Intrusion detection systems are essential for maintaining network security, yet they often face severe class imbalance, especially in multi-class intrusion scenarios, which leads to biased learning and poor recognition of minority attacks. Traditional oversampling methods, such as SMOTE and its variants, are limited in multi-class contexts and may generate redundant or noisy instances. To address these challenges, this paper proposes a novel clique-based multi-class oversampling with central and boundary instance strategies—CMCOB. The proposed method separates each minority class and computes cosine similarity to construct a bidirectional nearest-neighbor matrix. Based on this matrix, maximal cliques are identified, and new instances are generated within each clique through interpolation. By analyzing node degrees, CMCOB distinguishes between central and boundary instances, performing standard interpolation for central instances and radial interpolation toward the center for boundary instances. Experiments conducted on several multi-class benchmark datasets and the UNSW-NB15 intrusion detection dataset demonstrate that CMCOB achieves superior performance compared to existing multi-class oversampling methods. The results confirm that CMCOB effectively mitigates class imbalance and significantly enhances the accuracy of multi-class intrusion detection.
Xu et al. (Sat,) studied this question.