Uncertainty-Aware Intrusion Detection: Selective Reclassification Using Error-Driven Auxiliary Models

Abstract

Modern intrusion detection systems (IDS) increasingly rely on machine learning and deep learning models to identify complex attack patterns in network traffic. However, such models often produce uncertain predictions under class imbalance, overlapping feature distributions, and evolving attack behaviors. This paper proposes an uncertainty-aware IDS approach based on selective reclassification in prediction ambiguity regions. The method introduces a formalized uncertainty interval ($\tau$-zone) over the confidence scores of a base classifier. Samples falling within this region are treated as ambiguous and passed to a secondary decision process. An auxiliary classifier is trained specifically on misclassified instances obtained only from the training/validation procedure, which enables targeted correction of the base model weaknesses while preserving the independence of the final test set. The approach is integrated into a sonification-based IDS pipeline using time-frequency representations and convolutional neural networks. The experimental evaluation on the NSL-KDD benchmark demonstrates improved F1-score and reduced falsenegative behavior for the Boost strategy compared with the baseline and Mixed strategies. The results indicate that selective decision refinement in uncertainty regions is a practical mechanism for improving IDS quality, while adaptive threshold selection, multi-dataset validation, and latency measurements are identified as directions for further work.