CS-Forest: A Cost-Sensitive Explainable Ensemble Framework for Minority Attack Detection in Intrusion Detection Systems

With the proliferation of internet-connected infrastructures and the complexity of cyberattacks, cybersecurity and intelligent intrusion detection systems have become more and more critical. Intrusion detection datasets, however, are now highly imbalanced, and conventional machine learning models have become biased towards the majority of benign traffic, misclassifying minority attack classes. This paper introduces a Cost-Sensitive Forest (CS-Forest) approach to enhance the detection of minority attacks in the CSE-CIC-IDS2018 dataset. The proposed framework combines cost-sensitive learning, ensemble-based Random Forest classification, feature selection, and SHAP explainability analysis to boost the performance of intrusion detection and interpretability. Various machine learning algorithms such as Decision Tree, Random Forest, AdaBoost, and XGBoost were tested and compared based on accuracy, precision, recall, F1-score, ROC-AUC, false positive rate, and false negative rate. Experimental results proved that the proposed CS-Forest has excellent performance, with 99.81% accuracy, 99.55% recall, 99.61% F1-score, and 0.998 ROC-AUC, significantly enhancing the performance of minority attack detection and reduced false negatives. The framework learned meaningful and interpretable network traffic behaviors, which was also confirmed using SHAP analysis. The research suggests that future IDS systems should incorporate cost-sensitive learning and explainable AI techniques to ensure improved reliability, transparency, and deployment in the cybersecurity landscape.