Multiclass Flow-Based Network Anomaly Detection under Severe Class Imbalance: A Comparative Study and Inference Prototype

Flow-based machine-learning detectors can analyse encrypted or payload-inaccessible traffic, but their aggregate scores can conceal severe failures on rare attacks. This study compares seven supervised classifiers on CSE-CIC-IDS2018 using a seven-class label space: Benign, Bot, Brute Force, distributed denial of service (DDoS), denial of service (DoS), Infiltration, and Web Attack. The evaluation combined numeric cleaning, a stratified 70/15/15 split, low-variance feature selection, and Borderline-SMOTE for selected training classes. Gaussian naive Bayes, logistic regression, random forest, XGBoost, LightGBM, CatBoost, and a multilayer perceptron were evaluated on 2,434,942 held-out flows. Random forest produced the highest macro F1-score (0.7841), followed by LightGBM (0.7683), while their weighted F1-scores were 0.9815 and 0.9825, respectively. The gap between macro and weighted measures exposes weak recognition of minority classes: even the best overall model achieved F1-scores of only 0.2106 for Infiltration and 0.4659 for Web Attack. A complementary prototype captures rotating packet traces, extracts bidirectional flow features with CICFlowMeter, aligns them with the training schema, and reports predicted labels and confidence values. Under this fixed protocol, tree ensembles were strongest among the tested configurations, but the results do not establish general superiority or deployment readiness. The prototype remains a proof-of-concept inference pipeline.