Proto-CBANet: A Statistical Metric Learning Framework for Imbalanced Intrusion Detection

Abstract

: The detection of minority network attacks, such as User-to-Root (U2R), remains a challenge due to class imbalance. Traditional deep learning classifiers favor the majority class and exhibit large variations depending upon random initializations. We propose Proto-CBANet (Prototypical Class-Balanced Attention Network), which combines a 1D-CNN with an Average-Pooling Squeeze-and-Excitation block for feature recalibration, enabling distance-based reasoning in a latent metric space. To ensure statistical reliability, we evaluate our model across 60 random seeds. On NSL-KDD, Proto-CBANet achieves an average U2R recall of 61.07% ± 7.18%. To mitigate the trade-off between precision and recall for rare attacks, we further develop an advanced variant, HPN-GLF (Hyperspherical Prototypical Network with Global-Local Fusion). HPN-GLF integrates global learnable prototypes with hypersphere alignment, global-local semantic fusion, and dual-objective metric optimization. This advanced model reduces parameter count and FLOPs by 95% while significantly improving U2R precision from 12.95% to 59.76% and achieving the highest Macro F1 among compared methods. On NF-UNSW-NB15-v2, HPN-GLF attains a Macro F1 of 59.39% and high Shellcode recall (97.09%), indicating its promise for resource-constrained, imbalanced network security environments.