The increasing connectivity of systems and the rapid growth of the Internet have intensified cybersecurity threats. It has been demonstrated that conventional signature-based intrusion detection methods are deficient, especially against Zero-Day attacks. An alternative approach involves the deployment of Intrusion Detection Systems (IDS) that are based on deep learning algorithms. However, these systems face a significant challenge in detecting minority classes of attacks, such as Remote-to-Local (R2L) and User-to-Root (U2R) attacks, which, although rare, are of critical importance. Misclassifying these attacks is costly. Therefore, the reduction of false negatives is achieved by coupling feature selection techniques (Chi square, correlation, information Gain, Extreme Gradient Boosting (XGBoost), Autoencoder), oversampling methods (Synthetic Minority Oversampling Technique (SMOTE), Adaptive Synthetic Sampling (ADASYN)) and deep learning models (Deep Neural Network (DNN), Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM) and hybrid model CNN LSTM). The present study uses the NSL-KDD dataset, with a particular focus on the minority classes R2L, which represents 2.61% of the dataset, and U2R, representing 0.08% of the dataset. The findings indicate that data balancing is paramount. ADASYN facilitates 100% U2R detection, while SMOTE enhances R2L accuracy to above 95%. The application of correlation and autoencoder feature selection techniques proved to be the most effective. The effectiveness of CNN models in addressing U2R classification tasks has been extensively demonstrated, while the use of DNN or CNN-LSTM models has been shown to yield optimal results for R2L tasks. DNN remains the most stable model overall. For the two minority classes, the most effective pipelines are Correlation + SMOTE + DNN, achieving 93.84 % recall for U2R and 99.88 % for R2L, and Autoencoder + SMOTE + CNN-LSTM, achieving 89.66 % recall for R2L and 99.68 % for U2R.
LABHALLA et al. (2026) studied this question.