Cost-Sensitive Stacking Ensemble with Hybrid Feature Selection for Rare Attack Detection in Network Intrusion Detection Systems

Abstract

Machine learning-based network intrusion detection systems are often optimized using aggregate accuracy, although operational security depends on the reliable detection of rare, high-impact attacks. This paper proposes a data-preserving intrusion detection framework that combines hybrid feature selection, heterogeneous ensemble learning and cost-sensitive optimization for imbalanced multi-class attack detection. The method first applies Mutual Information filtering and Recursive Feature Elimination to reduce the NSL-KDD feature space from 122 one-hot encoded attributes to 25 discriminative features. Four classifiers, Random Forest, XGBoost, Support Vector Machine and K-Nearest Neighbors, are evaluated individually, and a stacking ensemble is constructed using Logistic Regression as a meta-learner. Class imbalance is addressed by balanced class weighting rather than by synthetic oversampling, preserving the original minority-class observations. Experiments on the NSL-KDD benchmark show that the proposed cost-sensitive configuration improves rare attack recognition, most notably increasing U2R recall from 0.00% to 35.82% (24 of 67 test instances) for the stacking ensemble; this improvement, together with the accompanying weighted F1-score change from 0.7120 to 0.7214, is statistically significant under the Wilcoxon signed-rank test across repeated random seeds, and both values are reported with their variability rather than as single point estimates. SVM obtains the largest global gain, with a 7.06 percentage point improvement in weighted F1-score. The results show that cost-sensitive learning is a simple and practical mechanism for improving rare-attack visibility, but also reveal a remaining limitation for R2L detection, where feature overlap with Normal traffic remains substantial. The revised validation design explicitly includes direct resampling baselines, repeated-seed evaluation, statistical significance testing, feature-subset sensitivity analysis, and absolute true-positive counts for R2L and U2R in order to avoid overinterpreting marginal point-estimate gains. All experiments, including the resampling comparison, the component ablation, the feature-subset sensitivity analysis and the repeated-seed statistical evaluation, are executed on the complete KDDTrain+ training set of 125,973 instances under a single unified protocol, so that every reported per-class value refers to the same experimental setting. The revised study additionally reports probability-level evaluation for the primary model, including class-level PR-AUC, precision-recall curves and a U2R threshold and alert-budget analysis, and validates the framework externally on the UNSW-NB15 benchmark, where balanced class weighting raises the recall of the rarest categories (Worms, Shellcode, Backdoor) from near-zero baseline levels to 69–96% under an identical protocol.