SECAI Core · phase 3 of 15
Data balancing
A technique used to realign a training set so that rare, yet critical events receive proportionate attention
The Explain card
- Plain English
- Data balancing adjusts a training set so that rare but important events get a fair share of attention instead of being drowned out by the common ones.
- Example
- Real intrusions make up a tiny fraction of network sessions. Without balancing, a detector learns that "always say benign" is almost always right and completely useless.
- Why it matters
- Security data is almost always imbalanced. Balancing decides whether the model actually learns the threats, and the balancing method itself can introduce bias or synthetic artefacts.
- Hook
- Give the rare event a microphone or the crowd drowns it out.
Where it sits in the deck
Phase 3: Data Fundamentals: Types, Pipelines, and Preparation
Models are only as good as their data — understand the raw material and the engineering that shapes it before covering how it flows or breaks.
