# Adaptive Sampling Framework for Imbalanced DDoS Traffic Classification

## TL;DR

This paper introduces a new adaptive sampling method to improve detection of rare DDoS attacks in imbalanced network data.

## Contribution

A novel adaptive sampling framework that combines oversampling and undersampling for DDoS traffic classification.

## Key findings

- The proposed method outperformed baseline models in accuracy, recall, and F1-score on benchmark DDoS datasets.
- Improved detection of minority attack classes enhances the reliability of sensor-driven security systems.
- The approach is adaptable and applicable to other imbalanced classification tasks in sensor environments.

## Abstract

Imbalanced data is a major challenge in network security applications, particularly in DDoS (Distributed Denial of Service) traffic classification, where detecting minority classes is critical for timely and cost-effective defense. Existing machine learning and deep learning models often fail to accurately classify such underrepresented attack types, leading to significant degradation in performance. In this study, we propose an adaptive sampling strategy that combines oversampling and undersampling techniques to address the class imbalance problem at the data level. We evaluated our approach using benchmark DDoS traffic datasets, where it demonstrated improved classification performance across key metrics, including accuracy, recall, and F1-score, compared to baseline models and conventional sampling methods. The results indicate that the proposed adaptive sampling approach improved minority class detection performance under the tested conditions, thereby improving the reliability of sensor-driven security systems. This work contributes a robust and adaptable method for imbalanced data classification, with potential applications across simulated sensor environments where anomaly detection is essential.