HyRes-Boost: Hybrid Resampling for Sensitivity–False-Alarm Trade-offs in Network Intrusion Detection

Achmad  Affandi; Eko Setijadi; Endroyono Endroyono; Sri Rahayu; Prasetiyono Hari Mukti; Suwadi Suwadi; Fransiska Sisilia Mukti

doi:10.29207/resti.v10i5.7579

Authors

Achmad Affandi Institut Teknologi Sepuluh Nopember Surabaya
Eko Setijadi Institut Teknologi Sepuluh Nopember Surabaya
Endroyono Endroyono Institut Teknologi Sepuluh Nopember Surabaya
Sri Rahayu Institut Teknologi Sepuluh Nopember Surabaya
Prasetiyono Hari Mukti Institut Teknologi Sepuluh Nopember Surabaya
Suwadi Suwadi Institut Teknologi Sepuluh Nopember Surabaya
Fransiska Sisilia Mukti Institut Teknologi dan Bisnis Asia Malang

DOI:

https://doi.org/10.29207/resti.v10i5.7579

Keywords:

cost-sensitive evaluation, false alarm rate, hybrid resampling, imbalanced learning, intrusion detection system, XGBoost

Abstract

Class imbalance in network intrusion detection systems (NIDS) creates a trade-off between intrusion sensitivity and false-alarm control. While hybrid resampling methods often improve minority class representation, their effectiveness varies depending on imbalance severity and operational needs. This study presents HyRes-Boost, a Generate-then-Clean hybrid resampling framework that integrates Adaptive Synthetic Sampling (ADASYN), Edited Nearest Neighbours (ENN), and XGBoost to examine how post-generation editing affects the sensitivity and false-alarm balance. HyRes-Boost is evaluated on UNSW-NB15, CICIDS2018, and CICIoT2023 using a leakage-safe protocol with predictive metrics, operational indicators, asymmetric error costs, and fold-level statistical analysis. Results indicate that HyRes-Boost produces context-dependent changes in operating points rather than universal improvements. In the attack-minority UNSW-NB15 scenario, HyRes-Boost achieves a recall of 99.74%, increasing intrusion sensitivity but also raising the false-alarm rate. In CICIoT2023, where benign traffic is the minority class, HyRes-Boost lowers the false alarm rate to 2.23% from 13.72% in the unbalanced baseline, though attack recall drops to 98.75%. For the highly separable CICIDS2018 dataset, additional resampling yields minimal improvement, with the F1-score remaining near 99.90%. These results suggest that hybrid resampling should not be evaluated solely by aggregate accuracy or ranking. The suitability of HyRes-Boost depends on class prevalence, boundary ambiguity, and the relative costs of false positives and false negatives.

Downloads

Download data is not yet available.

References

[1] S. Tariq, M. Baruwal Chhetri, S. Nepal, and C. Paris, “Alert Fatigue in Security Operations Centres: Research Challenges and Opportunities,” ACM Comput. Surv., vol. 57, no. 9, pp. 1–38, Sep. 2025, doi: https://doi.org/10.1145/3723158 .

[2] F. Sisilia Mukti, E. Setijadi, A. Affandi, A. Basuki, and M. Ali Akbar, “In-Depth Network Traffic Analysis using Machine Learning Perspective: Characterization and Classification,” in 2023 6th International Seminar on Research of Information Technology and Intelligent Systems (ISRITI), IEEE, Dec. 2023, pp. 415–421. doi: https://doi.org/10.1109/ISRITI60336.2023.10467384 .

[3] F. S. Mukti, A. Basuki, B. A. Pratomo, A. Affandi, H. Studiawan, and E. Setijadi, “SPARCOF: A Two-stage Decision-Support Framework for Efficient Feature Sets in Network Intrusion Detection Datasets,” Int. J. Intell. Eng. Syst., vol. 19, no. 10, 2026, doi: https://doi.org/10.22266/ijies2026.1031.17 .

[4] N. Gupta, V. Jindal, and P. Bedi, “CSE-IDS: Using cost-sensitive deep learning and ensemble algorithms to handle class imbalance in network-based intrusion detection systems,” Comput. Secur., vol. 112, p. 102499, Jan. 2022, doi: https://doi.org/10.1016/j.cose.2021.102499 .

[5] S. Gopikrishnan, P. Jonnalagadda, M. Driss, and W. Boulila, “EFS-IDS: An Enhanced Feature-Selective Intrusion Detection System for Imbalanced IoT Traffic Data,” IEEE Open J. Commun. Soc., vol. 6, pp. 9673–9695, 2025, doi: https://doi.org/10.1109/OJCOMS.2025.3630471 .

[6] A. Abdelkhalek and M. Mashaly, “Addressing the class imbalance problem in network intrusion detection systems using data resampling and deep learning,” J. Supercomput., vol. 79, no. 10, pp. 10611–10644, Jul. 2023, doi: https://doi.org/10.1007/s11227-023-05073-x .

[7] S. Bagui, D. Mink, S. Bagui, S. Subramaniam, and D. Wallace, “Resampling Imbalanced Network Intrusion Datasets to Identify Rare Attacks,” Futur. Internet, vol. 15, no. 4, p. 130, Mar. 2023, doi: https://doi.org/10.3390/fi15040130 .

[8] T.-T.-H. Le, Y. Shin, M. Kim, and H. Kim, “Towards unbalanced multiclass intrusion detection with hybrid sampling methods and ensemble classification,” Appl. Soft Comput., vol. 157, p. 111517, May 2024, doi: https://doi.org/10.1016/j.asoc.2024.111517 .

[9] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, “SMOTE: Synthetic Minority Over-sampling Technique,” J. Artif. Intell. Res., vol. 16, pp. 321–357, Jun. 2002, doi: https://doi.org/10.1613/jair.953 .

[10] M. Zakariah, S. A. AlQahtani, and M. S. Al-Rakhami, “Machine Learning-Based Adaptive Synthetic Sampling Technique for Intrusion Detection,” Appl. Sci., vol. 13, no. 11, p. 6504, May 2023, doi: https://doi.org/10.3390/app13116504 .

[11] J. Liu, Y. Gao, and F. Hu, “A fast network intrusion detection system using adaptive synthetic oversampling and LightGBM,” Comput. Secur., vol. 106, p. 102289, Jul. 2021, doi: https://doi.org/10.1016/j.cose.2021.102289 .

[12] F. Omer Albasheer, R. Ramesh Haibatti, M. Agarwal, and S. Yeob Nam, “A Novel IDS Based on Jaya Optimizer and Smote-ENN for Cyberattacks Detection,” IEEE Access, vol. 12, pp. 101506–101527, 2024, doi: https://doi.org/10.1109/ACCESS.2024.3431534 .

[13] T. Sameer, J. Rashmi, B. Khushi, M. Khushi, R. Rahul, and J. Prachi, “Enhanced intrusion detection framework: Integrating SMOTE-ENN with random forest and XGBoost,” i-manager’s J. Inf. Technol., vol. 13, no. 3, p. 19, 2024, doi: https://doi.org/10.26634/jit.13.3.21454 .

[14] L. Xue and T. Zhu, “Hybrid resampling and weighted majority voting for multi-class anomaly detection on imbalanced malware and network traffic data,” Eng. Appl. Artif. Intell., vol. 128, p. 107568, Feb. 2024, doi: https://doi.org/10.1016/j.engappai.2023.107568 .

[15] M. A. Umar, Z. Chen, K. Shuaib, and Y. Liu, “Effects of feature selection and normalization on network intrusion detection,” Data Sci. Manag., vol. 8, no. 1, pp. 23–39, Mar. 2025, doi: https://doi.org/10.1016/j.dsm.2024.08.001 .

[16] A. Salehpour, M. Norouzi, M. A. Balafar, and K. SamadZamini, “A cloud‐based hybrid intrusion detection framework using XGBoost and ADASYN‐Augmented random forest for IoMT,” IET Commun., vol. 18, no. 19, pp. 1371–1390, Dec. 2024, doi: https://doi.org/10.1049/cmu2.12833 .

[17] V. Shanmugam, R. Razavi-Far, and E. Hallaji, “Addressing Class Imbalance in Intrusion Detection: A Comprehensive Evaluation of Machine Learning Approaches,” Electronics, vol. 14, no. 1, p. 69, Dec. 2024, doi: https://doi.org/10.3390/electronics14010069 .

[18] D. Kasina, V. S. Reddy, S. Rajamanickam, J. Jose, and B. Palani, “A novel intrusion detection system for class imbalance datasets using hybrid sampling with deep learning techniques,” Inf. Sci. (Ny)., vol. 741, p. 123208, Jun. 2026, doi: https://doi.org/10.1016/j.ins.2026.123208 .

[19] N. Moustafa and J. Slay, “UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in 2015 Military Communications and Information Systems Conference (MilCIS), IEEE, Nov. 2015, pp. 1–6. doi: https://doi.org/10.1109/MilCIS.2015.7348942 .

[20] I. Sharafaldin, A. Habibi Lashkari, and A. A. Ghorbani, “Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization,” in Proceedings of the 4th International Conference on Information Systems Security and Privacy, SCITEPRESS - Science and Technology Publications, 2018, pp. 108–116. doi: https://www.scitepress.org/Link.aspx?doi=10.5220/0006639801080116 .

[21] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, “CICIoT2023: A Real-Time Dataset and Benchmark for Large-Scale Attacks in IoT Environment,” Sensors, vol. 23, no. 13, p. 5941, Jun. 2023, doi: https://doi.org/10.3390/s23135941 .

[22] S. T. Hamidou and A. Mehdi, “Enhancing IDS performance through a comparative analysis of Random Forest, XGBoost, and Deep Neural Networks,” Mach. Learn. with Appl., vol. 22, p. 100738, Dec. 2025, doi: https://doi.org/10.1016/j.mlwa.2025.100738 .

[23] D. Chicco, N. Tötsch, and G. Jurman, “The Matthews correlation coefficient (MCC) is more reliable than balanced accuracy, bookmaker informedness, and markedness in two-class confusion matrix evaluation,” BioData Min., vol. 14, no. 1, p. 13, Feb. 2021, doi: https://doi.org/10.1186/s13040-021-00244-z .

[24] T. Saito and M. Rehmsmeier, “The Precision-Recall Plot Is More Informative than the ROC Plot When Evaluating Binary Classifiers on Imbalanced Datasets,” PLoS One, vol. 10, no. 3, p. e0118432, Mar. 2015, doi: https://doi.org/10.1371/journal.pone.0118432 .

[25] O. Rainio, J. Teuho, and R. Klén, “Evaluation metrics and statistical tests for machine learning,” Sci. Rep., vol. 14, no. 1, p. 6086, Mar. 2024, doi: https://doi.org/10.1038/s41598-024-56706-x .

[26] C. Padró-Ferragut, F. Martínez-Plumed, and M. J. Ramírez-Quintana, “Robustness under noise: assessing the impact of perturbed key attributes on machine learning models,” Int. J. Data Sci. Anal., vol. 22, no. 1, p. 71, Dec. 2026, doi: https://doi.org/10.1007/s41060-025-01006-4 .