系统优化的CNN-Transformer与焦点损失用于NSL-KDD上不平衡入侵检测

中文摘要 AI 辅助

入侵检测系统（IDS）在处理如NSL-KDD等不平衡数据集时面临挑战，尤其是在检测罕见的R2L和U2R攻击方面。本文描述了一个系统优化且可解释的框架，采用CNN-Transformer架构以提高在高度不平衡数据上的性能。我们决定使用XGBoost进行特征选择，并采用焦点损失（Focal Loss）作为少数类学习的主要机制。我们使用Optuna进行端到端超参数优化（学习率=0.00042，批量大小=256，焦点损失γ），并通过周到的数据分割过程防止数据泄漏。关键的是，我们的消融研究表明，虽然焦点损失（最优γ=1.5）显著提升了少数类召回率，但添加如SMOTE等过采样方法会因过度校正而导致精确率下降。我们的最终模型仅使用调优后的焦点损失，在NSL-KDD测试数据上达到了98.73%的整体准确率，并在R2L和U2R上分别取得了84.63%和69.66%的显著平衡F1分数，优于基线方法。此外，我们进行了SHAP分析以理解模型预测，识别显著特征（如服务http、已登录），并解释了因特征重叠而持续存在的U2R精确率挑战。本研究为不平衡IDS提供了一个全面的流程，提供了方法论见解，并证明了调优的焦点损失可以作为一种充分且有效的类别平衡策略。

英文摘要

Intrusion Detection Systems (IDS) struggle with imbalanced datasets like NSL-KDD, especially in detecting rare R2L and U2R attacks. This work describes a systematically optimized and explainable framework using a CNN-Transformer architecture to improve performance on highly imbalanced data. We decided to use XGBoost for feature selection and Focal Loss as the main mechanism for minority class learning. We used Optuna for end-to-end hyrate=0.00042, batch size=256, and Focal Loss γ), using a thoughtful data splitting process to prevent data leakage. Critically, our ablation studies pointed out that while Focal Loss (optimally at γ = 1.5) substantially enhanced minority recall, adding oversampling methods like SMOTE caused precision degradation via over-correction. Our final model, using only tuned Focal Loss, achieved 98.73% overall accuracy on the NSL-KDD test data, with significantly balanced F1-scores of 84.63% (R2L) and 69.66% (U2R) over baseline approaches. Additionally, we performed SHAP analysis to understand model predictions, understand salient features (e.g., service http, logged in), and explain the persistent U2R precision challenge due to feature overlap. This study presents a comprehensive pipeline for imbalanced IDS, providing methodological insights, and demonstrates that tuned Focal Loss can be a sufficient and effective strategy for class balancing.

发表机构

• Gandhi Institute of Technology and Management（甘地技术与管理学院）
• Indian Institute of Information Technology Sri City（斯里城市印度信息科技大学）

机构由 AI 辅助整理，请以论文原文为准。