A Hybrid Light GBM Framework Integrating Feature Selection and Cost-Sensitive Learning for Network Outlier Detection

Machine learning intrusion detectors are often judged on benchmarks with redundant features, severe class imbalance and evaluation shortcuts. This study builds and evaluates a hybrid framework that combines a correlation filter, a rank-aggregated feature ranking based on mutual information and LightGBM split gain, softened square-root cost-sensitive weighting, and a regularised LightGBM classifier with early stopping. Every design choice was settled on a validation subset carved from the official UNSW-NB15 training partition, and the official test partition of 82,332 flows was used once for final measurement. The pipeline retained 15 of 42 features. Square-root weighting gave the best validation macro-F1 (0.634 against 0.601 without treatment) and outperformed SMOTE and hybrid resampling. On the test partition, the framework reached a ten-class macro-F1 of 0.530, the highest of seven models, and a binary F1 of 0.890 with an AUC of 0.977. Its accuracy was, however, significantly lower than that of five of six baselines under McNemar's test, and its false alarm rate was 25.6%. An ablation study showed that stabilising the learner with regularisation and early stopping contributed 7.0 of the 9.4 points of macro-F1 gained over default LightGBM. Feature selection cut training time by 37.3%. SHAP analysis identified the source time-to-live as the dominant feature, yet removing it changed binary F1 by only 0.001. A nine-point gap between validation and test binary F1 was traced to distribution shift, not duplicate leakage. The framework improves rare-class detection at low training cost, but benchmark results on this dataset must be read with caution.