Balanced-IDS: A Deep Hybrid Model to Overcome Class Imbalance in Network Intrusion Detection

The rapid growth of digital communication systems has increased exposure to sophisticated cyberattacks, creating a strong need for intrusion detection methods that can adapt and respond intelligently. Traditional Intrusion Detection Systems (IDS) struggle with identifying uncommon or newly emerging threats because real-world network data typically contains far more normal traffic than malicious activity. This imbalance causes models to learn unevenly, often leading to biased predictions and higher false-negative rates.To address these shortcomings, this work introduces Balanced-IDS, a hybrid deep-learning model that combines Convolutional Neural Networks (CNNs) with Long Short-Term Memory (LSTM) networks, supported by both data-level and model-level balancing strategies. The CNN layers extract spatial features from network traffic, while the LSTM component captures their sequential patterns. To ensure fair learning across classes, the framework incorporates the Synthetic Minority Oversampling Technique (SMOTE) along with cost-sensitive training, enabling the model to give appropriate attention to underrepresented attack types during optimization. Comprehensive experiments performed on benchmark datasets—including NSL-KDD, CICIDS2017, and UNSW-NB15—show that Balanced-IDS delivers significant upgrades in accuracy, recall, and F1-score compared with existing IDS approaches. The results confirm that the proposed system reduces false negatives and strengthens detection performance across a wide range of attack scenarios, making it a reliable and scalable choice for large-scale cybersecurity environments.