Systematically Optimized CNN-Transformer with Focal Loss for Imbalanced Intrusion Detection on NSL-KDD
A tuned CNN-Transformer with Focal Loss reaches 98.73% accuracy on imbalanced NSL-KDD detection.
The authors optimize a CNN-Transformer intrusion detector for imbalanced NSL-KDD data, using XGBoost feature selection, Optuna tuning, and Focal Loss rather than oversampling. Ablations find Focal Loss at gamma 1.5 improves minority recall, while SMOTE reduces precision. With learning rate 0.00042 and batch size 256, the model reports 98.73% test accuracy and F1-scores of 84.63% for R2L and 69.66% for U2R. SHAP analysis points to features such as HTTP service and login status and attributes remaining U2R precision limits to feature overlap.
- Targets rare R2L and U2R attacks in the NSL-KDD dataset.
- Optuna uses learning rate 0.00042, batch size 256, and Focal Loss.
- Focal Loss at gamma 1.5 outperformed SMOTE, which hurt precision.
- Test accuracy 98.73%; R2L F1 84.63% and U2R F1 69.66%.
- SHAP highlights HTTP service and login state amid U2R feature overlap.
From the original article
1 min read at arxiv.orgIntrusion Detection Systems (IDS) struggle with imbalanced datasets like NSL-KDD, especially in detecting rare R2L and U2R attacks. This work describes a systematically optimized and explainable framework using a CNN-Transformer architecture to improve performance on highly imbalanced data. We decided to use XGBoost for feature selection and Focal Loss as the main mechanism for minority class learning.
By Kartick Sutradhar · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.