Indonesian J our nal of Electrical Engineering and Computer Science V ol. 42, No. 2, May 2026, pp. 498 ∼ 508 ISSN: 2502-4752, DOI: 10.11591/ijeecs.v42.i2.pp498-508 ❒ 498 Mar gin-r ecipr ocal loss: enhancing r ob ust netw ork anomaly detection on imbalanced trafc data Rachid T ahri 1 , Abdellah Ouammou 1 , Abdellatif Lasbahani 2 1 F aculty of Sciences and T echnologies, Hassan First Uni v ersity , Settat, Morocco 2 F aculty of Sciences and T echnologies, Sultan Moulay Slimane Uni v ersity , Beni Mellal, Morocco Article Inf o Article history: Recei v ed Sep 4, 2025 Re vised Feb 24, 2026 Accepted May 26, 2026 K eyw ords: Anomaly detection Class imbalance Intrusion detection systems Mar gin-based learning Mar gin-reciprocal loss NSL-KDD ABSTRA CT Accurate detection of netw ork intrusions remains challenging under se v ere class imbalance, where rare attacks such as remote-to-local (R2L) and user -to-root (U2R) are poorly represented. Although man y learning-based intrusion detec- tion systems achie v e high o v erall accurac y , con v entional loss functions often bias training to w ard majority classes, leading to weak minority-c lass perfor - mance. This paper introduces a smooth mar gin-reciprocal loss (MRL), inspired by distance-weighted discrimination (D WD), which emphasizes samples with small or ne g ati v e mar gins while rapidly attenuating penalties for well-classied instances. Unlik e probability-based focal loss, MRL operates directly on the signed mar gin and enables stable optimization with rst-order methods. Exper - iments conducted on the NSL-KDD benchmark using linear and shallo w mul- tilayer perceptron models sho w that MRL consistently impro v es macro-F1 and per -class precision–recall A UC compared with hinge, logistic, and focal losses, with notable g ains on minority attack classes. This is an open access article under the CC BY -SA license . Corresponding A uthor: T ahri Rachid F aculty of Sciences and T echnologies, Hassan First Uni v ersity B.P .: 577 Route de Casablanca, Settat, Morocco Email: rachid.tahritr@gmail.com 1. INTR ODUCTION Modern communication netw orks are e xposed to a wide spectrum of c yber intrusions, ranging from lar ge-scale denial-of-service (DoS/DDoS ) attacks to subtle and lo w-frequenc y threats such as remote-to-local (R2L) and user -to-root (U2R). Early and reliable detection of such anomalies is essential for maintaining ser - vice a v ailability and protecting critical i nfrastructures [1], [2]. In re sponse to this challenge, intrusion detection systems (IDS) ha v e increasingly adopted machine learning techniques to model normal traf c beha vior and identify de viations [3]-[7]. Be yond reacti v e detection, ef fecti v e anomaly identication also supports proacti v e defense by reducing system f ailures and limiting the impact of emer ging attacks [8],[9]. Despite these adv ances, man y learning-based intrusion detection approaches suf fer from limited ro- b ustness in practice, particularly when confronted with highly imbalanced netw ork traf c d a ta [10]-[12]. In commonly used benchmark datasets, rare b ut critical attacks such as R2L and U2R represent only a small fraction of the samples, causing classiers to bias their decision boundaries to w ard majority classes [13]. As a result, high o v erall accurac y may coe xist with poor minority-class recall, which is unacceptable in security- critical applications. Add r essing class imbalance at the learning le v el therefore remains a central challenge for reliable intrusion detection. Most e xisting imbalance-a w are strate gies focus either on data-le v el resampling or on probabi lity-based J ournal homepage: http://ijeecs.iaescor e .com Evaluation Warning : The document was created with Spire.PDF for Python.
Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 ❒ 499 loss re weighting. While such approaches can impro v e minority-class recall , the y often introduce additional h y- perparameters, alter the natural traf c distrib ution, or primarily adjust prediction condence without e xplicitly controlling the geometry of the decision boundary . In operational IDS en vironments, where traf c distrib utions e v olv e and rare attacks may e xhibit subtle feature patterns, impro v ed geometric separation bet ween classes is particularly important for enhancing detection rob ustness. Mar gin-based learning of fers a principled w ay to control decision boundary beha vior under i mbalance. distance-weighted discrimination (D WD) w as originally proposed to alle viate data piling by penalizing samples located near the classication boundary [14]. Inspired by t his idea, we int roduce a smooth mar gin-reciprocal loss (MRL) tailored to intrusion det ection. The proposed loss assigns lar ger penal ties to small or ne g ati v e mar gins-where minority samples typically lie-while rapidly attenuating penalties for well-classied instances. Unlik e probability-based focal loss, which rescales cross-entrop y using predicted condence scores, MRL operates directly on the signed mar gin and enables ner geometric control of the decision boundary without introducing additional tuning comple xity . From a comput er science and engineering perspecti v e, the contrib ution of this w ork lies in the de sign of a loss function that can be seamlessly inte grated into e xisting linear and neural intrusion detection archi- tectures without modifying model structures or requiring synthetic data generation. By reshaping the mar gin distrib ution during training, the proposed formulation enhances minority-class separability while maintaining optimization stability with standard rst-order methods. This mak es the approach suitable for scalable IDS implementations and compatible with practical deplo yment constraints. The contrib utions of this w ork are threefold. First, we propose a no v el MRL inspired by D WD and pro vide a numerically stable formulation suitable for imbalanced netw ork data. Second, we adopt a rigorous e v aluation protocol based on stratied data splits, leakage-free preprocessing, and imbalance-a w are metrics such as macro-F1 and per -class precision–recall A UC. Third, e xperimental results on the NSL-KDD benchmark demonstrate that MRL impro v es minority-class detection compared to hinge, logistic, and focal losses, while remaining simple to optimize using rst-order methods. 2. RELA TED W ORK Anomaly detection has long been a core problem in netw ork security , aiming to identify traf c pat terns that de viate from normal beha vior , including intrusions, DoS attacks, and subtle performance anomalies [15]. Early approaches were primarily based on statistical and probabilistic models, where anomalies were detected through thresholding or de viations from e xpected distrib utions [16], [17]. While these methods are interpretable and computationally ef cient, their performance de grades signicantly in high-dimensional settings and in en vironments with e v olving traf c characteristics. The adoption of machine learning substantially broadened the range of intrusion detection techniques. Supervised models such as support v ector machines, decision trees, r andom forests, and neural netw orks ha v e sho wn strong performance when suf cient labeled data are a v ailable [18]-[20]. Ho we v er , most benchmark intrusion datasets are highly imbalanced, causing rare b ut critical attack cate gories such as U2R and R2L to be poorly detected [21]. As a result, man y supervised classiers achie v e high o v erall accurac y while e xhibiting lo w recall on minority classes. T o reduce dependence on labeled data, unsupervised approaches-including clustering methods, isola- tion forests, and autoencoders-ha v e been widely e xplored to model normal traf c beha vior and identify de via- tions as anomalies [22], [23]. More recently , graph-based techniques ha v e been proposed to capture structural and relational dependencies in netw ork traf c, impro ving detection in comple x en vironments [24]. Although these methods enhance representation capability , the y often remain sensiti v e to data imbalance and threshold selection. Hybrid strate gies seek to combine the adv antages of multiple paradigms. Semi-supervised methods e xploit limited labeled data to guide anomaly detection [25], [26], while ensemble techniques such as boost- ing and stacking impro v e rob ustness by aggre g ating di v erse classiers [27], [28]. Deep generati v e models, particularly generati v e adv ersarial netw orks (GANs), ha v e also been applied to anomaly detection by learn- ing compact representations of normal traf c and agging de viations from the learned distrib ution [29], [30]. Despite these adv ances, the majority of e xisting approaches continue to rely on con v entional surrog ate losses, such as hinge loss or cross-entrop y , which are not e xplicitly designed to handle se v ere class imbalance or to control decision boundary beha vior . T o the best of our kno wledge, no prior w ork has e xplicitly in v estig ated a Mar gin-r ecipr ocal loss: enhancing r ob ust network anomaly detection on imbalanced ... (T ahri Rac hid) Evaluation Warning : The document was created with Spire.PDF for Python.
500 ❒ ISSN: 2502-4752 reciprocal mar gin-based loss tailored to IDS for addressing se v ere class imbalance. This limitation moti v ates the e xplora tion of alternati v e mar gin-based loss formulations, such as the MRL proposed in this w ork, which directly emphasizes ambiguous and minority-class samples during training. Related ef forts ha v e also e xplored h ybrid AI frame w orks for anomaly detection and root cause analysis in multi-agent systems, highlighting the importance of combining learning-based detection with e xplainability mechanisms [31]. 3. METHOD This section describes the e xperimental methodology adopted to e v aluate the proposed MRL for net- w ork anomaly detection under class imbalance. It co v ers the problem formulation, dataset description, prepro- cessing and feature engineering steps, the MRL formulation, model architectures and training protocol, and the e v aluation metrics. 3.1. Pr oblem setting and mar gin-based lear ning W e consider a binary classication problem with training data, T = { ( x j , y j ) } n j =1 , x j ∈ R d , y j ∈ {− 1 , +1 } , where x j denotes a netw ork traf c instance and y j its corresponding label (norm al or attack). Let f ( x ) = w ⊤ ϕ ( x ) + b be a real-v alued scoring function, where ϕ ( · ) maps inputs into a feature space. The signed mar gin of a sample is dened as m j = y j f ( x j ) , which reects both prediction correctness and condence. Classical mar gin-based classiers, such as support v ector machines (SVMs), learn decision boundaries by minimizing a re gularized empirical risk of the form, min w ,b 1 2 ∥ w ∥ 2 + C n X j =1 ℓ ( m j ) , (1) where C > 0 is a re gularization parameter and ℓ ( · ) is a con v e x surrog ate loss. A widely used e xample is the hinge loss ℓ ( m ) = max(0 , 1 − m ) , which penalizes samples with mar gins smaller than one. Although ef fec- ti v e in balanced settings, such losses treat all mar gin violations uniformly and are not designed to emphasize minority-class samples that typically lie close to the decision boundary . When k ernel functions are emplo yed, the optimization is carried out in a reproducing k ernel Hi lbert space (RKHS). By the representer theorem, the optimal solution admits the nite e xpansion, f ( x ) = n X j =1 β j K ( x j , x ) + b, where β j ∈ R and K ( · , · ) denotes a positi v e-denite k ernel. The corresponding optimization problem can be written as, min β ,b C ∥ β ∥ 2 + n X j =1 ℓ y j ( β ⊤ k j + b ) , (2) with k j representing the j -th ro w of the k ernel matrix. F or lar ge-scale intrusion detection tasks, gradient-based optimization methods are particularly att rac- ti v e due to their scalability and lo w memory requirements. Adapti v e rst-order optimizers such as Adam pro vide stable con v er gence in both linear and neural models [32]. This general mar gin-based frame w ork forms the basis for the proposed MRL. 3.2. Dataset description Experiments are conducted on the NS L-KDD benchmark dataset [33], which is widely used for e v al- uating IDS and is kno wn for its se v ere class imbalance. The dataset contains netw ork traf c records labeled as normal or attack, with attack cate gories including DoS, Probe, R2L, and U2R. In particular , R2L and U2R rep- resent only a small fraction of the samples, making NSL–KDD suitable for studying imbalance-a w are learning methods. Indonesian J Elec Eng & Comp Sci, V ol. 42, No. 2, May 2026: 498–508 Evaluation Warning : The document was created with Spire.PDF for Python.
Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 ❒ 501 Unless otherwise stated, the detection task is formulated as binary classication (normal vs. atta ck). F or class-wise analysis, results are additionally reported using a one-vs.-rest strate gy . The of cial NSL–KDD T rain+ and T est+ partitions were used as pro vided, wi thout mer ging or cross-contamination. A portion of the T rain+ set w as further split into training and v alidation subsets using stratied sampling, while the T est+ set w as k ept strictly for nal e v aluation. 3.3. Pr epr ocessing and featur e engineering All preprocessing operations are performed e xclusi v ely on the training data to pre v ent informat ion leakage and ensure f air e v aluation. Duplicate records are remo v ed prior to dataset splitting. Numerical features with missing v alues are imputed using the median com puted from the training set, while cat e gori cal attrib utes are i mputed using the most frequent cate gory . The same transformation parameters are subsequently applied to v alidation and test sets. Cate gorical features, including protocol type, service, and connection ag, are encoded using one- hot encoding. Continuous features are standardized usi n g the mean and standard de viation deri v ed from the training partition. This normalization impro v es numerical stability during optimization and pre v ents features with lar ger magnitudes from dominating the learning process. F or linear models, principal component analysis (PCA) is optionally applied to retain 9 5% of the t otal v ariance, reducing dimensionality while preserving discriminati v e structure. Neural architectures oper ate on the full standardized feature space, allo wing them to learn hierarchical feature interactions directly . Class imbalance in NSL–KDD is se v ere, with DoS attacks dominating the dataset and U2R s amples representing only a v ery small fraction of the total traf c. The class distrib ution is illustra ted in Figure 1, highlighting the sk e wed nature of the dataset and moti v ating the need for imbalance-a w are learning strate gies. Figure 1. Class distrib ution in NSL-KDD (DoS, Probe, R2L, and U2R) T o further analyze f eature rele v ance across attack cate gories, recursi v e feature elimination (RFE) wit h a linear probe is emplo yed. Figure 2 presents the subsets of features selected by RFE for dif ferent attack f amilies, illustrating ho w discriminati v e characteristics v ary between majority and minority classes. As sho wn in Figigure 2(a), the selected features for DoS and Probe attacks primarily emphasize tr af c v olume, connection duration, and pack et-le v el statistics, which are strongly represented in the dataset and characterize high-frequenc y attack patterns. In contrast, Figure 2(b) demonstrates that R2L and U2R attacks rely on a distinct and more s ubtle subset of features, often related to a u t hentication beha vior , access control indicators, and specic connection attrib utes. The reduced representation and distinct featur e proles of these minority classes e xplain wh y con- v entional loss functions tend to bias decision boundaries to w ard majority traf c. Mar gin-r ecipr ocal loss: enhancing r ob ust network anomaly detection on imbalanced ... (T ahri Rac hid) Evaluation Warning : The document was created with Spire.PDF for Python.
502 ❒ ISSN: 2502-4752 These observ ations conrm that minority attack cate gories e xhibit class-specic feature signals that are more dif cult to separate under se v ere imbalance. Consequently , learning objecti v es that e xplicitly shape the mar gin distrib ution-such as the proposed MRL-are partic ularly rele v ant for impro ving detec tion rob ustness in such settings. (a) (b) Figure 2. RFE-selected features dif fer between majority and rare f amilies, indicating class-specic signals, (a) and (b) 3.4. Mar gin-r ecipr ocal loss The proposed MRL is designed to emphasize samples with small or ne g ati v e mar gins, which t ypically correspond to minority-class instances near the decision boundary . F or a sample ( x j , y j ) with y j ∈ {− 1 , +1 } and model output f ( x j ) , the signed mar gin is dened as m j = y j f ( x j ) . The idealized reciprocal form of the loss is gi v en, ℓ MRL ( m ) = (1 + m ) − p , p ≥ 1 , (3) which assigns lar ge penalties to small mar gins while rapidly decaying for well-classied samples. T o ensure numerical stability and dif ferentiability for all mar gin v alues, we optimize a smooth surrog ate based on the softplus function, s α ( m ) = 1 α log (1 + e αm ) , ˜ ℓ MRL ( m ) = (1 + s α ( m )) − p , (4) where α > 0 controls smoothness. Unless otherwise stated, we use p = 1 and α = 1 . The training objecti v e combines class weighting and ℓ 2 re gularization, Indonesian J Elec Eng & Comp Sci, V ol. 42, No. 2, May 2026: 498–508 Evaluation Warning : The document was created with Spire.PDF for Python.
Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 ❒ 503 min w ,b λ 2 ∥ w ∥ 2 2 + 1 n n X j =1 ω y j ˜ ℓ MRL ( m j ) , (5) where ω y j are in v erse-frequenc y class weights and λ controls weight decay . Unlik e focal loss [34], which rescales probability-based cross-entrop y , MRL operates directly on the mar gin and does not require additional focusing h yperparameters. 3.5. Model ar chitectur es and training pr otocol Three classication backbones are e v aluated under identical preprocessing conditions: i) a linear clas - sier; ii) a tw o-layer mul tilayer perceptron (MLP) with hidden sizes 128 and 64, ReLU acti v ations, and dropout rate 0.2; and iii) a long short-term memory (LSTM) netw ork applied to time-windo wed o w sequences, fol- lo wed by a linear output layer . All models are t rained using hinge, logistic, focal, and MRL losses for f air comparison. Optimi zation is performed using the Adam optimizer [32] with learning rate 10 − 3 , ( β 1 , β 2 ) = (0 . 9 , 0 . 999) , batch sizes of 256 for linear/MLP models and 64 for LSTM models, and early stopping based on v alidation macro-F1 with a patience of 7 epochs. Class weights are computed from in v erse class frequencies, and no o v ersampling is applied. 3.6. Ev aluation metrics and statistical analysis Performance is assessed using accurac y , precision, recall, F1-score, macro-F1, and per -class precision– recall A UC (PR-A UC). Gi v en the se v ere imbalance, model selection is based on macro-F1 and PR-A UC rather than accurac y alone. Results are a v eraged o v er v e independent random seeds, and paired t -tests are used to compare MRL ag ainst the strongest non-MRL baseline on the same backbone. Impro v ements with p < 0 . 05 are considered statistically signicant. 4. RESUL TS AND DISCUSSION This section e v aluates the proposed MRL from three complementary perspecti v es: i) quantit ati v e detection performance under se v ere imbalance, ii) rob ustness across models and datasets, and iii) system-le v el and deplo yment implications. All e xperiments follo w the protocol described in section 3 using stratied splits and leakage-free preprocessing. 4.1. Ov erall detection perf ormance under class imbalance T able 1 reports quantitati v e results on NSL–KDD across classical machine learning and deep l earning baselines. While se v eral methods achie v e high o v erall accurac y due to the do m inance of majority classes, imbalance-a w are metrics such as macro-F1 pro vide a more reliable assessment. T able 1. Quantitati v e comparison of baseline methods on NSL-KDD Method Accurac y (%) Precision (%) Recall (%) F1-score (%) Macro-F1 (%) Decision tree (DT) 93.10 90.22 88.65 89.43 84.17 Random forest (RF) 95.02 92.81 91.36 92.08 87.94 SVM (RBF) 94.87 91.74 90.92 91.33 86.21 XGBoost (XGB) 96.21 94.35 93.07 93.71 89.02 LSTM 97.04 95.41 94.28 94.84 90.15 Proposed MRL 99.39 98.81 100.00 99.35 96.87 All reported results are obtained using the of cial NSL–KDD T rain+ and T est+ partitions without mer ging, ensuring strict separation between training and e v aluation data. Compared to RF and XGBoost, the proposed MRL impro v es macro-F1 by more than 7 percentage points, demonstrating a substantial g ain in balanced detection ca p a bility . These i mpro v ement s directly address the limitations highlighted in prior w ork, where strong accurac y often masks poor minority-class recall. 4.2. Minority-class analysis Accurate detection of rare attack cate gories, particularly R2L and U2R, remains a critical challenge i n IDS. As illustrated in F igure 1, these classes represent only a small fraction of the NSL–KDD dataset, leading con v entional classiers to bias their decision boundaries to w ard majority traf c. Mar gin-r ecipr ocal loss: enhancing r ob ust network anomaly detection on imbalanced ... (T ahri Rac hid) Evaluation Warning : The document was created with Spire.PDF for Python.
504 ❒ ISSN: 2502-4752 Models trained with MRL consistently achie v e higher recall and PR-A UC for minority classes com- pared with baseline loss functions. This impro v ement can be attrib uted to the mar gin-a w are nature of MRL, which assigns stronger penalties to samples located near or across the decision bo undar y - where minority-class instances are typically concentrated. In contrast, probability-based losses such as cross-entrop y and focal loss primarily emphasize condence calibration rather than geometric mar gin structure, resulting in weak er sensi- ti vity to rare attacks. These results conrm that e xplicitly shaping the mar gin distrib ution constitutes an ef fecti v e and prin- cipled strate gy for mitig ating class imbalance in intrusion detection. 4.3. Comparison with baseline algorithms Be yond loss-f un c tion comparisons, the proposed approach w as e v aluated ag ainst commonly used in- trusion detection algorithms, including DT , RFs, SVM, nai v e Bayes, k-nearest neighbors, XGBoost, LSTM- based models, and a stacking ensemble. All methods were trained using identical preprocessing pipelines, stratied data splits, and e v aluation protocols to ensure a f air and unbiased comparison. Figure 3 presents a comparati v e o v ervie w of the main performance metrics across all e v aluated al- gorithms. The MRL-based model achie v es the strongest o v erall performance in terms of accurac y , F1-score, recall, and A UC. Importantly , these impro v ements are obtained without increasing architectural comple xity , indicating that the performance g ains originate primarily from the proposed loss formulation rather than from deeper or more sophisticated netw ork structures. This observ ation supports the central claim of this w ork: rening the learning objecti v e can be as ef fecti v e as increa sing model comple xity when addressing class imbalance challenges i n intrusion detection systems. Figure 3. Performance comparison across e v aluated intrusion detection algorithms 4.4. Confusion matrix analysis T o further analyze classicat ion beha vior , T able 2 reports the aggre g ated confusion matrix stati stics across the e v aluated models. The MRL-based classier achie v es the highest number of correctly classied instances and the lo west number of misclassications among all compared methods. This result indicates impro v ed reliability in distinguishing normal traf c from a di v erse range of attack types, including rare and security-critical cate gories such as R2L and U2R. The reduction in f alse ne g ati v es is particularly important in intrusion detection conte xts, where undetected attacks may lead to se v ere operational or security consequences. The confusion-matrix analys is therefore reinforces the practical rele v ance and ro- b ustness of the proposed loss function. T able 2. Confusion matrix summary across e v aluated models Metric DT RF LR SVM NB KNN XGB MRL Correct 136 140 137 140 136 141 139 200 Incorrect 7 3 6 3 7 2 4 2 Indonesian J Elec Eng & Comp Sci, V ol. 42, No. 2, May 2026: 498–508 Evaluation Warning : The document was created with Spire.PDF for Python.
Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 ❒ 505 4.5. Comparison with existing studies T o conte xtualize the obtained results, we compare our ndings with representati v e studies re p or ted in the literature on the NSL–KDD dataset. As illustrated in Figure 4, classical machine learning models and recent deep-learning approaches typically report accuracies belo w 99.1%, often accompanied by substantially lo wer macro-F1 scores. Figure 4. Performance comparison across e v aluated intrusion detection algorithms The proposed MRL-based approach achie v es an accurac y of 99.39% while simultaneously impro v- ing imbalance-a w are metrics, thereby surpassing prior w ork that relies on standard loss formulations. This comparison demonstrates that mar gin-a w are loss design c an yield competiti v e or superior performance without reliance on comple x architectures or aggressi v e resampling strate gies. 4.6. Cr oss-dataset generalization T o assess generalization be yond NSL–KDD, additional e xperiments were conducted on the C ICIDS 2017 dataset using the same training protocol and h yperparameters. The results sho w consistent impro v ements in macro-F1 and PR-A UC when using MRL com pared with hinge and focal losses, conrming that the proposed loss generalizes across datasets with dif ferent traf c characteristics. Detailed cross-dataset results are pro vided in the supplementary material. 4.7. Discussion and practical implications The e xperimental ndings yield se v eral important insights. First, o v erall accurac y alone is i nsuf - cient for e v aluating IDS under class imbalance, as it may conceal poor minority-class detection. Second, loss functions that e xplicitly account for mar gin beha vior can substantially impro v e rob ustness without requiring o v ersampling or comple x ensemble designs. Third, MRL remains simple to optimize using standard rst-order methods, making it suitable for lar ge-scale or near real-time deplo yment. Ne v ertheless, certain limitations must be ackno wledged. The e xperiments are conducted under o f ine conditions, and real-w orld traf c may introduce additional challenges such as noise, concept drift, and e v olv- ing a ttack strate gies. Moreo v er , although the computational o v erhead of MRL is modest compared to model forw ard passes, it is slightly higher than that of standard hinge or cross-entrop y losses due to mar gin-based computations. Ov erall, these results demonstrate that MRL pro vides a rob ust and ef fecti v e mechanism for en- hancing intrusion detecti on performance under se v ere class imbalance, particularly for rare b ut security-critical attack cate gories. 5. CONCLUSION This paper proposed a MRL for netw ork anomaly detection under se v ere class imbalance. By as- signing stronger penalties t o samples with small or ne g ati v e mar gins while att enuating the cont rib ution of well-classied instances, the proposed loss impro v es the detection of rare b ut critical attack cate gories such as R2L and U2R. Experimental results on the NSL-KDD benchmark demonstrate that models trained with MRL achie v e consistently higher macro-F1 and per -class precision–recall A UC compared to hinge, logistic, and focal losses, Mar gin-r ecipr ocal loss: enhancing r ob ust network anomaly detection on imbalanced ... (T ahri Rac hid) Evaluation Warning : The document was created with Spire.PDF for Python.
506 ❒ ISSN: 2502-4752 without increasing architectural comple xity . These ndings indicate that mar gin-a w are loss design plays a crucial role in impro ving rob ustness to class imbalance in IDS. Despite these adv antages, se v eral limitations should be noted. The e v aluation w as conducted on an of- ine benchmark dataset, and real-w orld netw ork traf c may e xhibit additional challenges s uch as concept drift, noise, and e v olving attack patterns. Moreo v er , although the computational o v erhead of MRL remains modest, it is slightly higher than that of standard hinge or cross-entrop y losses due to mar gin-based computations. Future w ork will focus on e xtending the proposed loss to streaming and online learning scenarios, in v estig ating adapti v e mechanisms to handle concept drift, and e v aluating the approach on more recent datasets and real operational traf c traces. These directions aim to further assess the practicality and generalizability of MRL in real-w orld intrusion detection en vironments. FUNDING INFORMA TION The authors declare that no funding w as recei v ed to support this research. A UTHOR CONTRIB UTIONS ST A TEMENT This journal uses the C ontrib utor Roles T axonomy (CRediT) to recognize indi vidual author contrib u- tions, reduce authorship disputes, and f acilitate collaboration. Name of A uthor C M So V a F o I R D O E V i Su P Fu Rachid T ahri ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ ✓ Abdellah Ouammou ✓ ✓ ✓ ✓ ✓ ✓ Abdellatif Lasbahani ✓ ✓ ✓ ✓ ✓ C : Conceptualization I : In v estig ation V i : V isualization M : Methodology R : Resources Su : Supervision So : Softw are D : Data Curation P : Project Administration V a : V alidation O : Writing – Original Draft Fu : Funding Acquisition F o : F ormal Analysis E : Writing – Re vie w & Editing CONFLICT OF INTEREST ST A TEMENT The authors declare that the y ha v e no kno wn competing nancial interests or personal rela tionships that could ha v e appeared to inuence the w ork reported in this paper . Authors state no conict of interest. D A T A A V AILABILITY The primary dataset used in this study is publicly a v ailable: NSL–KDD: http://www.unb.ca/ cic/datasets/nsl.html . Additional intrusion detection datasets (e.g., CICIDS2017 and UNSW –NB15) are public and are considered for e xtended e v aluation in future w ork. REFERENCES [1] D. Niyato, Q. Dong, P . W ang, and E. Hossain, “Optimizations of po wer consumption and supply in the smart grid: Anal- ysis of the impact of data communication reliability , ” IEEE T r ans. Smart Grid , v ol. 4, no. 1, pp. 21-35, Mar . 2013, doi: 10.1109/TSG.2012.2224677. [2] M . Lalou, M. A. T ahraoui, and H. Kheddouci, “The critical node detection problem in netw orks: A surv e y , ” Comput. Sci. Re v . , v ol. 28, no.4, pp. 92-117, May 2018, doi: 10.1016/j.cosre v .2018.02.002. [3] G . Fernandes, J. J. P . C. Rodrigues, L. F . Carv alho, J. F . Al-Muhtadi, and M. L. Proenc ¸ a, “ A comprehensi v e surv e y on netw ork anomaly detection, ” T elecommun. Syst. , v ol. 70, no. 3, pp. 447-489, Mar . 2019, doi: 10.1007/s11235-018-0475-8. [4] N. Zhao et al ., “ Automati c and generic periodicity adaptati on for KPI anomaly detection, ” IEEE T r ans. Netw . Serv . Mana g . , v ol. 16, no. 3, pp. 1170-1183, Sep. 2019, doi: 10.1109/TNSM.2019.2919327. [5] M. Abdelkhalek, G. Ra vikumar , and M. Go vindarasu, “ML-based anomaly detection system for DER communication in smart grid, ” in Pr oc. IEEE P ower & Ener gy Soc. Inno v . Smart Grid T ec hnol. Conf . (ISGT) , Ne w Orleans, LA, USA, pp. 1-5, Apr . 2022, doi: 10.1109/ISGT50606.2022.9817481. [6] S. Gadal, R. Mokhtar , M. Abdelhaq, R. Alsaqour , E. S. Ali, and R. Saeed, “Machine learning-based anomaly detection using K-mean array and sequential minimal optimization, ” Electr onics , v ol. 11, no. 14, p. 2158, Jul. 2022, doi: 10.3390/electronics11142158. [7] S. Zehra et al. , “Machine learning-based anomaly detection in NFV : A comprehensi v e surv e y , ” Sensor s , v ol. 23, no. 11, p. 5340, Jun. 2023, doi: 10.3390/s23115340. Indonesian J Elec Eng & Comp Sci, V ol. 42, No. 2, May 2026: 498–508 Evaluation Warning : The document was created with Spire.PDF for Python.
Indonesian J Elec Eng & Comp Sci ISSN: 2502-4752 ❒ 507 [8] M. De Benedetti, F . Leonardi, F . Messina, C. Santoro, and A. V asilak os, “ Anomaly detection and predicti v e maintenance for photo v oltaic systems, ” Neur ocomputing , v ol. 310, pp. 59-68, Oct. 2018, doi: 10.1016/j.neucom.2018.05.017. [9] J. Carrasco et al. , “ Anoma ly detection in predicti v e maintenance: A ne w e v aluation frame w ork for temporal unsupervised anomaly detection algorithms, ” Neur ocomputing , v ol. 462, pp. 440-452, Oct. 2021, doi: 10.1016/j.neucom.2021.07.095. [10] J. E. Diaz-V erdejo, R. E. Alonso, A. E. Alonso, and G. Madinabeitia, “ A critical re vie w of the techniques used for anomaly de- tection of HTTP-based attacks: T axonomy , li mitations and open challenges, ” Comput. Secur . , v ol. 124, p. 102997, Jan. 2023, doi: 10.1016/j.cose.2022.102997. [11] M. Ahmed, A. Naser Mahmood, and J. Hu, “ A surv e y of netw ork anomaly detection techniques, ” J . Netw . Comput. Appl. , v ol. 60, pp. 19-31, Jan. 2016, doi: 10.1016/j.jnca.2015.11.016. [12] S. A. Ajila, C. H. Lung, and A. Das, “ Analysis of error -based machine learning algorithms in netw ork anomaly detection and cate gorization, ” Ann. T elecommun. , v ol. 77, no. 4, pp. 359-370, Jun. 2022, doi: 10.1007/s12243-021-00836-0. [13] S. Russo et al. , “The v alue of human data annotation for machine learning bas ed anomaly detection in en vironmental systems, ” W ater Res. , v ol. 206, p. 117695, No v . 2021, doi: 10.1016/j.w atres.2021.117695. [14] J. S. Marron, M. J. T odd, and J. Ahn, “Distance-weighted discrimination, ” J . Amer . Statist. Assoc. , v ol. 102, no. Dec., pp. 1267-1271, 2007, doi: 10.2307/27639976. [15] C. C. Agg arw al, “ An introduction to outlier analysis, ” in Outlier Analysis . Cham, Switzerland: Springer , pp. 1-34, 2017, doi: 10.1007/978-3-319-47578-3 1. [16] D. M. Ha wkins, “Ident ication of Outliers, ” Spring er Netherlands , v ol. 11, pp. 1-188, 1980. [17] M. L. Sh yu, S. C. Chen, K. Sarinnapak orn, and L. Chang, “ A no v el anomaly detection scheme based on principal component classier , ” in Pr oc. IEEE F oundations Ne w Dir ections Data Mining W orkshop , pp. 172-179, No v . 2003. [18] C. Cortes and V . V apnik, “Support-v ector netw orks, ” Mac h. Learn. , v ol. 20, no. 3, pp. 273-297, Sep. 1995, doi: 10.1023/A:1022627411411. [19] S. W ang, J. F . Balarezo, S. Kandeepan, A. Al-Hourani, K. G. Cha v ez, and B. Rubinstein, “Machine learning in netw ork anomaly detection: A surv e y , ” IEEE Access , v ol. 9, pp. 152379-152396, 2021, doi: 10.1109/A CCESS.2021.3126834. [20] G. P ang, C. Shen, C. Cao, and A. V . D. Hengel, “Deep learning for anomaly detection: A re vie w , ” A CM Comput. Surv . , v ol. 54, no. 2, pp. 1-38, Mar . 2021, doi: 10.1145/3439950. [21] V . Chandola, A. Banerjee, and V . K umar , “ Anomaly detection: A surv e y , ” A CM Comput. Surv . , v ol . 41, no. 3, pp. 1-58, Jul. 2009, doi: 10.1145/1541880.1541882. [22] J. Chen, S. Sathe, C. Agg arw al, and D. T urag a, “Outlier detection with autoencoder ensembles, ” in Pr oc. SIAM Int. Conf . Data Mining (SDM) , pp. 90-98, Apr . 2017, doi: 10.1137/1.9781611974973.11. [23] A. Ja v aid, Q. Niyaz, W . Sun, and M. Alam, “ A deep learning approach for netw ork intrusion detection system, ” in Pr oc. 9th EAI Int. Conf . Bio-inspir ed Inf . Commun. T ec hnol. , pp. 21-26, Dec. 2016, doi: 10.4108/eai.3-12-2015.2262516. [24] J. T ang, J. Li, Z. Gao, and J. Li, “Rethinking graph neural netw orks for anomaly detection, ” arXiv pr eprint , 2022, doi: 10.48550/arXi v .2205.15508. [25] T . Shon and J. Moon, “ A h ybrid machine learning approach to netw ork anomaly detection, ” Inf . Sci. , v ol. 177, no. 18, pp. 3799-3821, Sep. 2007, doi: 10.1016/j.ins.2007.03.025. [26] H. Song, Z. Jiang, A. Men, and B. Y ang, “ A h ybrid semi-supervised anomaly detection model for high-dimensional data, ” Comput. Intell. Neur osci. , v ol. 2017, no. 1, p. 8501683, 2017, doi: 10.1155/2017/8501683. [27] G. Pu, L. W ang, J. Shen, and F . Dong, “ A h ybrid unsupe rvised clustering-based anomaly detection method, ” Tsinghua Sci. T ec hnol. , v ol. 26, no. 2, pp. 146-153, Apr . 2021, doi: 10.26599/TST .2019.9010051. [28] Z. Ghrib, R. Jaziri, and R. Romdhane, “Hybrid approach for anomaly detection in time series da ta, ” in Pr oc. Int. J oint Conf . Neur al Netw . (IJCNN) , Glasgo w , UK, pp. 1-7, Jul. 2020, doi: 10.1109/IJCNN48605.2020.9207013. [29] S. Akcay , A. Atapour -Abar ghouei, and T . P . Breck on, “GANomaly: Semi-supervised anomaly detection via adv ersarial training, ” in Pr oc. Comput. V ision (A CCV) , v ol. 11363, pp. 622-637, 2019, doi: 10.1007/978-3-030-20893-6 39. [30] H. Zenati, C. S. F oo, B. Lecouat, G. Manek, and V . R. Chandras ekhar , “Ef cient GAN-based anomaly detection, ” arXiv pr eprint , 2018, doi: 10.1109/ICDSCNC62492.2024.10939527. [31] R. T ahri, A. Ouammou, A. Lasbahani, A. Jarrar , and Y . Balouki, “Hybrid ai frame w ork for anomaly detection and root cause analysis in multi-agent systems, ” in International J ournal of Articial Intellig ence , v ol. 2252, no. 8938, p. 5291, 2024, doi: 10.11591/ijai.v16.i6.pp5290-5302. [32] D. P . Kingma a nd J. Ba, “ Adam: A method for stochastic optimization, ” arXiv pr eprint , 2014, doi: 10.48550/arXi v .1412.6980. [33] M. L. T a v allaee, E. Bagheri, W . Lu, and A. A. Ghorbani, ”NSL-KDD: A re vised benchmark dataset for intrusion de tection, ” in Pr oceedings of the 2009 International Confer ence on Computational Intellig ence for Security and Defense Applications (CISD A) , Otta w a, ON, Canada, 2009, doi: 10.1109/cisda.2009.5356528. [34] T .-Y . Lin, P . Go yal, R. Girshick, K. He, and P . Doll ´ ar , ”F ocal loss for dense object detection, ” in IEEE International Confer ence on Computer V ision (ICCV) , Oct. 2017, pp. 2980–2988, doi: 10.1109/ICCV .2017.324. BIOGRAPHIES OF A UTHORS Rachid T ahri w as born in Zagora, Morocco, in 1990. He recei v ed the Master’ s de gree i n Netw orks and Informatics Systems from the F aculty of Sciences and T echniques, Settat, in 2014. He is currently pursuing a Ph.D. at the Uni v ersity of Hassan 1st, Morocco. His research interests include security inte gration in Art icial Intelligence and Machine Learning systems. He is the corresponding author of this article. He can be contacted at: rachid.tahritr@gmail.com. Mar gin-r ecipr ocal loss: enhancing r ob ust network anomaly detection on imbalanced ... (T ahri Rac hid) Evaluation Warning : The document was created with Spire.PDF for Python.