## 1 Introduction  
Training an AMIDS using an imbalanced dataset, where normal examples appear more frequently than malicious ones in a non-hostile environment, is normal and often desirable. The nature of the real-time network traffic in a non-critical or non-hostileIoT system or environment typically contains more normal events than malicious ones. However, the real-time network flow can exhibit a rise in malicious events in a CioT system that involves deploying and operating critical infrastructure. Consequently, in highly hostile environments such as Miot, it is possible to encounter a network flow where adversarial examples are notably higher than non-adversarial examples. Nonetheless, there is a tendency to train AMiDS models to protect nodes in CioT systems and Miot environments using imbalanced datasets where malicious examples appear less frequently than non-malicious examples. Training AMiDS models using more normal examples than malicious ones is desirable when dealing with anomaly detection cases such as fraud detection and predictive maintenance. However, in mission-critical and highly hostile environments, there is a high possibility that real-time network traffic will contain more malicious examples than normal ones. The author of [1] described this case as a rare event prediction case and defined rare events, which constitute less than 5% of the dataset, as occurring infrequently. Moreover, the degree of imbalance based on the proportion of the minority class can be extreme, moderate, or mild [2]. When the proportion of the minority class is less than 1%, the degree of imbalance is extreme. However, proportions between 1 and 20% and 20 and 40% signal moderate and mild degrees of class imbalance, respectively. Therefore, in this study, we consider the hostile case where the dataset contains more malicious events than normal ones with a moderate degree of imbalance. Similar to the authors of [1], we call this hostile case a rare event prediction case. Therefore, we use these two terms (hostile and rare) interchangeably in this paper. Likewise, a non-hostile case is where normal events occur more frequently than malicious events. In doing so, our main objective is to improve the performance of the PCA-based and oSVM-based AMiDS in hostile environments using imbalanced learning and passive adversarial learning. Our disposition towards considering the hostile case stems from the fact that behavior-based IDS typically detects intrusions based on a deviation from normal behavior instead of a malicious one. Usually, datasets for intrusion detection systems and malware analyses consist of logs and network traffic captures, where the number of malicious and constant connections generated by an intruder is less than the number of normal connections generated by non-malicious applications [3]. In the hostile case, our underlying assumption is that a traffic flow instance may exhibit more malicious events than normal ones. Whether considering a hostile or a non-hostile case, insufficient data and a data imbalance invariably result in a skewed data distribution and, hence, the model's inability to recognize the most significant features. Most notably, it can lead to biased predictive models, inaccurate predictions, and a performance degradation [4]. Therefore, training an AMiDS to protect nodes in CioT and Miot using insufficient or imbalanced data or both can adversely impact the model's predictability and detection rate. In a hostile environment, an AMiDS that fails to predict and accurately detect malicious events due to a biased classification can have a catastrophic impact when used to secure, for example, smart transportation, and inevitably, it can have a fatal impact when used to secure Internet of Battle Things (IoBT) devices used by connected soldiers. Unlike imbalanced learning, purpose-driven learning, where models are trainable using imbalanced real-time or simulated data, invariably leads to inefficient logical models that neither make accurate predictions nor generalize to highly hostile environments.