Density-Aware Cost-Sensitive Learning for Enhanced Detection of Imbalanced Web-Based Intrusions

Abstract

In contemporary network environments, intrusion detection faces significant challenges due to highly skewed traffic distributions, where benign instances predominate while certain attack types occur infrequently. This imbalance often leads to biased learning, resulting in poor detection performance for rare but crucial attack types. To address this challenge, this paper presents a density-aware cost-sensitive learning framework for web-based intrusion detection. Initially, logarithmic class weights are employed to mitigate majority class dominance. Subsequently, a k-nearest neighbor (k-NN)-based density estimation is utilized to capture data sparsity enabling density-based adaptive sample weighting that emphasizes both minority and hard-to-learn instances. Furthermore, a hard sample amplification mechanism is introduced to amplify misclassified samples to enhance the model’s ability to learn complex patterns. Experimental results demonstrate that the proposed approach significantly improves minority class detection, achieving a G-Mean of 91.95% with Histogram Gradient Boosting Model, while maintaining an overall accuracy of 99.81%. Additionally, an average minority gain of 3.8% for HGB and 3.5% for Random Forest highlights its effectiveness in handling severely underrepresented classes.