Lightweight intrusion detection systems for critical infrastructure protection: a comparative evaluation of class balancing techniques with strategic dataset reduction and cross-dataset validation

Abstract

Machine-learning-based intrusion detection systems are increasingly important for protecting critical infrastructure as cyber threats grow in number and sophistication. However, the computational demands of many state-of-the-art models can limit deployment in resource-constrained environments, while traditional intrusion detection systems often exhibit substantial generalization gaps across networks and real-world settings. This study evaluates whether aggressive dataset reduction, optimized preprocessing, and hybrid class balancing can improve cross-dataset generalization without dedicated hardware. Five class-balancing techniques were evaluated on a KDD Cup 1999 dataset reduced by 90%, with SMOTETomek selected because it produced the lowest false-negative count, a critical consideration for security-sensitive anomaly detection. In benchmark-transfer validation against the NSL-KDD test dataset, the lightweight model achieved 80.11% accuracy, compared with 76.65% for a minimally preprocessed baseline. It also processed 22,544 instances in 0.1005 s, corresponding to 224,388 instances per second, on commodity hardware with a 4-core CPU and 16 GB RAM. These results challenge reliance on high single-dataset accuracy and provide a reproducible, computationally sustainable benchmark-transfer methodology. Independent pipeline validation on UNSW-NB15 achieved 94.66% accuracy and a Matthews correlation coefficient (MCC) of 0.8849, while validation on a supervisory control and data acquisition/industrial control system (SCADA/ICS) dataset achieved 99.98% accuracy, an MCC of 0.9991, and a 0.0% false-positive rate. These latter results provide preliminary, non-transfer evidence that the pipeline design generalizes beyond the KDD family.