• CHANDRA PRAKASH MISHRA
• ATUL KUMAR MISHRA

Cost-sensitive intrusion detection seeks to prevent missed attacks without overwhelming analysts with false alarms. However, selecting a threshold on held-out development data does not guarantee that its operational advantage will survive a change in traffic composition. This paper examines that transfer problem using the official UNSW-NB15 partitions (175,341 training and 82,332 testing records). A leakage-controlled workflow separates model fitting, probability calibration, and threshold selection within the training partition, and holds the official test partition untouched until evaluation. Four conventional baselines are compared with a Platt-calibrated random-forest policy using an illustrative missed-attack-to-false-alarm cost ratio of 5:1. The random forest achieves 89.42% test accuracy and an F1-score of 0.9105. Calibration with a validation-selected threshold of 0.13 reduces false negatives from 1,009 to 17, but increases false positives from 7,700 to 15,458. Thus, despite a substantial validation-set cost reduction, observed test cost rises from 0.1548 to 0.1888 per flow (21.95%); the paired-bootstrap 95% interval for the increase is [0.0298, 0.0381]. Three completed seed-wise partition checks show the same direction. The reported behavior coincides with an attack-prevalence change from 68.06% in training to 55.06% in testing, without establishing causation. Our results support evaluating threshold transfer, calibration stability, and decision costs alongside accuracy, rather than treating recall gains as evidence of lower operational risk.

Network intrusion detection; UNSW-NB15; cost-sensitive classification; probability calibration; threshold transfer; dataset shift; random forest.

"WHEN COST-SENSITIVE THRESHOLDS FAIL TO TRANSFER: A LEAKAGE-CONTROLLED EVALUATION OF NETWORK INTRUSION DETECTION ON UNSW-NB15", International Journal of Emerging Technologies and Innovative Research (www.jetir.org), ISSN:2349-5162, Vol.13, Issue 10, page no.c544-c552, October-2026, Available :http://www.jetir.org/papers/JETIR2610258.pdf

"WHEN COST-SENSITIVE THRESHOLDS FAIL TO TRANSFER: A LEAKAGE-CONTROLLED EVALUATION OF NETWORK INTRUSION DETECTION ON UNSW-NB15", International Journal of Emerging Technologies and Innovative Research (www.jetir.org | UGC and issn Approved), ISSN:2349-5162, Vol.13, Issue 10, page no. ppc544-c552, October-2026, Available at : http://www.jetir.org/papers/JETIR2610258.pdf