Evaluation of AutoML Frameworks for IDS under Imbalanced Data Conditions of the NSL-KDD Dataset

Technical Summary: Evaluation of AutoML Frameworks for IDS under Imbalanced Data Conditions of NSL-KDD Dataset

Problem Statement
Network Intrusion Detection Systems (NIDS) increasingly rely on machine learning (ML) to identify malicious activities. However, a critical challenge persists: the severe class imbalance inherent in real-world network traffic datasets, such as NSL-KDD. In these datasets, minority attack categories (specifically Remote-to-Local [R2L] and User-to-Root [U2R]) are significantly underrepresented compared to majority classes (Normal and Denial of Service). This imbalance biases standard learning processes toward majority classes, resulting in poor detection performance for rare attacks. While Automated Machine Learning (AutoML) frameworks offer to streamline the ML pipeline through automated preprocessing, algorithm selection, and hyperparameter optimization, their effectiveness in handling severe multiclass imbalance within the NIDS domain remains underexplored. Previous studies often simplify this problem by converting it to binary classification or removing minority classes, thereby failing to provide a realistic evaluation of imbalance-sensitive learning behaviors.

Methodology
This work conducts a comparative analysis of nine open-source AutoML frameworks applied to the NSL-KDD dataset under a unified, reproducible experimental protocol. The study preserves the original five-class distribution (Normal, DoS, Probe, R2L, U2R) to maintain the severity of the imbalance, rather than simplifying the task.

The evaluated frameworks include:

• AutoGluon, PyCaret, TPOT, H2O AutoML, Auto-Sklearn, FLAML, LazyPredict, Auto-PyTorch, and AutoKeras.

The experimental design focuses on the internal architectures of these frameworks, specifically analyzing:

1. Pipeline Construction: How each framework handles data loading, splitting, and iterative evaluation.
2. Optimization Strategies: The use of genetic programming (TPOT), Bayesian optimization (Auto-Sklearn, Auto-PyTorch, AutoKeras), cost-frugal optimization (FLAML), and neural architecture search (AutoKeras, Auto-PyTorch).
3. Imbalance Handling Mechanisms: The presence and activation of native resampling (e.g., SMOTE), class weighting, and ensemble strategies.

The study utilizes the KDDTest+ subset for evaluation. Performance is measured using macro-F1 score, weighted-F1, accuracy, precision, and recall. Crucially, the macro-F1 metric is prioritized to ensure that minority class discrimination is not masked by high overall accuracy. The results are benchmarked against related works that employ handcrafted, manually optimized pipelines.

Key Results
The evaluation reveals significant performance disparities among the frameworks, directly correlated with their ability to handle class imbalance:

• Top Performers: PyCaret achieved the best overall performance with a macro-F1 score of 66%, followed by AutoGluon with 55%. PyCaret's success is attributed to its modular design utilizing stacking, ensembles, and refined hyperparameter optimization (via Optuna). AutoGluon's performance stems from its weighted ensemble strategy, which hierarchically combines models (NeuralNetFastAI, Extra Trees, and LGBM) to mitigate majority-class dominance.
• Underperformers: Frameworks lacking native balancing support or those prioritizing computational efficiency over complex search spaces showed significant degradation. TPOT and FLAML achieved macro-F1 scores of 49% and 48%, respectively. LazyPredict, which offers no hyperparameter optimization or balancing support, also performed poorly.
• Comparison with Handcrafted Models: The study notes that handcrafted architectures (e.g., specialized Random Forest, Gradient Boosting, and Voting Ensembles from prior literature) generally outperformed the default-configured AutoML frameworks, achieving macro-F1 scores between 68.99% and 71.10%. This suggests that while AutoML provides robust baselines, it currently lacks the dataset-specific adaptation (feature selection, adaptive weighting, undersampling) found in manually tuned solutions.
• Metric Sensitivity: The results demonstrate that accuracy-oriented optimization is insufficient for imbalanced IDS scenarios. Frameworks optimizing for accuracy often coexist with poor generalization on rare attack categories.

Contributions and Significance
The paper establishes a standardized benchmark for evaluating AutoML-based intrusion detection under severe multiclass imbalance. Its primary contributions include:

1. Realistic Evaluation: By preserving the original five-class distribution of NSL-KDD, the work avoids the pitfalls of binary simplification, offering a more rigorous test of imbalance-aware learning.
2. Architectural Analysis: The study identifies that frameworks incorporating ensemble learning and imbalance-aware optimization (such as explicit resampling or metric weighting) significantly outperform those that do not.
3. Identification of Limitations: The work highlights that current AutoML pipelines often rely on generalized search spaces without dataset-specific adaptation, limiting their effectiveness in detecting rare attacks like R2L and U2R compared to handcrafted solutions.
4. Reproducibility: The authors provide a publicly available source code repository to ensure the reproducibility of the experimental protocol.

Conclusion
The paper concludes that while AutoML frameworks like PyCaret and AutoGluon can provide competitive baselines for NIDS, they currently face limitations in handling extreme class imbalance without manual intervention or specific configuration. The authors argue for the future integration of native balancing strategies—such as automated oversampling, class weighting, and stratified validation—directly into AutoML search and optimization procedures to improve adaptability and robustness in cybersecurity applications.