Paper Details

Intrusion detection models trained on skewed network data favor frequent traffic and miss rare, high-impact attacks. We study imbalance-aware learning on NSL-KDD, where U2R attacks constitute 0.04% of the training records, and propose a hybrid pipeline: random-forest feature selection, capped under-sampling with Borderline-SMOTE and Tomek-link cleaning, and a cost-sensitive LightGBM and Random Forest ensemble. We compare it with five standard classifiers and seven imbalance-aware alternatives under a single leakage-free protocol (5-fold cross-validation, a 30% hold-out, and the official KDDTest+ file). In cross-validation, the pipeline achieves the highest macro-F1 (0.951 ± 0.010) and a U2R recall of 0.775 ± 0.083, against 0.936 and 0.582 for XGBoost; its gain over class-weighted LightGBM (0.944) is small and not significant. On KDDTest+, which contains unseen attack types, all methods detect few rare attacks (proposed: R2L recall 0.12, U2R 0.13). Imbalance handling clearly helps over unweighted learners, but the full hybrid adds only a modest benefit over simple cost-sensitive learning.

Dr. S. A. Nagalpara, “An Imbalance-Aware Machine Learning Approach for Improving Minority-Class Cyberattack Detection”, International Journal of Advance Engineering and Research Development (IJAERD), Vol. 13, Issue 10, pp. 1-5, October 2026, DOI: 10.5281/zenodo.23600946.