Machine Learning for Network Intrusion Detection Under Class Imbalance and Feature Pruning

Abstract

Machine learning classifiers trained on labelled network flow records routinely fail to detect privilege-escalation and remote-access intrusions because these attack classes are orders of magnitude rarer than benign traffic. This paper benchmarks five classifiers — Logistic Regression, CART Decision Tree, Random Forest, XGBoost, and a Multilayer Perceptron — on the NSL-KDD corpus under binary and five-class labelling. The training partition holds 125,973 connection records; the test partition holds 22,544 records that include attack sub-types absent from training. Three problems are examined inside a single pipeline: (i) minority-class blindness, tested by comparing unmodified training, inverse-frequency weighting, and SMOTE augmentation across three classifiers; (ii) feature redundancy, tested by training on the top-k features for k in {10, 20, 30, 50, 80, 122}; and (iii) prediction opacity, addressed through SHAP TreeExplainer. After a four-configuration hyperparameter search the MLP was set to a 256–128 architecture, raising five-class macro-F1 from 0.615 to 0.636. XGBoost obtains the highest binary AUC of 0.969 (95 % bootstrap CI [0.967, 0.971]). SMOTE applied to XGBoost lifts U2R F1 from 0.182 to 0.438 but, counterintuitively, degrades MLP macro-F1 from 0.636 to 0.578. Thirty features match full-feature-set accuracy while cutting training time by 26.6 %. SHAP attributes the largest predictive mass to src_bytes (mean |SHAP| = 4.20), consistent with volumetric DoS mechanics.