RareGuard: Effective-Number Reweighting with Selective Prediction for Multiclass Intrusion Detection

An intrusion detector may perform well on an
imbalanced test set and still miss the rarest attacks. We study that
tradeoff using the official UNSW-NB15 training and test files.
RareGuard fits a histogram gradient-boosted classifier with effectivenumber weights chosen on a 20% validation partition, then applies a
confidence threshold fixed on the same partition. Effective weighting
increases test macro F1 from 0.4924 to 0.5144 and balanced accuracy
from 0.5428 to 0.6198. Inverse-frequency weighting reaches 0.6488
balanced accuracy, but macro F1 falls to 0.4960 and calibration
deteriorates sharply. RareGuard also sacrifices overall accuracy, from
0.7649 to 0.7264, while expected calibration error increases from 0.0661
to 0.0872. A validation threshold aimed at 80% coverage accepts 85.77%
of test flows and yields 0.7990 conditional accuracy. RareGuard is
therefore not uniformly better than the alternatives. It is better viewed as
a first-stage policy for settings that prioritize class-balanced recognition
and can route low-confidence flows to another process. The executed
pipeline is documented with checksums, settings, adverse results, perclass recall, model size, and latency.