Abstract:With the growing complexity and frequency of cyber threats, there is a pressing need for more effective defense mechanisms. Machine learning offers the potential to analyze vast amounts of data and identify patterns indicative of malicious activity, enabling faster and more accurate threat detection. Ensemble methods, by incorporating diverse models with varying vulnerabilities, can increase resilience against adversarial attacks. This study covers the usage and evaluation of the relevance of an innovative approach of ensemble classification for identifying intrusion threats on a large CICIDS2017 dataset. The approach is based on the distributivity equation that appropriately aggregates the underlying classifiers. It combines various standard supervised classification algorithms, including Multilayer Perceptron Network, k-Nearest Neighbors, and Naive Bayes, to create an ensemble. Experiments were conducted to evaluate the effectiveness of the proposed hybrid ensemble method. The performance of the ensemble approach was compared with individual classifiers using measures such as accuracy, precision, recall, F -score, and area under the ROC curve. Additionally, comparisons were made with widely used state-of-the-art ensemble models, including the soft voting method (Weighted Average Probabilities), Adaptive Boosting (AdaBoost), and Histogram-based Gradient Boosting Classification Tree (HGBC) and with existing methods in the literature using the same dataset, such as Deep Belief Networks (DBN), Deep Feature Learning via Graph (Deep GFL). Based on these experiments, it was found that some ensemble methods, such as AdaBoost and Histogram-based Gradient Classification Tree, do not perform reliably for the specific task of identifying network attacks. This highlights the importance of understanding the context and requirements of the data and problem domain. The results indicate that the proposed hybrid ensemble method outperforms traditional algorithms in terms of classification precision and accuracy, and offers insights for improving the effectiveness of intrusion detection systems.

Multiple Classification Algorithm Based on Ensemble Learning for Intrusion Detection

A Mixed Intrusion Detection System Utilizing K-means and Extreme Gradient Boosting

The Use of Ensemble Models for Multiple Class and Binary Class Classification for Improving Intrusion Detection Systems

Error-correcting Ability Based Collaborative Multi-Layer Selective Classifier Ensemble Model for Intrusion Detection

A Novel Intrusion Detection System Based on an Optimal Hybrid Kernel Extreme Learning Machine

Ensemble classification for intrusion detection via feature extraction based on deep Learning

Optimized Ensemble Learning Models Based on Clustering and Hybrid Deep Learning for Wireless Intrusion Detection

A supervised machine learning-based solution for efficient network intrusion detection using ensemble learning based on hyperparameter optimization

MCES: Multi-classifier Ensemble System for Malware Detection and Identification

LCCDE: A Decision-Based Ensemble Framework for Intrusion Detection in The Internet of Vehicles

Network intrusion detection by using multiple-criteria linear programming

A Hybrid Spectral Clustering and Deep Neural Network Ensemble Algorithm for Intrusion Detection in Sensor Networks

MEMBER: A multi-task learning model with hybrid deep features for network intrusion detection

Effectiveness of an ensemble technique based on the distributivity equation in detecting suspicious network activity

Deep Feature Extraction in Intrusion Detection System

A Multi-Channel Contrastive Learning Network Based Intrusion Detection Method

ICDF: Intrusion collaborative detection framework based on confidence

A Comprehensive Comparative Study of Individual ML Models and Ensemble Strategies for Network Intrusion Detection Systems

Unsupervised deep learning approach for network intrusion detection combining convolutional autoencoder and one-class SVM

A Hypergraph-Based Machine Learning Ensemble Network Intrusion Detection System

An AutoML-based approach for Network Intrusion Detection