Abstract:With the growing complexity and frequency of cyber threats, there is a pressing need for more effective defense mechanisms. Machine learning offers the potential to analyze vast amounts of data and identify patterns indicative of malicious activity, enabling faster and more accurate threat detection. Ensemble methods, by incorporating diverse models with varying vulnerabilities, can increase resilience against adversarial attacks. This study covers the usage and evaluation of the relevance of an innovative approach of ensemble classification for identifying intrusion threats on a large CICIDS2017 dataset. The approach is based on the distributivity equation that appropriately aggregates the underlying classifiers. It combines various standard supervised classification algorithms, including Multilayer Perceptron Network, k-Nearest Neighbors, and Naive Bayes, to create an ensemble. Experiments were conducted to evaluate the effectiveness of the proposed hybrid ensemble method. The performance of the ensemble approach was compared with individual classifiers using measures such as accuracy, precision, recall, F -score, and area under the ROC curve. Additionally, comparisons were made with widely used state-of-the-art ensemble models, including the soft voting method (Weighted Average Probabilities), Adaptive Boosting (AdaBoost), and Histogram-based Gradient Boosting Classification Tree (HGBC) and with existing methods in the literature using the same dataset, such as Deep Belief Networks (DBN), Deep Feature Learning via Graph (Deep GFL). Based on these experiments, it was found that some ensemble methods, such as AdaBoost and Histogram-based Gradient Classification Tree, do not perform reliably for the specific task of identifying network attacks. This highlights the importance of understanding the context and requirements of the data and problem domain. The results indicate that the proposed hybrid ensemble method outperforms traditional algorithms in terms of classification precision and accuracy, and offers insights for improving the effectiveness of intrusion detection systems.

A Dynamic Ensemble Learning Framework for Data Stream Analysis and Real-Time Threat Detection

A Causality Based Feature Selection Approach for Data-Driven Dynamic Security Assessment

An ensemble-based framework for user behaviour anomaly detection and classification for cybersecurity

Research on Dynamic Data Flow Anomaly Detection based on Machine Learning

Distributed anomaly detection using concept drift detection based hybrid ensemble techniques in streamed network data

Big data analysis and distributed deep learning for next-generation intrusion detection system optimization

A Deep Learning Ensemble for Network Anomaly and Cyber-Attack Detection

A Stream Learning Approach for Real-Time Identification of False Data Injection Attacks in Cyber-Physical Power Systems

Analyzing threat flow over network using ensemble-based dense network model

Effectiveness of an ensemble technique based on the distributivity equation in detecting suspicious network activity

Anomaly Intrusion Detection Based on Data Stream

Toward a monitoring and threat detection system based on stream processing as a virtual network function for big data

DELM: Deep Ensemble Learning Model for Anomaly Detection in Malicious Network Traffic-based Adaptive Feature Aggregation and Network Optimization

A Real Time Deep Learning based Approach for Detecting Network Attacks

A Framework for Detecting Distributed Denial of Services Attack in Cloud Enviorment using Machine Learning Techniques

Malware Attack Detection in Large Scale Networks using the Ensemble Deep Restricted Boltzmann Machine

Adaptive regularized ensemble for evolving data stream classification

A distributed platform for intrusion detection system using data stream mining in a big data environment

SALAD: A split active learning based unsupervised network data stream anomaly detection method using autoencoders

ATM Fraud Detection using Streaming Data Analytics

Ensemble Learning Framework for DDoS Detection in SDN-Based SCADA Systems