This paper addresses the critical challenge of imbalanced datasets in data-driven cybersecurity, afecting model eficacy. It investigates the impact of data quantity and quality management through random undersampling on multiclass classification using the UNSW-NB15 dataset and Support Vector Classifiers (SVC). Furthermore, it explores a quantum perspective by examining quantum SVC with diferent sampling methods. Obtained results show that balanced datasets, achieved via undersampling, yield superior classification performance. While quantum approaches demonstrate fast learning, current noise limitations are noted. This work underscores the importance of data preprocessing and highlights future avenues for quantum machine learning in robust threat detection.
Cybersecurity is a fundamental quality aspect of Information and Communication Technologies aiming to, e.g., restrict access to sensitive data, protect critical infrastructure from disruption, and ensure national security against digital espionage and sabotage. The digital landscape poses persistent and increasingly dificult threats, challenges, and evolving issues, including sophisticated ransomware attacks, widespread phishing campaigns, distributed denial-of-service (DDoS) attacks, and insider threats, to name a few. Such problems may be afected by rapidly evolving attack vectors, the increasing complexity of systems, human error, and the growing vulnerabilities in Internet of Things (IoT) devices. To address them, a combination of proactive and reactive solutions is consistently required. Proactive measures include, e.g., threat intelligence, vulnerability management, security by design principles, encryption, firewalls, and intrusion prevention systems. Reactive measures encompass approaches such as robust incident response frameworks, digital forensics, prompt patch management, intrusion detection systems (IDS), and comprehensive malware analysis.
Models are of strategic importance in addressing both approaches. Models are usually used to design and to assess computing system Cybersecurity aspects, and are particularly useful for predicting and identifying threats as well as for assessing their impact. But, for such a purpose, they need large amount of data to either fit statistical parameters and distributions of white-box models or to train black-box (e.g. machine learning) ones. This is moving the focus of cybersecurity research on datasets and data management, towards data-driven cybersecurity.
As a consequence, cybersecurity data management presents significant challenges regarding data availability, quantity and size, i.e. the number of data points available in a dataset. Cybersecurity datasets, indeed, are typically quite unbalanced. Attack events, such as man-in-the-middle attacks, worm infections, malware propagation, denial-of-service (DoS) attacks, SQL injection, cross-site scripting (XSS), and privilege escalation, are inherently rare in real-world observations. Furthermore, cybersecurity data quality impacts on quantity, implying preprocessing activities such as filtering, cleaning, aggregation, and fusion that may afect the dataset size. Data scarcity in cybersecurity may lead to biased and misleading representation of normal versus anomalous activities.
Considering classification problems and machine learning models, therefore, dealing with data quantity and quality in cybersecurity analysis is of utmost importance. Widely unbalanced datasets may lead to model overfitting, where the model learns the majority class too well and performs poorly on the rare attack instances. Conversely, small datasets can result in low accuracy and generalizability, failing to capture the complexity of real-world phenomena.
This paper performs an in-depth analysis of unbalanced datasets. It applies undersampling techniques to obtain balanced datasets with diferent sizes. These modified datasets are then compared against their original, unbalanced counterparts. The objective is to determine a proper size and optimal mixture among classes for efective classification problems. Even diferent computational paradigms are considered within this comparison, including classical and quantum computing approaches.
The results obtained from investigating a real-world cybersecurity dataset provide interesting insights. The study demonstrates the efectiveness of random undersampling techniques. Furthermore, it reveals better performance with balanced datasets, as opposed to unbalanced ones. This trend is much more evident and further highlighted by increasing the dataset size to widely unbalanced ones.
The remainder of the paper is organized as follows. Section 2 introduces and defines data-driven
cybersecurity, while Section 3 provides the background solutions and technologies for its enforcement.
Section 4 reports a case study on network intrusion detection systems based on the well-known
UNSWNB15 dataset [
Data-driven cybersecurity is an emerging approach that leverages data science and technologies such
as advanced analytics, machine learning, and vast amounts of security-related data to enhance the
detection, prevention, and response to cyber threats [
This paradigm shift from traditional, reactive security measures to proactive data-centric
methodologies has become essential as cyber threats grow in complexity and frequency. The increasing complexity
and frequency of cyber threats necessitate this evolution. By processing structured, semi-structured, and
unstructured data, organizations can derive actionable insights that inform robust security strategies,
thereby enhancing overall resilience against cyber attacks [
At its heart, data-driven security relies heavily on machine learning (ML) and deep learning
algorithms. These models are trained on historical and real-time data to identify intricate patterns indicative
of malicious activity or anomalies that deviate from established baselines [
Despite its demonstrable advantages, data-driven cybersecurity encounters several inherent
challenges. These include issues pertaining to data quality, the complexities of regulatory compliance, and
the imperative for efective inter-team collaboration. The reliance on diverse data sources necessitates
rigorous data management practices to ensure the accuracy and relevance of information, as suboptimal
data quality can inherently compromise threat detection capabilities. Moreover, organizations must
diligently navigate the intricate landscape of evolving data privacy regulations while simultaneously
optimizing model performance to mitigate false positives and combat alert fatigue. Data-driven security
systems, particularly in areas like smart grids, face challenges in integrating diverse data sources and
ensuring real-time analysis [
As the cybersecurity landscape continues its dynamic evolution, the emphasis on data-driven
methodologies is projected to intensify, solidifying its role as a vital component of organizational security
strategies. The continuous progression of technologies such as artificial intelligence (AI) and machine
learning is poised to further amplify the potential of data-driven cybersecurity in advanced threat
management, thereby reinforcing its indispensable significance in safeguarding sensitive information
within an increasingly digitized global environment. This includes applications in industrial control
systems, where multilayer data-driven cyber-attack detection systems are being developed based on
network, system, and process data [
Machine learning (ML) enables systems to learn patterns from data without explicit programming. It
involves training models on datasets to make predictions or decisions. This process involves defining a
problem, collecting a dataset, data cleaning and feature engineering, selecting and training a model,
evaluating it and deploying the trained model. This section contains brief introduction to the ML; for
more detailed exposition please refer, for example, to [
A dataset is a structured collection of data items, typically represented as a matrix where rows correspond to samples and columns represent features. For the supervised learning, the dataset additionally contains the labels for each data item that represent the ground truth value. Formally, the dataset is denoted by X = {x1, . . . , x} ∈ R× , the corresponding labels are denoted by ∈ , where is an arbitrary finite set, = 1, . . . , , and each class is denoted by C = {x ∈ X | = }, where ∈ . By definition, C ∩ C = ∅ for ̸= , and ⋃︀∈ C = X. Once the dataset is defined, the next step is to split it into training and testing subsets to evaluate model performance.
The dataset X is divided into training Xtrain and testing Xtest subsets to evaluate model performance: X = Xtrain ∪ Xtest; Xtrain ∩ Xtest = ∅. The training set is used to train the model, while the test set assesses its generalization to unseen data. Common splits include 80% training and 20% testing, with stratified sampling to maintain tasks (i.e. the training and testing datasets contain the same proportion of items of diferent classes). This ensures that the model performance is measured on representative data.
Building on this, multi-class classification is a supervised learning task where the goal is to assign input data to one of multiple classes. Unlike binary classification, which distinguishes between two classes, multi-class problems require models to diferentiate between three or more categories (e.g., classifying images into “cat,” “dog,” “bird”, or, as in our case, diferent types of attacks). To evaluate such models, specific metrics are used.
One of the metrics to evaluate the model efectiveness is the 1 score. This metric balances precision (TP/(TP + FP)) and recall (TP/(TP + FN)), addressing trade-ofs between false positives (FP) and false negatives (FN). For multi-class problems, the macro-averaged 1 score, the unweighted mean of 1 score for all classes, provides a balanced measure of model performance.
There are a multitude of methods that can be used to solve the classification problem. One such method is the use of support vector machines (SVMs). SVMs identify the optimal hyperplane to separate classes in feature space. The Support Vector Classifier (SVC) is an implementation of SVM for classification. Formally, SVC solves the following optimization problem maximize ( 1,..., ) s.t.
∑︀=1 − 12 ∑︀=1 ∑︀=1 (x, x ),
0 ≤ ≤ and ∑︀=1 = 0, where (x, x ) = x · x denotes the dot product, the weights are associated with the support vectors (the points closest to the separating hyperplane), and is a regularization hyperparameter.
A key technique in SVMs is the kernel trick, which maps input data into a higher-dimensional space using an arbitrary kernel function (x, x ) instead of the dot product. This allows linear separation of non-linearly related data without explicitly computing the transformation, improving eficiency and lfexibility. One of the most widely used kernels is the Radial Basis Function (RBF) kernel.
The RBF kernel, defined as (, ) = exp(− ‖ − ‖2), where controls the kernel influence, is a popular choice for non-linear problems. By mapping data into an infinite-dimensional space, it efectively captures complex, non-linear relationships. This makes the RBF kernel particularly valuable in scenarios where data is not linearly separable.
In machine learning, sampling refers to the process of selecting a subset of data from a larger dataset to train models. This is particularly critical when dealing with imbalanced datasets, where one class (the majority class) significantly outnumbers the other (the minority class): i.e. if some class outnumbers other classes : || ≫ | |. Proper sampling techniques help ensure that models are trained on representative data, reducing bias and improving generalization. Building on this, undersampling methods are specifically designed to address class imbalance by removing some instances in the majority class.
To address class imbalance, undersampling techniques are employed to balance the dataset by decreasing the number of majority class samples. Two common approaches are: Random undersampling. This method randomly selects a subset of the majority class samples to match the number of minority class samples. For example, if the minority class has 100 instances and the majority class has 1,000, random undersampling would randomly retain majority samples. While simple and computationally eficient, this approach risks losing important information from the majority class, as random selection does not consider the distribution or relevance of the samples. NearMiss methods. There are several closely related undersampling techniques that selects majority class samples based on their proximity to the minority class. This study focuses on NearMiss-3 method, which operates in three steps: • For each minority sample, identify its nearest neighbors from the majority class. • select the samples that are farthest from the minority sample (to avoid overfitting to noisy or outlier samples).
• Retain these selected majority samples for the balanced dataset.
This method preserves the structure of the majority class while focusing on regions where the minority class is most prevalent, making it more efective than random undersampling in retaining meaningful patterns.
By incorporating these undersampling strategies, it is possible to mitigate the efects of class imbalance and achieve robust and fair model performance.
Quantum computing leverages principles of quantum mechanics, such as superposition and
entanglement, to perform computations that are infeasible for classical computers. Unlike classical bits,
which exist in a state of 0 or 1, quantum systems use qubits (quantum bits) to encode information in a
superposition of states. This enables parallelism and exponential speedups for specific problems, such as
factoring large numbers or simulating quantum systems. This section provides a basic introduction into
quantum computing; for a more detailed introduction please refer, for example, to the textbook [
A qubit is the fundamental unit of quantum information. It is represented as a quantum state in a two-dimensional Hilbert space:
| ⟩ = |0⟩ + |1⟩, correspond to classical bits, but the qubit can exist in any linear combination of these states. where ,
∈ C are complex amplitudes satisfying | |2 + | |2 = 1. The basis states |0⟩ and |1⟩ For qubits, the combined quantum state lives in a 2-dimensional Hilbert space. For example, two qubits can be in a state:
| ⟩ = |00⟩ + |01⟩ + 10⟩ + |11⟩, correlated in ways impossible for classical systems. A classic example is the Bell state: where | |2 + | |2 + | |2 + | |2 = 1. This state can exhibit entanglement, where the qubits’ states are 1 | Φ+⟩ = √2 (|00⟩ + |11⟩). the state of an -qubit system is written as | ⟩ = ∑︀2− 1 =0 |⟩.
The notation |⟩ for a number ∈ Z≥ 0 means that |⟩ is a basis state with qubit states corresponding to the binary notation of the number . For example, the state |10⟩ can be written as |2⟩, and in general,
Quantum states can be modified by performing quantum operations. They are described by unitary matrices , which preserve the norm of the quantum state. For a single qubit, the Hadamard gate and Pauli gates , , are fundamental: = √ 1 (︂ 1
1 )︂ 2
Pauli gates can be used to define rotation gates, for example, ( ) = − / 2, where ∈ [0, 2 ): ( ) = ︂( cos(/ 2) − sin(/ 2))︂ sin(/ 2) cos(/ 2) .
Another important gate is the controlled-NOT (CNOT) gate, which is analogous to the “if-then-else” construction in the classical programming: CNOT = ⎜⎜⎝00 10 00 01⎟⎠⎟ .
0 0 1 0 encode it in a quantum state. encoding strategies include:
To extract the information from the quantum state, one needs to perform measurements and get a classical outcome. For a qubit in state | ⟩ = ∑︀2− 1
=0 |⟩, the probability of measuring |⟩ is | |2.
After the measurement, the state collapses to the observed basis state, so subsequent measurements will return the same outcome with probability 1.
Quantum Machine Learning (QML) combines principles from quantum computing and machine learning. It is used to process and analyze data, often ofering advantages in speed, scalability, or expressivity over classical methods. QML typically outsources some step in the ML pipeline to a quantum computer. In order to work with classical data on a quantum computer, it is necessary to Data encoding is the process of translating classical input data into quantum states. Common • amplitude encoding that represents 2-dimensional data as the amplitudes of a -qubit quantum state: • angle encoding that represents data as the angles of rotations, for example: | (x)⟩ = 1
∑︁ , |⟩ , ‖x‖ =1 | (x)⟩ = ∏︁ ()(, ) ⃒⃒ 0⊗ ⟩︀ ,
=1
The choice of encoding depends on the task, the quantum hardware, and the desired trade-of between expressivity and complexity.
This study adopts a heuristic real amplitudes encoding ⃒⃒ qra(x)︀⟩ from the Qiskit circuit
library [
This study is based on the widely adopted UNSW-NB15 dataset [
All tests were performed on a machine with the following characteristics. CPU: AMD Ryzen 9 5950X, RAM: 64 GiB, OS: Linux, kernel: 6.6.74-gentoo, Python: 3.12.9, jupyter-core: 5.7.2, numpy: 2.2.2, qiskit: 1.3.2, qiskit-machine-learning: 0.8.2, scikit-learn: 1.6.1. The source code is available upon request.
The case study focus on the efects of balancing the dataset on the multiclass classification of a packet into various attack classes. In this experiment, given the required class size ℓ, the random undersampling method selects a random subset C′ ⊆ C for each class ∈ . If ℓ ≤ | C| then |C′| = ℓ; otherwise, the random undersampling method selects the whole class: C′ = C, and |C′| < ℓ. After the random undersampling step, the support vector classifier [ 19] is trained to classify the data items on the selected subset X′ = ⋃︀∈ C′ of training dataset and its performance is assessed on randomly selected 100 data items (10 data items per class) from test dataset by using 1 score averaged over all classes.
The experiment results are reported in Figure 2. Note that the maximum average 1 score roughly coincides with ℓ = 130, which is the maximum ℓ value when the selected subset is still balanced, so training on an imbalanced dataset doesn’t improve the results.
Another (preliminary) result of this study is the investigation of the behavior of the quantum SVC in
conjunction with diferent sampling techniques such as random undersampling and the NearMiss-3
method [20], which is based on geometric ideas. The heuristic quantum kernel real amplitudes [
This study rigorously investigated the interconnected challenges of data quantity and quality in multiclass classification within data-driven cybersecurity, while also providing a preliminary quantum perspective. Our experiments with the UNSW-NB15 dataset unequivocally demonstrate the critical influence of data imbalance on model performance. We found that strategically managing data quantity through random undersampling techniques to create balanced training sets significantly enhances classification accuracy and generalizability compared to using highly imbalanced datasets, thereby proving the direct link between data quality improvements and model eficacy. This finding highlights the essential role of diligent data preprocessing and balancing strategies in developing efective threat detection systems.
Furthermore, our preliminary exploration into the quantum perspective of machine learning, specifically with the quantum Support Vector Classifier, revealed promising fast learning capabilities. This suggests a compelling potential for quantum computing to ofer novel computational paradigms for cybersecurity analytics in the future. However, it is crucial to acknowledge the current technological limitations, particularly concerning noise efects in contemporary quantum hardware, which underscore the need for continuous advancements in both quantum hardware and algorithm development.
Future work should focus on a deeper exploration of advanced data balancing techniques, including more sophisticated methods for managing data quantity and quality beyond simple undersampling. Investigating the robustness and scalability of quantum machine learning models on larger and more diverse cybersecurity datasets will be paramount. Additionally, developing and implementing efective noise mitigation strategies will be key to unlocking the full potential of quantum approaches and transitioning these theoretical perspectives into practical, high-impact cybersecurity applications.
We acknowledge financial support under the National Recovery and Resilience Plan (PNRR), Mission 4, Component 2, Investment 1.4, Call for tender No. 1031 published on 17/06/2022 by the Italian Ministry of University and Research (MUR), funded by the European Union – NextGenerationEU, Project Title "National Centre for HPC, Big Data and Quantum Computing (HPC)" – Code National Center CN00000013 – CUP D43C22001240001. This work has also been supported by the European Union - Next Generation EU under the Italian National Recovery and Resilience Plan (NRRP), Mission 4, Component 2, Investment 1.3, project 3D-SEECSDE, CUP J33C22002810001, partnership on “SEcurity and RIghts in the CyberSpace” (PE00000014 - program “SERICS”).
During the preparation of this work, the author(s) used LLM tools in order to: Grammar and spelling check. After using these tool(s)/service(s), the author(s) reviewed and edited the content as needed and take(s) full responsibility for the publication’s content. contaminant features in intrusion detection datasets, in: 2022 19th Annual International Conference on Privacy, Security & Trust (PST), 2022, pp. 1–11. doi:10.1109/PST55820.2022.9851974. [19] C. Cortes, V. Vapnik, Support-vector networks, Machine Learning 20 (1995) 273–297. doi:10.
1007/bf00994018. [20] I. Mani, I. Zhang, knn approach to unbalanced data distributions: a case study involving information extraction, in: Proceedings of workshop on learning from imbalanced datasets, volume 126, ICML United States, 2003, pp. 1–7.