Tackling extreme class imbalance in NIDS: a hybrid architecture integrating SMOTE and CNN-BiLSTM with focal loss

Abstract

With the rapid development of network technologies, Network Intrusion Detection Systems (NIDS) play a critical role in securing networks against malicious attacks. However, existing machine learning and deep learning models often struggle to effectively identify minority class attacks, such as User-to-Root (U2R) and Remote-to-Local (R2L), when faced with highly imbalanced network traffic data. To tackle this extreme class imbalance challenge, this paper proposes a hybrid NIDS framework integrating Synthetic Minority Over-sampling Technique (SMOTE), a CNN-BiLSTM architecture, and Focal Loss. First, at the data level, the SMOTE algorithm is employed to synthetically oversample minority classes in the training set, establishing a balanced data distribution. Subsequently, at the algorithmic level, a Convolutional Neural Network-Bidirectional Long Short-Term Memory (CNN-BiLSTM) deep neural network is designed to jointly extract the local spatial topologies and global temporal features of network traffic. Finally, the Focal Loss function is introduced to further optimize the model by dynamically down-weighting easily classified majority samples, forcing the network to focus on hard-to-classify boundary samples. Extensive experiments on the benchmark NSL-KDD dataset demonstrate that the proposed method achieves a breakthrough in minority attack recognition. Specifically, the F1-Scores for R2L and U2R are elevated to 0.38 and 0.34, respectively, significantly outperforming traditional machine learning and standard deep learning baselines while maintaining robust detection capabilities for majority attacks.