Ruensukont S.Sumonkayothin K.Siritanawan P.Hnoohom N.Saennam S.Beuran R.Mahidol University2026-02-062026-02-062026-01-01Lecture Notes in Computer Science Vol.16172 LNCS (2026) , 255-27603029743https://repository.li.mahidol.ac.th/handle/123456789/114473With the increasing role of Machine Learning (ML) and Deep Learning (DL) in various domains, their application in enhancing Network Intrusion Detection Systems (NIDS) has gained significant attention. Traditional NIDS approaches often rely on correlation-based detection, which may lead to misleading or fake correlations, failing to align with real-world use cases. Addressing this issue requires additional features, new datasets, and the development of new solutions. However, the rapid advancements in ML and DL pose challenges for timely deployment, as training, testing, and evaluating new models against existing solutions can be time-consuming. The large size of real-world datasets also contributes to high computational costs and extended training times, limiting the practical use of ML-based NIDS in dynamic environments. To tackle these challenges, this paper contributes to the field of NIDS in three key aspects: employing Reinforcement Learning (RL) to accelerate and optimize the model tuning process; introducing an efficient data preprocessing pipeline specifically designed for NIDS, which enhances data quality and feature representation; and proposing a novel sampling strategy that determines an optimal dataset size both in terms of total records and class-level balance. By integrating model tuning with the proposed method on dataset sampling, this research uses a smaller sampling size of 3,898 records and achieves a higher F1 score of 93.20, compared to the state-of-the-art statistical sampling method on the same NIDS dataset.MathematicsComputer ScienceConference PaperSCOPUS10.1007/978-981-95-2961-2_142-s2.0-10502023917916113349