## 2 Related Work  
NIDSs extensively employ ML and DL techniques for the analysis of network traffic data and the detection of potential security threats. While traditional ML approaches, like k-nearest neighbor (KNN) [17] and support vector machines (SVM) [18], have been widely used in intrusion detection, their performance is limited when confronted with the challenges posed by large-scale network traffic data and high-dimensional feature spaces [19; 20; 21]. In contrast, by utilizing neural networks, DL has proven to be effective in handling massive network traffic data and high-dimensional feature spaces, thereby improving the accuracy of IDS [22]. As a result, the research community has shown significant interest in applying DL to intrusion detection in recent years. In Table 1, we have summarized the recent research in network intrusion detection, encompassing the utilization of machine learning, deep learning, and class balancing techniques. [PERSON] et al. [23] proposed a CNN-based IDS in their study. Their approach involved employing three convolutional layers to effectively capture feature relationships through convolution and pooling operations. The extracted features were subsequently classified using the softmax function. The proposed method underwent evaluation on the KDD99 dataset, achieving an accuracy of 99.23% when tested on 10% of the dataset. [PERSON] et al. [24] introduced an IDS based on BiLSTM. Their method involved exploring 24 different scenarios with various learning rates, activation functions, and optimizers. In order to address the issue of model overfitting, each scenario incorporated a dropout layer and an L2-regularizer as mitigating techniques. The evaluation was conducted on the CIC-IDS2017 dataset, and the experimental results consistently demonstrated a stable accuracy of over 95% across all scenarios. Specifically, after 100 epochs, the proposed method attained an accuracy of 97.72% for binary classification. Subsequently, the method underwent additional training for 1000 epochs, leading to the best model achieving an accuracy of 98.34%. [PERSON] et al. [25] presented an IDS based on DNN. The DNN architecture employed in their study consisted of five hidden layers, each containing 30 neurons. The DNN model attained an accuracy of 79.26% when evaluated on the KDD99 dataset. [PERSON] et al. [26] introduced a feature selection technique that utilized a recursive feature elimination decision tree based on Pearson correlation. In this study, the model was applied to analyze the BoT-IoT dataset, leading to the identification of nine highly correlated features. Subsequently, these selected features were used in a DNN for attack detection. The experimental results demonstrated that the proposed model achieved an accuracy of 99.2%. [PERSON] et al. [27] employed the modified GreyWolf optimization algorithm (MGWO) for feature selection and, furthermore, fine-tuned the parameters of the base classifier, the extreme learning machine (ELM), using the MGWO. The proposed approach was experimentally tested on the UNSW-NB15 dataset, achieving an accuracy of 80.93%. [PERSON] et al. [28] proposed an effective method for detecting a botnet attack, known as the local-global best bat algorithm for neural networks (LGBA-NNs). This method enhances intrusion detection performance by selecting the best feature subset and hyperparameters. Their proposed method was experimentally evaluated on the N-BaloT dataset, achieving an accuracy of 90%. [PERSON] et al. [29] transformed network features into images and employed the ResNet50 model for classification. The proposed method achieved detection accuracies of 99.8%, 86%, and 67.9% for generic attacks, reconnaissance attacks, and exploit attacks, respectively, on the UNSW-NB15 dataset. Additionally, the proposed method achieved a detection accuracy of 99.7% for DDoS attacks on the BOUN DDoS dataset. In order to address the negative impact of imbalanced datasets on the performance of IDS, [PERSON] et al.