Optimizing Intrusion Detection: Hybrid Deep Learning Techniques for Class Imbalance Correction

Advanced Network Intrusion Detection Systems (NIDS) are needed because cybersecurity threats evolve. Managing dataset class imbalance and rapidly recognizing and categorizing network and host-level threats are priority issues. To solve this, we used Convolutional Neural Networks (CNNs), Gated Recurrent Units (GRUs), class balance, and Principal Component Analysis (PCA) in a hybrid deep learning strategy. Using the CIC-IDS2018 dataset, we trained our models and evaluated their performance based on precision, recall, False Positive Rate (FPR), True Positive Rate (TPR), and other metrics. We tested the CNN-GRU model in three data processing scenarios: without balancing, with undersampling, and with PCA. The balanced models, particularly with PCA, improved computing efficiency, although the unbalanced model achieved the highest accuracy. Specifically, combining CNN and GRU without balancing (Method 1) resulted in an accuracy of 99.99%, making it the most computationally intensive. This approach was the most computationally intensive. Method 2, which combined CNN and GRU with undersampling, achieved a slightly lower accuracy of $\mathbf{9 9. 9 8 \%}$ but significantly reduced training time. Though slightly less accurate at $\mathbf{9 9. 9 8 \%}$, it considerably reduces training time. The most computationally efficient method was Method 3, which incorporated CNN-GRU with PCA and undersampling, resulting in an accuracy of $\mathbf{9 8. 8 8 \%}$. In McNemar’s tests, Methods 1 and 2 performed similarly, whereas Methods 1 and 3 did not. The study found that application requirements affect model choice, including accuracy-efficiency trade-offs. By balancing precision and processing resources, hybrid deep learning may improve NIDS.