Open Access

ARTICLE

An Innovative Binary Model Framework for Cyberattack Detection and Classification in Imbalanced Domains

Óscar Mogollón-Gutiérrez^*, José Carlos Sancho Núñez, Mar Ávila, MohammadHossein Homaei, Andrés Caro

Department of Computer and Telematic Systems Engineering, Universidad de Extremadura, School of Technology, Cáceres, Spain

* Corresponding Author: Óscar Mogollón-Gutiérrez. Email:

Computers, Materials & Continua 2026, 88(1), 90 https://doi.org/10.32604/cmc.2026.079694

Received 26 January 2026; Accepted 31 March 2026; Issue published 08 May 2026

Abstract

Cyberattacks have increased in frequency and complexity in recent years, resulting in significant consequences for organizations. The negative consequences of cyberattacks force organizations to implement adequate cybersecurity measures to prevent and mitigate the impact of these attacks. Analysis of network traffic is essential for determining whether a cyberattack has been conducted. Intrusion detection systems (IDS) are used to detect malicious actions or irregularities in information systems. In conjunction with artificial intelligence (AI), they enable the development of intelligent intrusion detection systems. This paper presents an intelligent method of network traffic classification for securing systems with multiple connected devices. A proposed method combines several binary models, one for each type of cyberattack, in a two-step framework. The final system predicts whether new incoming traffic is legitimate or potentially malicious. In the first step, attacks are detected. In the second one, cyberattacks are classified into several categories. The proposal also addresses class imbalance by oversampling minority classes during binary model generation. The method was tested on four datasets related to intrusion detection in order to validate its effectiveness. Compared to classical machine learning models and state-of-the-art approaches, this model showed a significant gain in F1 scores, reaching an F1-score of 0.7213, 0.7754, 0.9340, and 0.9793 for NSL-KDD, UNSW-NB15, CSE-CICIDS2018, and ToN-IoT, respectively.

---

Keywords

---