Investigating Contrastive Learning for Conditional Variational Autoencoders in Network Intrusion Detection

Abstract

Class imbalance, where majority-class samples vastly outnumber minority-class samples, remains a persistent challenge in network intrusion detection systems (NIDS), often causing classifiers to overlook rare but critical attack types while yielding misleadingly optimistic performance metrics. Synthetic data generation is a common mitigation strategy. However, existing methods often fail to capture the non-linear network traffic and neglect inter-class relationships with the majority class, resulting in inconsistent performance gains. This study investigates three contrastive learning loss functions, Contrastive Loss, Soft Nearest Neighbor Loss, and Supervised Contrastive Loss, integrated into a Conditional Variational Autoencoder (CVAE) regularised via the standard Kullback-Leibler divergence objective. Experiments were conducted on four widely used NIDS benchmark datasets (NSL-KDD, UNSW-NB15, CIC-IDS2017, and CSE-CIC-IDS2018), with synthetic data evaluated using four machine learning classifiers against the original imbalanced data, a non-contrastive CVAE, and conventional oversampling approaches. The results show that the effectiveness of integrating contrastive learning into the CVAE framework is dependent on the specific dataset, minority class, contrastive loss function, and distance metric, with the proposed approach outperforming traditional oversampling techniques in several settings without degrading majority-class performance or overall accuracy. These findings provide practical guidance for selecting contrastive learning objectives in class-imbalanced NIDS scenarios.