A novel intrusion detection model combining cost sensitive neural networks and ensemble algorithms was proposed to address the issue of poor performance in identifying rare minority attacks in industrial control systems, with an excessive focus on accuracy and neglecting false alarms. The model was divided into three layers. In the first layer, the optimal spatiotemporal feature subset was extracted by combining convolutional neural network (CNN) and long short-term memory (LSTM) to avoid defocusing in a large amount of unnecessary data. A dual cross entropy cost sensitive deep neural network (CSEDNN) was proposed to divide samples into normal traffic and abnormal traffic. In the second layer, the AdaBoost algorithm was used to classify the abnormal traffic identified in the first layer into normal classes, different majority attack classes, and a single class of all minority attack classes, reducing the inherent imbalance between categories. In the third layer, logistic regression (LR) was used to classify the identified few attacks into multiple categories. Its accuracy and false alarm rate reaches 96.1% and 5.90%, respectively. By comparing the performance with other existing models on the UNSW-NB15 dataset, it was found that the model optimizes both false positive and false negative rates while ensuring accuracy. The results show that the model can accurately and efficiently identify network intrusions and classify them.