Towards Trustworthy Imbalanced IDS: Balancing Calibration, Adaptation, and Oversampling

Intrusion Detection Systems (IDS) are central to network defense but remain challenged by severe class imbalance and distributional drift. Oversampling methods such as Synthetic Minority Oversampling Technique (SMOTE) and diffusion-inspired generators can enrich rare classes, yet they often produce off-support samples and risk degrading the performance when distributions shift. In this study, we revisit oversampling, calibration, and adaptation in a unified framework. We introduce a lightweight flow-matched variant (MeanFlow-IDS) equipped with stabilizers, including gentle synthesis ratios, one-hot projection, density filtering, prior-calibrated logit adjustment, and per-class threshold tuning, and we further assess a stabilized Feature Tokenizer (FT)-Transformer classifier to model interactions between categorical and numeric features. Experiments on NSL-KDD show that under the canonical split, augmentation alone often underperforms, particularly for the R2L (remote-to-local) and U2R (user-to-root) categories. When minimal adaptation is applied by incorporating a small portion of test data into training, however, all methods improve substantially, with macro-F1 rising above 0.83 and minority recalls increasing sharply. Within this adaptive regime, SMOTE remains competitive for certain rare classes; MeanFlow-IDS provides safer synthesis under drift; and FT-Transformer enhances robustness to heterogeneous feature types. Overall, our findings indicate that trustworthy imbalanced IDS requires balancing oversampling with calibration and continual adaptation, rather than relying on augmentation in isolation.