Tier-Adaptive CVAEs with Bagging Ensembles for Imbalanced Network Intrusion Detection

With rapid technological advancements, networks have become a critical infrastructure; however, they face growing cybersecurity threats, making network intrusion detection systems (NIDS) indispensable. A persistent challenge is class imbalance, which severely hinders the detection of rare attack types. We propose a framework that integrates Conditional Variational Autoencoders (CVAE) with deep ensembles under a generalized (𝑛 + 1)-tier stratification, comprising one ample tier 𝐴 and 𝑛 rarity tiers 𝑅 1 ,…, 𝑅 𝑛 determined by class-wise imbalance/sparsity thresholds. The method supports arbitrary 𝑛 selected tiers according to dataset imbalance diagnostics. We train tier-specific CVAEs only for the rarity tiers while keeping 𝐴 unchanged, and then perform classification with a bagging-based deep neural network (DNN) ensemble. We evaluate the proposed method on the UNSW-NB15 and CICIDS-2017 datasets under both binary and multi-class settings, reporting comprehensive metrics, i.e., accuracy, precision, recall, F1 score, ROC-AUC, and false alarm rate (FAR). Experimental results show consistent gains-notably improved minority-class detection and overall robustness-that outperform recent methods across several key indicators, demonstrating strong practical potential.