## 1 Introduction  
Cybersecurity mechanisms, such as network intrusion detection systems (NIDSs) and firewalls, detect network attacks and prevent hackers from gaining entry into the enterprise network. Most methods for intrusion detection focus on large-scale targeted cyberattacks, such as distributed denial of service (DoS) attacks [1], botnet attacks [2], ransomware attacks [3], phishing attacks [4], and credential theft [5]. Thus, studies on network attack detection have primarily focused on the use of specific security mechanisms as entry points into the enterprise network to defend against network threats. In practice, information security experts are often required to analyze and classify the threat type in cases of network intrusion, and it is often impossible to judge new types or variants of cyber threats in real time. For the implementation of network security applications, NIDSs must support intrusion detection when the volume of flow inspections is large by performing anomaly detection and exploring new threats through machine learning (ML) algorithms. Typically, network intrusion detection (NID) involves collecting behavioral information to classify all potential threats into attacker and victim categories under some given constraints on the quantity of packets collected and NIDS computational time. Many classification approaches incorporate ML algorithms to assist managers in precisely identifying network attacks [4; 5; 6; 7]. ML techniques for threat classification--such as support vector machine (SVM) and hybrid approaches--are used to aid category prediction, wherein the SVM [4] is incorporated with other classification approaches, such as those based on decision trees (DTs) [5], principal component analysis (PCA) [6], and the Dempster-Shafer theory [7]. These network threat classification schemes are summarized in Table 1.  
Because information diversification services produce diverse and complex threat patterns, a single classifier in an ML model may not produce perfect predictions for a given data set under certain real-time requirements for intrusion detection by an NIDS. As attacks on large-scale networks become more diverse, a basic classifier in ML models, such as SVM, becomes increasingly unable to effectively process a large volume of traffic in large-scale networks with complex intrusion patterns. Therefore, ensemble learning-based techniques, such as random forest (RF) [8; 9; 10], boosting [11], gradient boost DT (GBDT) [12], and stacking [13], are adopted to help security managers detect complex threats from a variety of sources. In practice, classes necessarily have an imbalanced distribution in information flows because the volume of traffic is large and because certain types of anomalies occur at a low frequency. Thus, the classification performance of supervised ML techniques, such as DT, naive Bayes, and SVM techniques, are affected by imbalances in the number of data points for each threat class in a given data set. Intrusion detection schemes have tended to ignore the magnitude of imbalanced data and overfitting-related difficulties in threat data. In imbalanced intrusion data sets, ML algorithms intuitively provide more accurate predictions for classes with many data points (i.e., majority classes) and less accurate predictions for classes with a small number of data points [14]. To maintain prediction stability at high precision, rebalancing sampling must be applied to the raw data to achieve a balance in the number of data points for each class. Furthermore, threat data sets necessarily include noise extracted from flow traffic; such noise causes overfitting in model training. An overfitted model predicts future observations