<![CDATA[Class imbalance is a major challenge in multi-class network intrusion detection, particularly when extremely underrepresented attack categories provide insufficient samples for effective model learning. Such imbalance can cause machine learning models to favor majority classes, resulting in high overall accuracy but poor detection of minority attacks. This study proposes a data-level imbalance handling strategy that restructures the representation of extremely sparse attack classes before applying the Synthetic Minority Over-sampling Technique (SMOTE). Four experimental conditions were evaluated on the UNSW-NB15 dataset using Decision Tree, Random Forest, and XGBoost classifiers to examine the effects of class representation restructuring and SMOTE separately. The evaluation employed accuracy, macro-precision, macro-recall, and macro-F1-score, complemented by class-wise analysis. The results show that, for XGBoost, class representation restructuring without SMOTE increases macro-recall from 54.44% to 68.56% and macro-F1-score from 57.44% to 68.24%, while accuracy remains nearly unchanged. When SMOTE is subsequently applied to the restructured representation, macro-recall further increases to 78.60% and macro-F1-score to 69.05%. Compared with the original non-SMOTE condition, the combined strategy improves macro-recall by 24.16% and macro-F1-score by 11.61%, while accuracy decreases by only 0.73 %, from 98.30% to 97.57%. Class-wise analysis further indicates substantial recall improvements for several underrepresented attack categories, although precision trade-offs remain for some classes. These findings show that restructuring extreme minority-class representations before oversampling can improve minority-oriented detection performance under severe class imbalance.]]>
