M. N. Uddin, M. A. Uddin, S. Aryal, and A. Khraisat, “Enhancing K-nearest neighbor algorithm: a comprehensive review and performance analysis of modifications,” J. Big Data, vol. 11, no. 1, pp. 1–55, 2024, doi: 10.1186/s40537-024-00973-y.
T. Cover and P. Hart, “Nearest neighbor pattern classification,” IEEE Trans. Inf. Theory, vol. 13, no. 1, pp. 21–27, Jan. 1967, doi: 10.1109/TIT.1967.1053964.
A. İ. Çetin and A. H. Büyüklü, “A new approach to K-nearest neighbors distance metrics on sovereign country credit rating,” Kuwait J. Sci., vol. 52, no. 1, pp. 1–10, 2025, doi: 10.1016/j.kjs.2024.100324.
R. Ehsani and F. Drabløs, “Robust Distance Measures for kNN Classification of Cancer Data,” Cancer Inform., vol. 19, pp. 1–9, 2020, doi: 10.1177/1176935120965542.
R. Buaton and S. Solikhun, “The Application of Numerical Measure Variations in K-Means Clustering for Grouping Data,” MATRIK J. Manajemen, Tek. Inform. dan Rekayasa Komput., vol. 23, no. 1, pp. 103–112, 2023, doi: 10.30812/matrik.v23i1.3269.
E. Blanco-Mallo, L. Morán-Fernández, B. Remeseiro, and V. Bolón-Canedo, “Do all roads lead to Rome? Studying distance measures in the context of machine learning,” Pattern Recognit., vol. 141, pp. 1–15, Sep. 2023, doi: 10.1016/j.patcog.2023.109646.
I. H. Sarker, “Machine Learning: Algorithms, Real-World Applications and Research Directions,” SN Comput. Sci., vol. 2, no. 3, p. 160, May 2021, doi: 10.1007/s42979-021-00592-x.
P. Singh, N. Singh, K. K. Singh, and A. Singh, “Chapter 5 - Diagnosing of disease using machine learning,” in Machine Learning and the Internet of Medical Things in Healthcare, K. K. Singh, M. Elhoseny, A. Singh, and A. A. Elngar, Eds., Academic Press, 2021, pp. 89–111. doi: https://doi.org/10.1016/B978-0-12-821229-5.00003-3.
F. Saeik et al., “Task offloading in Edge and Cloud Computing: A survey on mathematical, artificial intelligence and control theory solutions,” Comput. Networks, vol. 195, p. 108177, 2021, doi: https://doi.org/10.1016/j.comnet.2021.108177.
H. Hairani, T. Widiyaningtyas, D. D. Prasetya, and A. Aminuddin, “Addressing Imbalance in Health Datasets: A New Method NR-Clustering SMOTE and Distance Metric Modification,” Comput. Mater. Contin., vol. 82, no. 2, pp. 2931–2949, 2025, doi: 10.32604/cmc.2024.060837.
S. Zhou, “A Method for Improving KNN Model Performance Based on Surrogate Model Feature Selection,” in Proceedings of the 2nd International Conference on Image Processing, Machine Learning, and Pattern Recognition, in IPMLP ’25. New York, NY, USA: Association for Computing Machinery, 2025, pp. 171–176. doi: 10.1145/3759928.3759956.
B. Wan, Z. Sheng, W. Zhu, and Z. Hu, “Compactness-Weighted KNN Classification Algorithm,” Int. J. Adv. Comput. Sci. Appl., vol. 15, no. 9, pp. 229–238, 2024, doi: 10.14569/IJACSA.2024.0150922.
H. Hairani, A. Anggrawan, and D. Priyanto, “Improvement Performance of the Random Forest Method on Unbalanced Diabetes Data Classification Using Smote-Tomek Link,” Int. J. Informatics Vis., vol. 7, no. 1, pp. 258–264, 2023, doi: https://dx.doi.org/10.30630/joiv.7.1.1069.
D. Priyanto, H. Hairani, K. Marzuki, and M. Innuddin, “Optimization of Random Forest for Health Data Classification Using PCA and K-Means SMOTE-ENN,” Eng. Technol. Appl. Sci. Res., vol. 15, no. 5, pp. 27646–27652, 2025, doi: 10.48084/etasr.12976.
M. M. Ahsan, M. S. Ali, and Z. Siddique, “Enhancing and improving the performance of imbalanced class data using novel GBO and SSG: A comparative analysis,” Neural Networks, vol. 173, p. 106157, 2024, doi: https://doi.org/10.1016/j.neunet.2024.106157.
W. Chen, K. Yang, Z. Yu, Y. Shi, and C. L. P. Chen, “A survey on imbalanced learning: latest research, applications and future directions,” Artif. Intell. Rev., vol. 57, no. 6, pp. 1–51, 2024, doi: 10.1007/s10462-024-10759-6.
R. Suwanda, Z. Syahputra, and E. M. Zamzami, “Analysis of Euclidean Distance and Manhattan Distance in the K-Means Algorithm for Variations Number of Centroid K,” J. Phys. Conf. Ser., vol. 1566, no. 1, pp. 1–6, Jun. 2020, doi: 10.1088/1742-6596/1566/1/012058.
J. A. Tolentino and B. D. Gerardo, “Enhanced Manhattan-based Clustering using Fuzzy C-Means Algorithm for High Dimensional Datasets,” Int. J. Adv. Sci. Eng. Inf. Technol., vol. 9, no. 3, pp. 766–771, May 2019, doi: 10.18517/ijaseit.9.3.6005.
S. Chormunge and S. Jena, “Metric Based Performance Analysis of Clustering Algorithms for High Dimensional Data,” in 2015 Fifth International Conference on Communication Systems and Network Technologies, 2015, pp. 1060–1064. doi: 10.1109/CSNT.2015.127.
S. A. Ajagbe, J. B. Awotunde, and H. Florez, “Intrusion Detection: A Comparison Study of Machine Learning Models Using Unbalanced Dataset,” SN Comput. Sci., vol. 5, no. 8, pp. 1–10, 2024, doi: 10.1007/s42979-024-03369-0.
R. Mohammad, F. Saeed, A. A. Almazroi, F. S. Alsubaei, and A. A. Almazroi, “Enhancing Intrusion Detection Systems Using a Deep Learning and Data Augmentation Approach,” Systems, vol. 12, no. 3, pp. 1–18, 2024, doi: 10.3390/systems12030079.
A. O. Prabowo et al., “Evaluation of Anomaly-based Network Intrusion Detection Systems with Unclean Training Data for Low-rate Attack Detection,” J. Cubersecurity Priv., vol. 6, no. 1, pp. 1–36, 2026, doi: https://doi.org/10.3390/jcp6010014.
S. M. Kasongo, “A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework,” Comput. Commun., vol. 199, no. October 2022, pp. 113–125, 2023, doi: 10.1016/j.comcom.2022.12.010.
G. H. Lee, J. Kim, Y. Yoo, and I. Lee, “Scientific Reports Article in Press Early detection of air leakage in IoT-connected compressors using enhanced data sampling with deep learning IN Early Detection of Air Leakage in IoT-Connected IN,” Sci. Rep., pp. 1–19, 2025, doi: https://doi.org/10.1038/s41598-025-29522-0.
V. Bharathi, B. Poojitha, D. Ramesh, and P. Babu, “Intelligent Ad-Hoc Networking : Ensuring Confidential and Adaptive Data Transmission with AI,” Int. J. Commun. Networks Inf. Secur., vol. 17, no. 4, pp. 296–304, 2025. [Online]. Available: https://www.ijcnis.org/index.php/ijcnis/article/view/8429.
L. Liu, P. Wang, J. Lin, and L. Liu, “Intrusion Detection of Imbalanced Network Traffic Based on Machine Learning and Deep Learning,” IEEE Access, vol. 9, pp. 7550–7563, 2021, doi: 10.1109/ACCESS.2020.3048198.
A. S. Barkah, S. R. Selamat, Z. Z. Abidin, and R. Wahyudi, “Impact of Data Balancing and Feature Selection on Machine Learning-based Network Intrusion Detection,” JOIV Int. J. Informatics Vis., vol. 7, no. 1, pp. 241–248, Feb. 2023, doi: 10.30630/joiv.7.1.1041.
Y. S. Lim, “Empirical Evaluation of SNN for IoT Network Anomaly Detection,” J. Korean Inst. Commun. Inf. Sci., vol. 49, no. 11, pp. 1497–1509, 2024, doi: 10.7840/kics.2024.49.11.1497.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 Jurnal RESTI (Rekayasa Sistem dan Teknologi Informasi)
This work is licensed under a Creative Commons Attribution 4.0 International License.
Copyright in each article belongs to the author
- The author acknowledges that the RESTI Journal (System Engineering and Information Technology) is the first publisher to publish with a license Creative Commons Attribution 4.0 International License.
- Authors can enter writing separately, arrange the non-exclusive distribution of manuscripts that have been published in this journal into other versions (eg sent to the author's institutional repository, publication in a book, etc.), by acknowledging that the manuscript has been published for the first time in the RESTI (Rekayasa Sistem dan Teknologi Informasi) journal ;
