A Super Learner Ensemble-based Intrusion Detection System to Mitigate Network Attacks

Abstract

Governments and corporate institutions are now mostly reliant on integrated digital infrastructures. These digital infrastructures are usually targets of cyber threats such as intrusion, for which intrusion detection systems (IDS) have emerged. One of the key needs for a robust IDS includes reducing the rate of false positives and thus improving accuracy. In this study, three traditional machine learning (ML) algorithms, including K-Nearest Neighbor (KNN), Naive Bayes (NB), and Decision Tree (DT), and three ensemble Machine Learning (ML) algorithms, including Random Forest (RF), Light Gradient Boosting Machine (LGBM), and Extreme Gradient Boosting (XGBOOST), were used on the UNSW-NB15 dataset from the Australian Centre for Cyber Security’s Cyber Range Lab, to train intrusion detection models. A super-learner ensemble model was then built using the best two ensemble models (XGBOOST and RF) along with the best traditional model (KNN) as its base learners. The super-learner ensemble model was able to reduce false positives and improve detection accuracy with 98% accuracy. The model was then deployed in an IDS application to mitigate network attacks effectively and efficiently.