Addressing Class Imbalance in Deep Learning-Based Network Intrusion Detection: A Comparative Study on UNSW-NB15

Network Intrusion Detection Systems (IDS) are a core cybersecurity defense mechanism, but traditionalsignature-based systems fail to generalize to novel attacks. Deep learning-based IDS can learn patternsdirectly from traffic data, but intrusion datasets exhibit severe class imbalance: common attack typesdominate the data while rare-but-dangerous categories such as Worms, Shellcode, and Backdoor areunderrepresented, which allows models to appear accurate overall while quietly failing on the detectionsthat matter most. We train a feedforward neural network on the UNSW-NB15 dataset to classify networktraffic into Normal plus nine modern attack categories, and evaluate performance with per-class precision,recall, and F1-score rather than relying on overall accuracy alone. We then compare three targeted classimbalance correction techniques — class-weighted cross-entropy loss, focal loss, and SMOTEoversampling — against an unweighted baseline trained on the raw, imbalanced distribution. The baselinereaches 75.13% overall accuracy but a Macro-F1 of only 0.393, with zero F1-score on Analysis, Backdoor,and Worms. SMOTE yields the best balance among the single-technique corrections, recovering non-trivialdetection of Worms (F1 improving from 0.000 to 0.139) while retaining 73.43% accuracy and the highestsingle-model Macro-F1 (0.398). A soft-voting ensemble of the baseline and the SMOTE-corrected modelfurther improves Macro-F1 to 0.416. A Random Forest surrogate model is used to interpret which trafficfeatures drive detection for the rare attack categories. Our results confirm that no single correctiontechnique fully resolves the class-imbalance problem in network intrusion detection, but combining awell-calibrated majority-class model with a rare-class-focused model through ensembling offers the bestoverall trade-off among the approaches we tested.