Bal‐ <scp>IDS</scp> : A Robust Network Intrusion Detection System for Enhancing Low‐Frequency Attack Detection in <scp>IoT</scp> Networks

ABSTRACT Network Intrusion Detection Systems (NIDS) are crucial in safeguarding IoT security. However, due to complex traffic patterns and severe class imbalance, existing intrusion detection methods struggle to detect low‐frequency attacks, which are rare and sophisticated. This paper proposes Bal‐IDS, a novel NIDS designed to enhance low‐frequency attack detection in IoT networks. Bal‐IDS employs a parallel architecture that combines an improved one‐dimensional Convolutional Neural Network (1DCNN) for spatial feature extraction with Bidirectional Gated Recurrent Units (BiGRU) for temporal feature extraction. These features are dynamically fused using a self‐attention mechanism to strengthen representation. A two‐stage class balancing method, Sampling‐based Equalization Loss (SEL), is designed to address class imbalance. This approach incorporates an adaptive oversampling strategy to mitigate local sample imbalance and utilizes Equalization Loss v2 (EQLv2) to address global gradient imbalance, significantly improving the detection rate for low‐frequency attacks while maintaining low computational costs. The effectiveness of Bal‐IDS is validated on the NSL‐KDD and BoT‐IoT datasets, achieving multi‐class classification accuracies of 99.88% and 99.96%, respectively, with false alarm rates of 0.08% and 0.03%, surpassing state‐of‐the‐art methods.