A Unified ML Pipeline for Multiclass Intrusion Detection Across Enterprise Network and UAV Traffic

Intrusion detection systems for Internet of Drones (IoD) networks face persistent challenges, including severe class imbalance, redundant features, data leakage, and traffic patterns that differ fundamentally from enterprise networks. Most existing pipelines are tuned to a single dataset and fail to generalize across domains. We propose a dataset-unified pipeline, configured identically across settings with feature selection and automated hyperparameter search, requiring no dataset-specific tuning. Validation was conducted on two contrasting benchmarks: the large-scale, imbalanced CSE-CIC-IDS2018 dataset (~6.3M records, 15 classes) and the near-balanced UAVIDS-2025 UAV/MANET dataset (122,171 records, 5 classes). The pipeline integrates three-stage leakage screening, multivariate k-NN-anchored Gaussian jittering with Tomek-link cleaning, permutation-importance feature selection, and an Optuna-tuned XGBoost classifier. On CSE-CIC-IDS2018, it achieved an overall accuracy of 78.8%, a macro-F1 score of 72.7%, and a weighted F1 score of 86.2%. On UAVIDS-2025, accuracy reached 95.58% with a 95.82% macro-F1 score. Notably, this performance gap co-occurred with fundamental domain and architectural differences between the two benchmarks. Multi-seed and split-validation experiments confirmed the pipeline’s stability. Performance ceilings appear to be governed by sample scarcity and feature separability, underscoring the importance of per-class precision–recall analysis for minority-class reliability in operational IoD intrusion detection.