<![CDATA[Class imbalance in network intrusion detection systems (NIDS) creates a trade-off between intrusion sensitivity and false-alarm control. While hybrid resampling methods often improve minority class representation, their effectiveness varies depending on imbalance severity and operational needs. This study presents HyRes-Boost, a Generate-then-Clean hybrid resampling framework that integrates Adaptive Synthetic Sampling (ADASYN), Edited Nearest Neighbours (ENN), and XGBoost to examine how post-generation editing affects the sensitivity and false-alarm balance. HyRes-Boost is evaluated on UNSW-NB15, CICIDS2018, and CICIoT2023 using a leakage-safe protocol with predictive metrics, operational indicators, asymmetric error costs, and fold-level statistical analysis. Results indicate that HyRes-Boost produces context-dependent changes in operating points rather than universal improvements. In the attack-minority UNSW-NB15 scenario, HyRes-Boost achieves a recall of 99.74%, increasing intrusion sensitivity but also raising the false-alarm rate. In CICIoT2023, where benign traffic is the minority class, HyRes-Boost lowers the false alarm rate to 2.23% from 13.72% in the unbalanced baseline, though attack recall drops to 98.75%. For the highly separable CICIDS2018 dataset, additional resampling yields minimal improvement, with the F1-score remaining near 99.90%. These results suggest that hybrid resampling should not be evaluated solely by aggregate accuracy or ranking. The suitability of HyRes-Boost depends on class prevalence, boundary ambiguity, and the relative costs of false positives and false negatives.]]>
Copyrights © 2026
