## 1 Introduction  
The rapid advancement of networks has led to a significant improvement in the quality of human life and work efficiency. Nevertheless, the growing dependence of modern society on networks has heightened the risks of network intrusions and malicious attacks, which pose threats to privacy, property, and even personal safety. Therefore, it is crucial to adopt a reliable and efficient network intrusion detection system (NIDS). NIDSs play a critical role in detecting abnormal traffic and potential security threats, such as unauthorized access and denial-of-service (DoS) attacks, by analyzing network traffic and protocol states [1]. The prompt detection of these threats by NIDSs significantly enhances the security and stability of the network. Intrusion detection systems (IDSs) are typically classified into two primary types: misuse-based IDS (MIDS) and anomaly-based IDS (AIDS) [2]. MIDS, also known as the signature-based IDS, detects malicious activities in network traffic by comparing them with known intrusion behavior signatures. If network traffic matches a known intrusion signature, an alert is triggered to indicate the presence of an intrusion. However, MIDS requires frequent updates to its signature database and faces challenges in detecting zero-day attacks or unknown variant attacks. In contrast, AIDS utilizes statistical methods and machine learning (ML) algorithms to establish a baseline of normal network behaviors, enabling it to detect deviations from this baseline in network traffic. Through the continuous monitoring and analysis of network traffic, AIDS can detect traffic patterns that deviate from the norm and generate alerts to indicate potential intrusions. However, AIDS may exhibit a high false positive rate when the intrusion behavior is similar to normal behavior or when the training data for the model is insufficient. While AIDS may have a high false positive rate, it possesses the capability to detect both known and unknown attacks [3]. NIDSs have extensively employed traditional ML methods [4; 5]. However, the effectiveness of these approaches depends heavily on manually designed features and the model's capacity to learn relevant features from the data [6; 7]. In comparison, deep learning (DL) models can exploit the inherent properties of neural networks to extract abstract and intricate features from unprocessed network traffic data. DL can overcome the limitations of traditional ML [8]. Common DL algorithms, including recurrent neural networks (RNNs), deep neural networks (DNNs), and convolutional neural networks (CNNs), have demonstrated successful application in the domain of intrusion detection [9; 10; 11]. However, real-world network environments often experience an imbalance between normal and attack traffic data, as well as an uneven distribution of attack categories [12]. Imbalanced datasets can lead to model bias towards the majority class, thereby affecting the performance of IDS. As a result, research efforts have focused on addressing the issue of class imbalance in IDS. Techniques for handling imbalanced datasets can be implemented at both the data level and the algorithmic level [13; 14]. Data level techniques involve sampling the dataset to balance samples from different categories, such as oversampling and undersampling. However, these techniques have drawbacks, including information loss, overfitting, and increased computational complexity [15; 16]. Algorithmic-level techniques can address class imbalance by introducing algorithms during the training process without altering the dataset itself. Therefore, in this paper, we address the issue of imbalanced datasets at the algorithmic level by utilizing focal loss to mitigate the imbalance problem. This paper introduces CBF-IDS, an IDS that integrates convolutional neural networks (CNNs), bidirectional long short-term memory networks (BiLSTMs), and focal loss. CBF-IDS is designed to extract spatial and temporal features from network traffic data, facilitating comprehensive modeling and analysis.