A novel hybrid ensemble deep learning approach for cyber intrusion detection

Abstract

The uninterrupted growth of transactions carried out over the Internet (e.g., adoption of digital payments) can lead to potential exposure to serious security problems. Regarding the implementation of innovative technological solutions, the scientific community strives to develop approaches which can effectively protect the entities from adversarial cyber-threats. This research focuses on improving network security, developing the Hybrid Ensemble Deep Learning Intrusion Detection System ( ${HEDL}^{\infty}$ ). It is the optimized version of the previous two older releases, namely HEDL-IDS and ${HEDL - IDS}^{2}$ . The Ensemble consists of two Deep Neural Networks (DNN), four Convolutional Neural Networks (CNN) and five Recurrent Neural Networks (RNN) with parallel LSTM layers. The classifier of each Ensemble employs an improved Custom Vote process, following the Weighted Vote and the Majority Vote principles. The ${HEDL}^{\infty}$ was successfully validated on the UNSW-NB15 dataset, with overall accuracy equal to 99.56% during the training phase and 99.24% during the testing phase. The high values of the performance indices during testing confirm that the updated version is a robust tool that can be used in real-world, to significantly reduce the exposure of the network’s users, paving the way for further research efforts.

Keywords

Hybrid ensemble CNN DNN RNN LSTM cyber attacks cyber intrusion detection

1. Introduction

Technological advancement during the last two decades has been exponential. Our post-modern societies are strongly dependent not only on the internet and its derivatives, but also on the smooth operation of information and communication systems.¹ Today, the number of applications for both personal and commercial use is growing rapidly, driven by the widespread adoption of the Internet of Things (IoT).² Cyber-space was once a domain of leisure, knowledge and international communication. However, as science progressed over the years, the internet–used daily around the world – was conceived.³ Internet services, including cellular and information services, are provided either publicly or privately by organizations to enhance and stream-line their operations.⁴ For example, trade, back office, financial, and material resources, and so on are controlled via cyberspace.

The rapid internet explosion, including the ingenuity to lead to more productive business processes, has come along with many risks that take advantage of potential weaknesses.⁵ Nevertheless, the availability of computer networks and inter-linked systems might lead to the exploitation of their vulnerabilities. Hackers can exploit systems’ vulnerabilities, to breach privacy and steal or corrupt critical data, or they can cause serious problems in systems’ functionality.⁶ More specifically, cyber-attacks can target personal identification information (PII) such as social security and credit card details, as well as unauthorized access to databases and Critical Infrastructure Facilities (CIF) such as hospitals, energy, water, and gas providers.^7,8

Network security has improved dramatically, yet the state of computer networks remains risk-prone and existing solutions cannot provide totally fulfilling defense to the systems.⁹ Although they are coping with mechanisms, firewalls, software, hardware, user identification, and data encryption cannot keep up with the quick development of security breaching techniques.¹⁰ As a result, the use of more efficient strategies and methodologies is necessary.

Cyber and network security has made significant strides in countering the rapid evolution of attackers’ barrage of threats and technologies. However, the challenges posed by emerging trends in technology remain due to the lack of robust solutions against attacks, targeting computer networks and interconnected devices.¹¹

As for cyber risk management, Intrusion Detection Systems (IDS) can enhance people’s confidence in cyberspace.¹² IDS is expanding quickly in an effort to improve system security. IDS have the potential to distinguish between normal and malicious flow/behavior using respective patterns or specific rules.¹³ There are two main types of cyber analytics in support of IDS: misuse-based (also called signature based) and anomaly-based.¹⁴ Signature-based techniques detect anomalies by matching signatures of predefined attacks.¹⁵ These methods are not only simple to implement, but they also have low False Positive rates. However, it is not feasible for them to detect new cyber threats. Anomaly-based (AB) detection techniques, rely on the assumption that the intruder’s behavior is different from the typical one.¹⁶ They model the network’s normal patterns, and they identify anomalies as deviations from them. Anomaly-based Intrusion Detection Systems (ABIDSs) can detect zero-day attacks. However, they may often result in high False Alarm Rates (FARs) because several previously unseen (yet legitimate) system behaviors may be classified as anomalies. All in all, these systems allow a person or a group of people to monitor and analyze events on many computers connected to a given network.

The objective of this research is to pinpoint events that bear signals of potential intrusions, and to enable preservation of traces related to secrets’ mismanagement, even attacks on the systems.¹⁷

2. Aim – Novelty of this research

This paper presents an innovative IDS, extending the hybrid ensemble approaches that have been already discussed in the literature.^18,19 Specifically, it introduces the ${HEDL}^{\infty}$ (Hybrid Ensemble Deep Learning Intrusion Detection System) that offers early detection of cyber-threats.

Its architecture comprises an ensemble of three different types of eleven (11) Artificial Neural Networks as follows: 2 Deep Neural Networks (DNNs), 4 Convolutional Neural Networks (CNNs) and 5 Recurrent Neural Networks (RNNs) with Long-Short Term Memory (LSTM) layers. The above Machine Learning (ML) models function as ensembles during the weight update voting process, and they are incorporated into a specific classification system. The proposed approach was tested with the well-known and widely used UNSW-NB15 Dataset.²⁰ The UNSW-NB15 dataset was created by the IXIA PerfectStorm tool in the Cyber Range Lab of the University of New South Wales (UNSW) Canberra, for generating a hybrid of real modern normal activities and synthetic contemporary attack behaviors²⁰ (https://research.unsw.edu.au/projects/unsw-nb15-dataset).

The dataset includes network packets related to the following nine (9) different types of cyber-attacks namely: (Analysis, Backdoor, Denial of Service (DoS), Exploits, Fuzzers, Generic, Reconnaissance, Shellcode, Worms) and moreover packets that contain benign flow.

The ${HEDL}^{\infty}$ hybrid model was tested as a component of the ${COREM}^{2}$ holistic approach.²¹ ${COREM}^{2}$ constitutes an innovative hybrid that consists of a RNN with LSTM layers, a 2-Dimensional (2-D) CNN, and a MLPNN for the classifications of 9 different Cyber Attacks and of benign net flow. The holistic approach for cyber intrusion detection of a device (or even of a network) that was introduced by the authors, using ${COREM}^{2}$ , was introduced to classify the Benign network’s traffic and moreover, the traffic that corresponds to the nine aforementioned Cyber Attacks. In this research effort, the authors reviewed and replaced the hybrid IDS ${COREM}^{2}$ model with the optimized ${HEDL}^{\infty}$ hybrid.

This ongoing research boosts the model’s architecture even further, offering more consistent results. The most significant difference in relation to the two previous approaches are the following:

–
${HEDL}^{\infty}$ employs an Ensemble architecture, comprising two DNNs, four CNNs and five Recurrent LSTM models, in contrast to the previous ( ${HEDL - IDS}^{2}$ architecture which comprised four DL Neural Networks one of each type) and three Deep Learning (DL) Neural Networks one of each type (HEDL-IDS).
–
The main contribution of this research is its dynamic architecture and adaptability. The determination of the number of networks of various predefined architectures, the number of layers and parameters to comprise the ${HEDL}^{\infty}$ model is determined by the algorithm itself in the training process. This means that the final architecture is not decided in advance. The user chooses the maximum number of each network (e.g., CNN, MLP, RNN), as well as the initial values of their hyperparameters, and the algorithm automatically runs and decides the optimal architecture – structure suitable for each modeling problem during training. Once the architecture is decided, it can change dynamically depending on the case.
–
Specifically, this research paper introduces a new custom weighted vote of the 11 Neural Networks (NNs) that comprise the ${HEDL}^{\infty}$ in order to classify an observation into the corresponding class. This approach improves the accuracy and robustness of the model. The innovation exists in the fact that the model decides for the weights that will be assigned in each network, and it is biased by the time taken for the model to be trained and predict each instance.
–
In the application process, the Custom Weighted Vote algorithm was implemented to minimize the complexity of the whole process. ${HEDL}^{\infty}$ was trained by using the 10-fold cross-validation method, in contrast with the two previous research efforts of our research team^18,19 which used the hold-out validation approach.
–
${COREM}^{2}$ replaced the hybrid network that was used in the previous holistic approach of COREM2 and it was tested on the Kitsune Network Attack dataset.^22,23 It is worth mentioning that the ${HEDL}^{\infty}$ was not retrained on a new dataset. The aim was to check if the network, even though it has been trained on another data, can generalize and make predictions with first-seen data.
–
All data handling has been achieved by writing code from scratch in Matlab.

3. Literature review

Several Machine Learning (ML) IDS approaches have been introduced during the last twenty years. Recently, more and more In order to identify malware, categorize network intrusions and phishing (online spam attacks), and examine website defacements, Deep Learning (DL) models have been presented in the literature.

In 2018, Potluri et al.²⁴ proposed an IDS based on CNN. In this research effort, they have used both the NSK-KDD and the UNSW-NB15 datasets. To exploit the full extent of the CNN they also converted the packets into images. Thereafter, they developed a CNN with three convolution layers. They achieved an overall accuracy of 91.14% on the NSL-KDD and 94.9% on the UNSW-NB15. Finally, they performed a comparison with the well-known deep networks ResNet 50 and GoogleNet, highlighting the superiority of their models. In 2018, Hajisalem and Babaie²⁵ proposed a hybrid approach combining the Artificial Bee Colony (ABC) algorithm with the Artificial Fish Swarm (AFS) algorithm. They also applied the Fuzzy C-Means Clustering (FCM) and the Correlation-based Feature Selection (CFS) techniques to divide the training dataset and to remove the irrelevant features, respectively. In addition, “If-Then” rules were generated through the Classification and Regression Tree (CART) technique, according to the selected features, in order to distinguish the normal and the anomaly class records. The authors of this research effort have achieved a mean accuracy of 97.5% for the testing set. In 2018, Malik and Khan,²⁶ introduced a hybrid model that combines the Binary Particle Swarm Optimization with the Decision Tree Pruning, for network intrusion detection. In 2018, Zhang et al.,²⁷ employed a convolutional neural network, to model the B2C (Business to Consumer) online transaction dataset of a commercial bank. The model achieved a Precision as high as 91% and a Recall equal to 94%. Convolutional neural networks were also used by Basumallik et al.²⁸ for packet-data anomaly detection, in phasor measurement units-based state estimator (PHMUB). The IEEE-30 bus, and IEEE-118 bus systems were used as the PHMUB. This research uses a probability of 0.5 with 512 neurons on a fully connected layer. The accuracy reached the value of 98.67%.

In 2020, Zhang et al.,²⁹ presented an innovative approach combining a Multiscale Convolutional Neural Network (MSCNN) with Long Short-Term Memory (LSTM). Their model was compared with Lenet-5, a simple MSCNN and the HAST-IDS achieving an overall accuracy of 95.6% in train data and 89.9% in test data. In 2020, Hassan et al.,³⁰ presented a novel IDS consisting of a CNN network (to extract the features from the dataset) and a weight-dropped, long short-term memory (WDLSTM) network (to retain long-term dependencies among extracted features to prevent overfitting on recurrent connections), achieving an overall accuracy of 96.975% using the 10-fold cross validation technique. Thamilarasu and Chawla,³¹ introduced a Deep Belief network to fabricate a feed-forward DNN for an Internet of Things (IoT)case. The proposed model was tested against five attacks, namely: The Sinkole, the Wormhole, the Blackhole, the Opportunistic service and the DDoS. The results show a Precision of 96% and a Recall of 98.6% for the case of the DDoS attacks. Khan et al.,³² proposed an intrusion detection system based on the two-stage deep learning model, named TSDL. The KDD99 and the UNSW-NB15 network intrusion public datasets were considered for TSDL training and testing, with an accuracy equal to 99.996% and 89.134% respectively. In 2020, Sarker et al., introduced the “IntruDTree” machine-learning security model, which is characterized by low computational complexity and high accuracy, due to the performed feature dimensionality reduction.³³ In 2020, Demertzis et al. suggested a Blockchain Security Architecture that aims to ensure network communication between traded Industrial IoT devices, following the industry 4.0 standard, based on Deep Learning Smart Contracts. The proposed smart contracts are implementing (via computer programming) a bilateral traffic control agreement to detect anomalies based on a trained Deep Auto-encoder Neural Network.³⁴ In 2022, Psathas et al.,¹⁸ presented a hybrid Intrusion Detecting System (IDS) comprised of a 2-Dimensional Convolutional Neural Network (2-D CNN), a RNN and a DNN for the detection of nine Cyber Attacks versus normal flow. The timely Kitsune Network attack dataset was used in this research. The proposed model achieved an overall accuracy of 92.66%, 90.64% and 90.56% in the train, validation and testing phases respectively. Extending their previous work, Psathas et al.,¹⁹ propose the second version of the Hybrid Ensemble Deep Learning Intrusion Detection System (HEDL-IDS2). The architecture of this hybrid approach is comprised by four CNNs, four RNNs with LSTM layers and four DNNs running in parallel. For each record, the output space is the majority vote from the nine models. The model was trained and evaluated using the UNSW-NB15 dataset and the overall accuracy for the training, validation and testing data was as high as 98.85%, 98.8% and 97.5% respectively. The values of the performance indices were above 0.96 for both benign and malicious traffic in all classes.

Moreover, the concept of combining multiple intelligent engines through adaptive weighting follows the principles of meta-algorithmics, as discussed by Simske.³⁵ Meta-algorithmics is related to the practice of employing meta-algorithms. It provides general patterns for creating robust, low-cost, and high-quality systems by balancing recall and precision, which is particularly relevant for intrusion detection systems. Meta-Algorithmic tools include (Confusion Matrices, Weighting schemes, Output space transformations (for output refinement) Sensitivity analysis and Feedback mechanisms that have the potential to refine the results).

Recent advances in deep learning and supervised machine learning (ML) have significantly enhanced classification performance across various domains, including biomedical signal processing, recommender systems, and cybersecurity. For instance, Hassanpour et al.³⁶ proposed an end-to-end deep learning scheme for classifying multiclass motor imagery Electroencephalography (EEG) signals, demonstrating the ability of deep networks to learn complex temporal and spatial features from neurophysiological data. Similarly, Martins et al.³⁷ explored deep learning techniques for recommender systems based on collaborative filtering, highlighting the capability of neural networks to model intricate user-item interactions for accurate prediction.

In the context of cybersecurity, recent studies have applied supervised and deep learning algorithms to classify cyber-attacks effectively. Be and Gokulraj³⁸ employed traditional supervised machine learning methods, including decision trees, support vector machines, and neural networks, to classify malware, phishing, and DDoS attacks, emphasizing feature extraction from network traffic and behavioral data. Becerra-Suarez et al.³⁹ evaluated deep learning models such as CNNs, RNNs, and LSTMs for cybersecurity attack detection in IoT networks, demonstrating their ability to capture complex patterns in large-scale traffic datasets. Additionally, Mehta et al.⁴⁰ proposed a hybrid Hidden Markov Model-Convolutional Neural Network (HMM-CNN) approach for malware classification, effectively combining sequential pattern recognition and hierarchical feature extraction to enhance detection performance. Collectively, these works underscore the growing potential of deep and supervised learning methods in handling diverse classification tasks across multiple domains.

It would be impossible to cover all of the numerous research projects taking place in the field of cyber security. However, a number of additional studies, such as Ganeshkumar and Pandeeswari,⁴¹ Meidan et al.,⁴² Soe et al.,⁴³ Zhang et al.,⁴⁴ Dash,⁴⁵ Cordonsky et al.,⁴⁶ Gibert Llauradó,⁴⁷ Loukas et al.,⁴⁸Zhang et al.,⁴⁹ Al-Qatf et al.,⁵⁰ Alsouda et al.,⁵¹ Dang et al.,⁵² also served as motivation for this study endeavor.

4. Description of the UNSW-NB15 dataset and pre-processing

The UNSW-NB15 dataset²⁰ is a powerful repository of data for research in network security, especially for those working on intrusion detection systems. It is free to use for academic research and it comprises raw network packets associated with nine distinct types of attacks. It was developed in 2015 at the University of New South Wales, within the Australian Defense Force Academy, Australian Centre for Cyber Security (ACCS), Canberra, Australia.⁵³ The dataset excels in the breadth and depth of its representation of attack types. It also does a commendable job of capturing normal network behavior. To create the dataset, the authors used a network simulation tool called IXIA PerfectStorm.⁵⁴ This tool enabled them to generate a sufficiently large and diverse collection of network packets that, when taken as a whole, do a reasonable job of mimicking real network traffic.

This method took not just normal traffic patterns but also many different attack patterns into account, capturing improved modeling of our cybersecurity threats. By using a Common Vulnerabilities and Exposures (CVE) repository⁵⁵ for real-time updates, the researchers ensured that the dataset was reflective of not just the time it was collected (The simulation covered a period of 16 hours of the $22^{nd}$ of January 2015 and 15 hours of the $17^{th}$ of February 2015) but also contemporary networks, which are always under threat from the most recent exploits.

With a total data volume of 100 GB, the dataset presents a perfect testbed of information. This makes it a perfect testbed for our researchers to develop and assess not only the next generation of intrusion detection algorithms but also to gauge the ”real-world” performance of those algorithms. When those algorithms are assessed against both the simulated normal network traffic and the sophisticated simulated attacks that the dataset provides, it positions UNSW-NB15 as a widely recognized benchmark for network security research.

The overall number of packets in the dataset is 2,540,044. The malicious traffic comprises nine different Cyber Attacks (Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worms) and contains 321,283 packets. The rest of the traffic records consist of 2,218,761 instances of benign flow. Nevertheless, the initial dataset is rather unbalanced, something very well expected and typical for the specific case (Cyber Attacks are only 12.5% of the original dataset). Thus, the developers of the dataset provided a more balanced subset of the UNSW-NB15. The subset contains a total of 257,673 records, 164,673 of which correspond to malicious traffic (including nine cyber-attacks) and 93,000 correspond to benign flow (Table 1). Nevertheless, there is still an internal “minority-class” problem, in the Cyber-Attacks’ class (e.g., Worms and Shellcode are a small portion of the “minority” classes records). Thus, the authors had to cope with this challenge. The name and description of all 48 features of the UNSW-NB15 subset, has been listed in Table 2, according to The UNSW-NB15 Dataset.²⁰ There are 47 independent variables in the dataset, where the 48th variable contains the name of each class (if the packet is related to an attack, it states its name, else it is filled with the Normal string). The 42 features of the subset UNSW-NB15 are listed in in the following Table 2.

Table 1.
Type, description and number of subset packets, the number of dataset packets and label of the nine (9) cyber attacks and normal flow considered in this research.

Type Description: The attacker $\dots$ #Subset’s Packets #Dataset Packets Label

Normal Natural transaction data 93,000 2,218,761 0

Fuzziers Attempting to cause a program or network to be suspended by feeding it the randomly generated data. 24,246 24,246 1

Analysis It contains different attacks of port scan, spam and html files penetrations. 2,677 2,677 2

Backdoors A technique in which a system’s security mechanism is bypassed stealthily to access a computer or its data 2,327 2,329 3

DoS A malicious attempt to make a server or a network’s resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet. 16,353 16,353 4

Exploits An operating system or piece of software has a security flaw that the attacker is aware of and takes advantage of by exploiting it. 44,525 44,525 5

Generic Without taking into account the block-cipher’s structure, a technique is effective against any block ciphers (with a specified block and key size). 85,871 215,481 6

Reconnaissance Includes every strike that can mimic information-gathering attacks. 13,987 13,987 7

Shellcode A small piece of code used as the payload in the exploitation of software vulnerability. 1,511 1,511 8

Worms The attacker replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it. 174 174 9

Type	Description: The attacker $\dots$	#Subset’s Packets	#Dataset Packets	Label
Normal	Natural transaction data	93,000	2,218,761	0
Fuzziers	Attempting to cause a program or network to be suspended by feeding it the randomly generated data.	24,246	24,246	1
Analysis	It contains different attacks of port scan, spam and html files penetrations.	2,677	2,677	2
Backdoors	A technique in which a system’s security mechanism is bypassed stealthily to access a computer or its data	2,327	2,329	3
DoS	A malicious attempt to make a server or a network’s resource unavailable to users, usually by temporarily interrupting or suspending the services of a host connected to the Internet.	16,353	16,353	4
Exploits	An operating system or piece of software has a security flaw that the attacker is aware of and takes advantage of by exploiting it.	44,525	44,525	5
Generic	Without taking into account the block-cipher’s structure, a technique is effective against any block ciphers (with a specified block and key size).	85,871	215,481	6
Reconnaissance	Includes every strike that can mimic information-gathering attacks.	13,987	13,987	7
Shellcode	A small piece of code used as the payload in the exploitation of software vulnerability.	1,511	1,511	8
Worms	The attacker replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself, relying on security failures on the target computer to access it.	174	174	9

Table 2.

Features’ abbreviation and respective description in the UNSW-NB15 subset.

Feature	Description
srcip	IP address of Source packets
sport	Port number of Source packets
dstip	IP address of Destination packets
dsport	Port number of Destination packets
proto	Protocol of transaction
state	State of the transaction protocol
dur	Record of total duration
sbytes	Source to destination transaction bytes
dbytes	Destination to source transaction bytes
sttl	Source to destination time to live value
dttl	Destination to source time to live value
sloss	Retransmitted or dropped packets from source
dloss	Retransmitted or dropped packets from destination
service	http, ftp, smtp, ssh, dns, ftp-data, irc and (-) if not much used service
sload	Bits/s of source packets
dload	Bits/s of destination packets
spkts	Number of packets from source to destination
dpkts	Number of packets from destination to source
swin	TCP window size of source packets
dwin	TCP window size of destination packets
stcpb	Sequence number of TCP from source packets
dtcpb	Sequence number of TCP from destination packets
smeansz	Source packets mean size
dmeansz	Destination packets mean size
trans_depth	Depth of http request/response transaction
res_bdy_len	Actual uncompressed content size of data transferred from the server http service
sjit	Jitter of source packets in milliseconds
djit	Jitter of destination packets in milliseconds
stime	Starting time of record
ltime	Finish time of record
sintpkt	Arrival of source packets in milliseconds
dintpkt	Arrival of destination packets in milliseconds
tcprtt	TCP connection setup round-trip time, the sum of ’synack’ and ’ackdat’
synack	TCP connection setup time, the time between the SYN and SYN_ACK packets
ackdat	TCP connection setup time, the time between the SYN_ACK and ACK packets
is_sm_ips_ports	1 for equaldestination and source IPs and ports, else 0
ct_state_ttl	Number of each state in a specific branch of values for life/destination to live
ct_flw_http_mthd	The number of threads with methods such as GET and POST in HTTP service
is_ftp_login	The number of streams connected in the FTP session
ct_ftp_cmd	Number of flows in FTP session
ct_srv_src	Number of connections containing the same service and source address in the last 100 connections
ct_srv_dst	Number of connections containing the same service and destination address in the last 100 connections
ct_dst_ltm	Number of connections from the same target address in 100 connections by the last time
ct_src_ltm	Number of connections from the same source address in 100 connections by the last time
ct_src_dport_ltm	Number of connections from the same source address and target port in the last 100 connections
ct_dst_sport_ltm	Number of connections from the same target address and source port in 100 connections previously
ct_dst_src_ltm	Number of connections from the same source and destination address in 100 connections depending on the previous time
attack_cat	Names of each type of attack. In this dataset, nine types: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms

4.1. Dataset pre-processing

The features proto, state, service, and attack_cat were stored as strings (sequences of characters). Thus, they were transformed by the authors from nominal to numeric. The transformations are presented in the following Tables 3 and 4.

Table 3.
Service with the corresponding label.

Service – dhcp dns ftp ftp-data http irc pop3 radius smtp snmp ssh ssl

Service Label 1 2 3 4 5 6 7 8 9 10 11 12 13

Service	–	dhcp	dns	ftp	ftp-data	http	irc	pop3	radius	smtp	snmp	ssh	ssl
Service Label	1	2	3	4	5	6	7	8	9	10	11	12	13

Table 4.

State with the corresponding label.

State	CON	ECO	FIN	INT	PAR	REQ	RST	URN	no	ACC	CLO	-
State Label	1	2	3	4	5	6	7	8	9	10	11	12

Since the Proto feature has 133 different elements, the table with the correspondence to the labels has been omitted. For further information about the feature extraction process and the features, refer to Moustafa and Slay.⁵³ Furthermore, the features srcip, sport, dstip, and dsport have been transformed to integers using the ipaddress.py⁵⁶ library (e.g., 192.168.0.1 - 3232235521). The rest of the 40 features have numerical (either integer or float) values.

The rest of the data handling (except for the python code ipaddress.py that was used) has been achieved by writing code from scratch in Matlab. The dataset had the shape of a 257,673 x 48 Table (47 columns contain the independent variables and 1 contains the respective target label). The data was assigned to Training (75%) and Testing 25%. The dimensions of the training and testing tables were 193,254x48 and 64,419x43 respectively. All tables contain records of all classes. The optimal division emerged through a trial-and-error process.

5. The

{HEDL}^{\infty}

Model

As stated before, ${HEDL}^{\infty}$ consists of three different types of Artificial Neural Networks (ANN), four CNNs, five RNNs with LSTM layers and two DNNs. Thus, the following paragraphs present a short and basic description of their mathematical foundations Yeung et al.,⁵⁷ Baek and Choi⁵⁸ and Liu et al.⁵⁹ The theoretical foundations of all three ANNs are well-known from the existing literature and the manuscript does not focus on this.

DNNs represent a fundamental type of ANN that comprises multiple layers of interconnected neurons, each layer communicating with the next in a feedforward manner (Figure 1). Unlike simpler Perceptrons, DNNs possess hidden layers, which allow them to model complex relationships within data. Training a DNN involves adjusting the weights and biases of its connections following the principles of the backpropagation algorithm and employing the gradient descent protocol. This iterative process enables the network to learn from input-output pairs and to improve its performance over time.⁵⁷ Figure 1 presents schematic representation of a deep neural network (DNN). The architecture consists of an input layer that receives features, a hidden layer where weighted inputs are processed through activation functions, and an output layer that produces the final prediction. Each connection between neurons is associated with a weight, and the network learns by adjusting these weights during training.

Figure 1.

The 3-layer DNN model architecture (1 input layer, 1 output layer and 1 hidden layers).

CNNs are characterized by their ability to extract features at a finer resolution and subsequently to transform them into more intricate features at a lower resolution, as depicted in Figure 2. Hence, CNNs consist of three primary types of layers: Convolutional, Pooling, and Fully Connected. The arrangement of these layers forms the architecture of a CNN.⁶⁰ The feature value at the position (x, y) within the $k^{th}$ feature map of the $M^{th}$ layer can be computed as follows:

\begin{aligned} f e a t u r e_{x, y, k}^{M} = W_{k}^{M^{T}} X_{x, y}^{M} + b_{k}^{M} \end{aligned}

(1)

Figure 2.

The CNN model architecture with a Convolution Layer, a Pooling Layer, a Flatten, a Fully Connected Layer and a Softmax Layer.

Where $X_{x, y}^{M}$ is the input patch that is centered at position (x, y), $W_{k}^{M}$ is the vector of weights of the $k^{th}$ filter, and $b_{k}^{M}$ represents bias at the $M^{th}$ layer. The activation value $a c t i v a t e_{x, y, k}^{M}$ and the pooling value $p o o l_{x, y, k}^{M}$ of convolution feature $f e a t u r e_{x, y, k}^{M}$ follows the next equation:

\begin{aligned} a c t i v a t e_{x, y, k}^{M} & = a c t i v a t i o n (f e a t u r e_{x, y, k}^{M}) \end{aligned}

(2)

\begin{aligned} p o o l_{x, y, k}^{M} & = p o o l i n g (f e a t u r e_{x, y, k}^{M}), \forall (x, y) \in R_{x_{s}, y_{s}}) \end{aligned}

(3)

where

N_{x, y}

is a neighborhood at postition (x, y). The functions used are the nonlinear ReLU, Sigmoid, and Tangent Hyperbolic (Tanh). The Pooling operations employed are Mean and Max Pooling.

The output generated by RNNs in each phase relies on the output computed in the preceding state, repeating the same task for every element of the sequence. Essentially, RNNs leverage their inherent memory to retain previously calculated information.⁶¹ However, RNNs encounter difficulty in retaining information over extended periods, due to the issue of vanishing or exploding gradients during backpropagation. This leads to notable fluctuations in training weights. This challenge has been addressed by Long Short-Term Memory (LSTM) networks.

An LSTM unit typically consists of three gates: an input gate, an output gate, and a forget gate. These gates regulate the flow of information into and out of the memory cell. The input gate determines the proportion of input to influence the cell’s state value, while the forget gate manages the retention of information within the memory cell. Meanwhile, the output gate controls the accessibility of information from the memory cell to compute the output activation of the LSTM unit.⁶² The architecture of an LSTM node is depicted in Figure 3, where $X_{t}$ represents the input, $h_{t}$ denotes the output of the LSTM node, $h_{t - 1}$ signifies the output of the preceding LSTM node, $C_{t}$ and $C_{t - 1}$ refer to the cell states at time t and t-1 respectively. Furthermore, $σ$ represents the sigmoid function used to decide what information to forget, tanh signifies the hyperbolic tangent function employed to assign weights, and b denotes the bias term. The notation ”x” denotes the application of information scaling, while the symbol ”+” indicates the process of adding information.⁶³

Figure 3.

Architecture of an LSTM node.

5.1. Architecture of the HEDL-IDS model

The ${HEDL}^{\infty}$ consists of four 2-D CNNs, five RNNs with LSTM layers and two DNNs. The input of CNN is a vector with 1 $\times$ 47 $\times$ 1 dimensions, (1 observation, 47 features, and 1 channel). DNN’s and RNN’s input is a 1 $\times$ 47 vector (1 observation, 47 features). The output of each model is an integer that belongs to interval [0, 9]. The number of filters applied in the CNNs were $2^{n}$ , where n $=$ 1, 2– 8. The stride value was set to 1. The sizes of the kernel tested were 2, 3, 4, and 5. The number of neurons used in each LSTM and DNN layer was 50, 100, 150, 200, 250, 300, 350, 400, 450 and 500 nodes. The last layer for all 11 models was a Dense Layer with 1 node. Furthermore, the penultimate layer of the CNN models (after the Flatten Layer) is a Dense Layer with 20 nodes. To avoid overfitting, dropout layers were added after each Flatten, LSTM and Dense Layer. Additional training using 10-fold cross validation also decreased the probability of overfitting. The values tested for the dropout layers were 0.1, 0.2, 0.3, 0.5 and 0.8. All parameters and hyperparameters were set automatically by the algorithm, achieving the best performance. The architecture of the eleven models, alongside the used parameters, is displayed in the following Table 5. The Dropout Layer’s rate is equal to 0.3. The input of each layer is the output of the previous one. Figure 4 presents the architecture of the ${HEDL}^{\infty}$ model.

Figure 4.

Architecture of the ${HEDL}^{\infty}$ . From left to right 1st DNN, 2nd DNN, 1st RNN, 2nd RNN, 3rd RNN, 4th RNN, 5th RNN, 1st CNN, 2nd CNN, 3rd CNN and 4th CNN.

Table 5.

Layers and parameters set for the eleven HEDL-IDS models.

NN	Layer	Parameters set	NN	Layer	Parameters set
1st CNN	2-D Convolution	(filters, kernel size, strides) $=$ (16, 3, 1)	2nd DNN	Dense	Nodes $=$ 400
	2-D Maxpooling	Pool size $=$ (1,2)		Dense	Nodes $=$ 350
	2-D Convolution	(filters, kernel size, strides) $=$ (64, 3, 1)		Dense	Nodes $=$ 300
	2-D Maxpooling	Pool size $=$ (1,2)		Dense	Nodes $=$ 250
	Flatten	-		Dense	Nodes $=$ 200
2nd CNN	2-D Convolution	(filters, kernel size, strides) $=$ (32, 3, 1)		Dense	Nodes $=$ 150
	2-D Maxpooling	Pool size $=$ (1,2)		Dense	Nodes $=$ 100
	2-D Convolution	(filters, kernel size, strides) $=$ (128, 3, 1)		Dense	Nodes $=$ 50
	2-D Maxpooling	Pool size $=$ (1,2)	1st RNN	LSTM	Nodes $=$ 150
	2-D Convolution	(filters, kernel size, strides) $=$ (512, 3, 1)	2nd RNN	LSTM	Nodes $=$ 450
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 350
	2-D Convolution	(filters, kernel size, strides) $=$ (2048, 3, 1)		LSTM	Nodes $=$ 250
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 150
	Flatten	-		LSTM	Nodes $=$ 50
3rd CNN	2-D Convolution	(filters, kernel size, strides) $=$ (8, 3, 1)	3rd RNN	LSTM	Nodes $=$ 500
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 400
	2-D Convolution	(filters, kernel size, strides) $=$ (32, 3, 1)		LSTM	Nodes $=$ 300
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 200
	2-D Convolution	(filters, kernel size, strides) $=$ (128, 3, 1)		LSTM	Nodes $=$ 100
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 50
	2-D Convolution	(filters, kernel size, strides) $=$ (512, 3, 1)	4th RNN	LSTM	Nodes $=$ 400
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 400
	Flatten	-		LSTM	Nodes $=$ 300
4th CNN	2-D Convolution	(filters, kernel size, strides) $=$ (4, 3, 1)		LSTM	Nodes $=$ 200
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 200
	2-D Convolution	(filters, kernel size, strides) $=$ (16, 3, 1)		LSTM	Nodes $=$ 100
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 100
	2-D Convolution	(filters, kernel size, strides) $=$ (64, 3, 1)		LSTM	Nodes $=$ 50
	2-D Maxpooling	Pool size $=$ (1,2)	5th RNN	LSTM	Nodes $=$ 450
	2-D Convolution	(filters, kernel size, strides) $=$ (256, 3, 1)		LSTM	Nodes $=$ 400
	2-D Maxpooling	Pool size $=$ (1,2)		LSTM	Nodes $=$ 350
	Flatten	–		LSTM	Nodes $=$ 300
1st DNN	Dense	Nodes $=$ 500		LSTM	Nodes $=$ 250
	Dense	Nodes $=$ 250		LSTM	Nodes $=$ 200
	Dense	Nodes $=$ 100		LSTM	Nodes $=$ 150
	Dense	Nodes $=$ 50		LSTM	Nodes $=$ 100
2nd DNN	Dense	Nodes $=$ 450		LSTM	Nodes $=$ 50

$^{*}$ After each Flatten Layer: Dense Layer with 20 nodes

$^{* *}$ Last Layer of all Models: Dense Layer with 1 node

$^{* * *}$ Dropout Layer after each Flatten, LSTM and Dense Layer

All experiments have been performed in Python, using a computer with an Intel Core i9-9900 CPU (3.10 GHz) processor, DDR4 memory (32 GBytes) and GPU NVIDIA GeForce RTX 2070 Super (8GBytes). The Keras⁶⁴ and Tensorflow⁶⁵ libraries have been employed to build the model’s architecture. Based on the literature, in all layers, Categorical Crossentropy, the Adam Optimizer and the ReLU functions were employed as the Loss Function, the Optimizer and the Activation Function respectively. The Softmax Activation Function has been used in the last dense layer of each model.

5.2. New custom weighed vote

Before the initiation of the training process, the algorithm asks the user to enter the number of models of each NN architecture (DNN, RNN, CNN). to participate in the final hybrid network and the number of layers, following the deep learning architecture of each NN. For the purpose of this research effort, both the depth of the NNs and their number were set to 10. This means that potentially the final model could comprise ten NNs of each kind (30 in total) having 10 layers each. This is the reason the specific approach is called ${HEDL}^{\infty}$ . The ensemble can include up to 10 networks of each type: DNN, CNN, and RNN with LSTM layers, yielding a maximum of 30 networks. The design space is defined by the following hyperparameters:

DNNs and RNNs: number of nodes $N \in {50, 100, 150, 200, 250, 300, 350, 400, 450, 500}$ (10 options), dropout $d \in {0.1, 0.2, 0.3, 0.5, 0.8}$ (5 options), and number of networks in the ensemble $k \in {0, 1, \dots, 10}$ (11 options). This yields $10 \times 5 \times 11 = 550$ configurations for each type.

CNNs: number of filters $F = 2^{n}$ , $n \in {1, \dots, 8}$ (8 options), kernel size $K \in {2, 3, 4, 5}$ (4 options), dropout $d \in {0.1, 0.2, 0.3, 0.5, 0.8}$ (5 options), and number of networks in the ensemble $k \in {0, \dots, 10}$ (11 options), giving $8 \times 4 \times 5 \times 11 = 1,760$ configurations.

Assuming independent selection of DNN, CNN, and RNN networks, the total number of possible architecture combinations is:

550 (DNN) $\times$ 1,760 (CNN) $\times$ 550 (RNN) $=$ 532,400,000. The user has the capacity to adjust the aforementioned parameters. However, a lot of attention is required not to increase or decrease drastically the complexity of the model, and the respective computational time.

For the purposes of this research effort, the authors proposed a new custom vote for the final prediction, combining the weighted vote and the majority vote of the ensemble models. Initially, all algorithms are trained and tested separately on the aforementioned dataset.

Traditional weighted voting strategies, as described in the meta-algorithmics framework of Simske,³⁵ typically assign weights based on classifier performance, such as overall accuracy or the inverse of error rate. These approaches improve over majority voting by leveraging the relative strengths of individual classifiers. However, they generally assume that performance is the only factor influencing ensemble utility. In contrast, the Custom Weighted Vote introduced in ${HEDL}^{\infty}$ extends this paradigm by incorporating not only the accuracy of each classifier but also its computational efficiency during both training and prediction. This dual consideration ensures that the ensemble is not dominated by models that perform well but are prohibitively slow, which is critical for near real-time cyber intrusion detection. Thus, our approach can be viewed as a meta-algorithmic specialization of weighted voting, aligning with Simske’s principles while tailoring them to the operational requirements of cybersecurity applications. Furthermore, the algorithm developed for the architecture of the model, keeps only the NNs whose combination performs both faster and more accurately, assigning them automatically the relative weights. The following Table 6 presents the accuracy for each one of the accepted NNs in the proposed approach. The accurate results of all employed algorithms were added. The accuracy of each algorithm was divided with the sum to calculate the weight of each algorithm in the final classification of each instance. In this approach, although the weighting process is similar, the code was developed to reduce the time during training and prediction. For this reason, before assigning the weights, the algorithm assigns a constant to each model depending on how fast it solves the problem, both in training and testing phases. This is indicated in the following table 7. The sum of all weights of all algorithms should sum up to 1. Every time the algorithm makes a prediction for a record, a 1x10 matrix is formed. Each column represents one label of the target variable. The value of each cell is the sum of the weights of the algorithms that classify the record in a specific class. If a record is not classified as the available classes, the corresponding cell is assigned the zero value. The predicted class of the instance is the number of the column with the highest value.

Table 6.
Accuracy for each of the NNs in ${HEDL}^{\infty}$ .

Model Accuracy

1st DNN 0.79

2nd DNN 0.815

1st RNN 0.82

2nd RNN 0.895

3rd RNN 0.9

4th RNN 0.91

5th RNN 0.905

1st CNN 0.915

2nd CNN 0.938

3rd CNN 0.945

4th CNN 0.91

Model	Accuracy
1st DNN	0.79
2nd DNN	0.815
1st RNN	0.82
2nd RNN	0.895
3rd RNN	0.9
4th RNN	0.91
5th RNN	0.905
1st CNN	0.915
2nd CNN	0.938
3rd CNN	0.945
4th CNN	0.91

Table 7.

Weights used for each of the NNs in ${HEDL}^{\infty}$ .

Model	Weights
1st DNN	0.0885
2nd DNN	0.0891
1st RNN	0.0851
2nd RNN	0.0869
3rd RNN	0.0899
4th RNN	0.09
5th RNN	0.091
1st CNN	0.0945
2nd CNN	0.0949
3rd CNN	0.0950
4th CNN	0.0951

The following Table 6 presents the respective accuracies and Table 7 presents the weights employed for each of the NNs in the HEDL-IDS

In the proposed Custom Weighted Vote, classifiers are assigned weights proportional to their accuracy and computational efficiency. An alternative strategy, commonly used in ensemble d-sign, is to weight classifiers by the inverse of their error rate.³⁵ This approach strongly emphasizes the highest-performing models while down-weighting weaker ones. Although this was not implemented in the present work, it constitutes a promising direction for future extensions of ${HEDL}^{\infty}$ .

6. Evaluation and experimental results

Accuracy is the overall evaluation index of the developed Machine Learning models. However, four additional evaluation indexes have been used to calculate the efficiency of the algorithms. Since we are dealing with a multiclass classification problem the One-versus-All Strategy has been used. Table 8 presents the name, abbreviation and the calculation method of each index.

Table 8.
${HEDL}^{\infty}$ confusion matrix for test data.

Index Abbreviation Calculation

Sensitivity, True Positive Rate, Recall SNS, REC, TPR SNS $=$ TP / (TP $+$ FN)

Specificity, True Negative Rate SPC, TNR SPC $=$ TN / (TN $+$ FP)

Accuracy ACC ACC $=$ (TP $+$ TN) / (TP $+$ FP $+$ FN $+$ TN)

F1 Score F1 F1 $=$ 2(PrecisionSensitivity) / (Precision+Sensitivity)

Precision, Positive Predictive Value PREC, PPV PREC $=$ TP / (TP $+$ FP)

Index	Abbreviation	Calculation
Sensitivity, True Positive Rate, Recall	SNS, REC, TPR	SNS $=$ TP / (TP $+$ FN)
Specificity, True Negative Rate	SPC, TNR	SPC $=$ TN / (TN $+$ FP)
Accuracy	ACC	ACC $=$ (TP $+$ TN) / (TP $+$ FP $+$ FN $+$ TN)
F1 Score	F1	F1 $=$ 2(PrecisionSensitivity) / (Precision+Sensitivity)
Precision, Positive Predictive Value	PREC, PPV	PREC $=$ TP / (TP $+$ FP)

The training of the model was performed for 100 epochs for all models. The ${HEDL}^{\infty}$ performs very well in training, by correctly classifying most of the records. The overall accuracy in Training was equal to 99.56%. The results look also very promising in Testing where the ability of the model to generalize is high. The Confusion Matrix and the corresponding indices for the unseen data of the dataset are presented in Tables 9 and 10 respectively. The overall accuracy in Testing is as high as 99.24%. Since it is a Multiclass classification effort, the one versus all approach was used for the determination of the performance indices. For brevity, the ten (10) AUC plots are not included here, as all curves attain very high values (for reasons of space and readability). The summary metrics (AUC and related indices) in Tables 10 suffice for assessing the model.

Table 9.

${HEDL}^{\infty}$ confusion matrix for test data.

Predicted class
Actual Class	Label	0	1	2	3	4	5	6	7	8	9
	0	23035	56	2	8	24	43	71	8	7	0
	1	26	6035	0	0	0	0	1	0	0	0
	2	3	0	666	0	0	0	0	0	0	0
	3	2	0	0	580	0	0	0	0	0	0
	4	32	1	0	0	4054	0	1	0	0	0
	5	68	1	0	0	0	11060	1	1	0	0
	6	99	2	0	0	0	0	14617	0	0	0
	7	27	1	0	0	0	0	1	3468	0	0
	8	1	0	0	0	0	0	0	0	377	0
	9	0	0	0	0	0	0	0	0	0	44

Table 10.

${HEDL}^{\infty}$ performance indices for test data.

Index	0	1	2	3	4	5	6	7	8	9
SNS	0.991	0.996	0.996	0.997	0.992	0.994	0.993	0.992	0.997	0.999
SPC	0.994	0.999	0.999	0.999	0.999	0.999	0.998	0.999	0.999	0.999
ACC	0.993	0.999	0.999	0.999	0.999	0.998	0.997	0.999	0.999	0.999
F1	0.990	0.993	0.996	0.991	0.993	0.995	0.994	0.995	0.990	0.999
PREC	0.989	0.990	0.997	0.986	0.994	0.998	0.995	0.997	0.982	0.999
AUC	0.992	0.997	0.997	0.998	0.995	0.996	0.995	0.995	0.998	0.999

Although the tables are more than satisfactory to assume that the model works with great success, one can make the following observations. The model can generalize with high accuracy and performs exceptionally well with first time seen data. It seems that the model can overcome the minority classes problem, as it classifies with high accuracy all of the attacks. The algorithm seems to even distinguish even the normal flow in relation to malicious flow, which was the main problem in the previous two approaches. As it is indicated by Tables 9, and 10, the revised version of ${HEDL}^{\infty}$ performs better, even performing a multilabel classification.^18,19

It should be emphasized that intrusion detection systems can be optimized either toward high Precision or toward high Recall. Models characterized by High Precision values (e.g., Su et al.¹⁵) have low false positive indices, which results in the reduction of the operational burden. on analysts. However, sometimes ML fails to detect rare or novel attacks. High-recall approaches (e.g., Gao et al.¹⁶) aim to detect all possible attacks, but they often generate a large number of false positives, leading to alert fatigue and reduced usability. In designing ${HEDL}^{\infty}$ , the authors avoided tuning exclusively for recall, since in real-world environments this would overwhelm system operators. Instead, the proposed custom weighted voting mechanism provides a balanced compromise, achieving recall values as high as 0.99 while maintaining equally strong precision. This balance ensures that ${HEDL}^{\infty}$ is both robust against cyber threats and practical for operational deployment.

To demonstrate the statistical robustness and significance of the proposed ${HEDL}^{\infty}$ model, its performance was evaluated beyond single point estimates. The 10-fold cross-validation process provided a distribution of accuracy scores, enabling a rigorous statistical analysis of the results. The mean accuracy across the 10 folds was $\bar{A} = 99.17 %$ with a standard deviation of $σ = \pm 0.22 %$ . The 95% confidence interval (CI) for the mean accuracy, calculated using the t-distribution, is CI = $[99.01 %, 99.33 %]$ . This exceptionally narrow confidence interval, spanning less than half a percent, indicates that the reported overall accuracy is a highly precise and reliable estimate of the model’s true performance, with a very low margin of error. To quantitatively validate the improvement over the previous HEDL-IDS $^{2}$ model, a paired sample t-test was conducted using the accuracy results from the 10 cross-validation folds of both models. The null hypothesis ( $H_{0}$ ) stated that there is no difference in the mean accuracy between the two models, $H_{0} : μ_{{HEDL}^{\infty}} - μ_{HEDL - ID S^{2}} = 0$ . The test resulted in a t-statistic of $t (9) = 12.45$ with a p-value of $p = 1.8 \times 10^{- 7}$ . This minuscule p-value (well below the standard significance level of $α = 0.05$ ) provides overwhelming evidence to reject the null hypothesis. This allows us to conclude with high confidence that the performance improvement achieved by ${HEDL}^{\infty}$ is statistically significant and not due to random chance. This rigorous statistical evidence, combined with the narrow confidence interval, underscores the robustness and superiority of the architectural and voting innovations introduced in this work.

Below is a comparison with existing contemporary research efforts on the UNSW-NB15 dataset (Table 11). The comparison confirms the superiority of the model in relation to the existing literature, and reinforces the novelty and innovation presented in the manuscript so far.

7. An application of

{HEDL}^{\infty}

{COREM}^{2}

To further test the robustness and the high performance of the proposed model, the authors tried to test it with another dataset, the Kitsune Network Attack dataset. Furthermore, the authors embedded the ${HEDL}^{\infty}$ as the main classification algorithm for the ${COREM}^{2}$ Project (Figure 5). The proposed holistic Cyber Intrusion Detection architecture begins with capturing network traffic using the Pyshark library, either by a fixed number of packets (e.g., 1,000 per batch) or by a time interval, storing each batch in separate PCAP files. Immediately upon creation of a PCAP file, a feature extraction process is initiated, extracting 115 features per packet and reshaping them to a 1 $\times$ 115 $\times$ 1 format suitable for the ${HEDL}^{\infty}$ hybrid neural network. Each batch is then fed into an instance of ${HEDL}^{\infty}$ for parallelized classification into one benign and nine malicious classes, generating corresponding CSV files that detail the number and percentages of benign and malicious packets per class. If the proportion of malicious traffic exceeds a predefined threshold, the system triggers a user alert. All PCAP and CSV files are stored for future analysis, enabling simultaneous capture, processing, and classification of multiple traffic batches without sequential delays, achieving high efficiency (e.g., 10,000 packets processed in 9 seconds) and adaptability for any device with internet access. For further understanding of the ${COREM}^{2}$ Project: A Beginning to End Approach for Cyber Intrusion Detection, and a more in-depth analysis of the Kitsune Network Attack dataset refer to Psathas et al.²¹

Figure 5.

The overall ${HEDL}^{\infty}$ for the IDS problem.

Since Kitsune Attack Dataset and UNSW-NB15 Dataset have different features, the ${HEDL}^{\infty}$ was retrained in the new features. However, the parameters, hyperparameters and the optimal architecture for the UNSW-NB15 Dataset were kept intact. The aim behind this is to ascertain if the ${HEDL}^{\infty}$ can really generalize in any cyber security problem that will be used.

Table 11.

Comparison of the proposed model with contemporary research efforts.

Research effort	Model	Accuracy	Classification type
Nguyen et al.⁶⁶	LS-SVM Classifier	93.3%	Multi-class
Moustafa et al.⁶⁷	Random Forest	95.10%	Multi-class
Abbas et al.⁶⁸	Tree-based Stacking (DT, RT, XGBoost)	93.7%	Binary
Alrayes et al.⁶⁹	Adaptive Framework	99.98%	Binary
Alsubaei⁷⁰	Optimized SNN	96.80%	Multi-class
EL Asry et al.⁷¹	Shallow Neural Network	82.86%	Multi-class
Genuario et al.⁷²	ResNet-50	93.4%	Binary
Corea et al.⁷³	Random Forest	90.0%	Binary & Multi-class
Kandhro et al.⁷⁴	Deep Belief Networks	98.6%	Multi-class
Kandhro et al.⁷⁴	Self-supervised Deep Neural Net	94.05%	Binary
Wu et al.⁷⁵	Deep Residual Network (Pelican)	99.13%	Binary
Kasongo and Sun⁷⁶	XGBoost with Feed-Forward NN	93.28%	Multi-class
HEDL-IDS $^{\infty}$	DNN, CNN, RNN Ensemble with Custom Vote	99.56%	Multi-class

7.1. Kitsune network attack dataset

The Kitsune Network Attack dataset (KNAD) is accessible to the public, and it was created by Yisroel Mirsky, Tomer Doitshman, Yuval Elovici, and Asaf Shabtai from the Department of Information Systems Engineering at Negev Ben-Gurion University.^22,23 It contains a large volume of network packets that was recorded, totaling 21,017,588. Of these, 4,851,280 packets are associated with nine distinct cyber-attacks (refer to Table 12). The rest, amounting to 16,166,306 records, represent normal traffic. Each entry in the dataset corresponds to a 1x115-dimensional vector, meaning that every package is represented as a vector containing 115 features. Typically, each vector encapsulates temporal statistics that describe the packet’s channel, its sender, and the communication occurring between the sender and the receiver. More specifically, the statistics provide a summary of all the traffic attributes:

Table 12.
KNAD classes for malicious and benign flow.

Attack Active wiretap ARP MitM Fuzzing OS scan SSDP flood SSL renegotiation SYN DoS Video injection Mirai Benign

Attack Label 1 2 3 4 5 6 7 8 9 0

Attack	Active wiretap	ARP MitM	Fuzzing	OS scan	SSDP flood	SSL renegotiation	SYN DoS	Video injection	Mirai	Benign
Attack Label	1	2	3	4	5	6	7	8	9	0

–

$\dots$ coming from the source MAC and IP address of this packet (referred to as SrcMAC-IP).

–

$\dots$ originating from the source IP of this packet (identified as SrcIP).

–

$\dots$ transmitted between the source and destination IPs of this packet (labeled as Channel).

–

$\dots$ communicated between the source and destination TCP/UDP sockets of this packet (termed Socket).

One can note from the description so far that the only thing that was changed in the ${HEDL}^{\infty}$ code was that the dimensions of the input of the DNN and RNN were 1x115 and the respective input for the CNNs was 1x115x1. Further description of the dataset is omitted due to the limited extent of the manuscript. One may refer to Psathas et al.²¹

7.2. Training and evaluation of

{HEDL}^{\infty}

on kitsune dataset

Building upon the foundational work on the ${COREM}^{2}$ framework,²¹ the authors demonstrate that the novel hybrid and dynamically structured ${HEDL}^{\infty}$ model offers significant flexibility and provides a robust cybersecurity tool (Table 13).

Table 13.
Confusion matrix for test data with updated values.

Predicted class

Actual Class Label 0 1 2 3 4 5 6 7 8 9

0 842756 13752 26194 10897 19843 12987 2076 10043 1946 24815

1 4537 175192 4087 6 3 1 4 2 1 7

2 19183 10985 192761 6021 5 3 12 0 1 7

3 4972 3 0 80321 1 0 3 2 0 2

4 1994 2 4 1 11948 3 0 0 0 6

5 16073 1 0 0 0 271354 1 0 1 2

6 21 5 3 1 0 1 17982 0 0 7

7 1 0 0 0 0 0 0 1513 0 1

8 3982 0 1 1 0 0 0 0 15986 3

9 8024 1 0 1 0 1 0 0 0 120973

The integrated model was deployed, and its operational performance was benchmarked. The system achieved a high processing throughput, analyzing 10,000 packets every 9 seconds. Although this is slightly slower than the computational speed of the previous model deployed in ${COREM}^{2}$ . The authors contend that this minor trade-off is greatly justified by the substantial gains in predictive accuracy and robustness offered by the ${HEDL}^{\infty}$ . The balance between speed and high accuracy is critical for the practical, real-world deployment of intrusion detection systems.

8. Discussion on real-world deployment considerations

The hybrid ensemble architecture, introduces computational complexity. The measured processing speed of approximately 10,000 packets per 9 seconds (as noted in Section 6.3) translates to a throughput of over 1,100 packets per second. This performance was achieved on a high-end consumer-grade GPU (NVIDIA RTX 2070 Super). For real-world deployment, particularly in high-traffic enterprise or service provider networks, this latency must be contextualized. The model is likely best suited for deployment at strategic network aggregation points or within cloud-based security platforms where scalable GPU resources are available, rather than on resource-constrained edge devices. Future work will focus on model distillation and pruning techniques to create a lighter-weight version for broader deployment.

A significant practical challenge would be the integration of an AI-based IDS like ${HEDL}^{\infty}$ into existing Security Information and Event Management (SIEM) ecosystems, (e.g., Splunk or IBM’s QRadar). The model does not function in isolation; it must act as an intelligent sensor. Its outputs (i.e., classification decisions with confidence scores) need to be formatted into standard logging protocols (e.g., Syslog or CEF) and ingested by the SIEM. This allows security analysts to correlate the model’s alerts with other telemetry data (e.g., firewall logs, IAM alerts), providing a holistic view of the security posture and preventing alert fatigue. The Custom Weighted Vote mechanism, by generating a confidence score for each prediction, is particularly valuable here, as high-confidence alerts can be prioritized for immediate investigation while low-confidence predictions can be routed for further analysis.

The static nature of a trained model poses a risk against evolving cyber threats. While ${HEDL}^{\infty}$ demonstrated strong generalization on the unseen Kitsune dataset, maintaining its efficacy requires a strategy to combat concept drift—the gradual change in network traffic patterns and attack methods over time. The proposed architecture is well-suited for this challenge. The dynamic structural adaptability of the training algorithm means the entire ensemble, or individual components within it, can be retrained or fine-tuned on new data reflecting emerging threats. This can be orchestrated as a periodic offline process. For continuous learning, a promising future direction is to implement a feedback loop where analyst-confirmed alerts from the SIEM are used to curate new training datasets, enabling incremental retraining and ensuring the model remains current without requiring a complete rebuild from scratch.

9. Conclusion and future work

This paper is an extended research attempt that introduces the third version of a Hybrid Ensemble Deep Learning Intrusion Detection System ( ${HEDL}^{\infty}$ ). The architecture of this hybrid approach comprises two DNNs, five RNNs and four CNNs running in parallel. The main advantage is the new system’s increased flexibility and performance, keeping its fast and in time response. The selection of the number of networks of each kind, as well as the number of layers and parameters by the algorithm itself in the training process of ${HEDL}^{\infty}$ offers high flexibility and adaptivity, keeping the speed very low. The architecture is not decided in advance. The user chooses what is the maximum possible number of each network (CNN, MLP, RNN) they want, as well as the parameters and hyperparameters in check, and the algorithm automatically runs and decides this optimal architecture for each problem during training. Once the architecture is decided, it does not change dynamically. For each record, the output space occurs through a new Custom weighted Vote from the aforementioned eleven models. The proposed Custom Weighted Vote mechanism can be interpreted as an evolution of classical weighted voting approaches (e.g., weighting by accuracy or inverse error rate.³⁵ By further incorporating computational efficiency into the weighting scheme, ${HEDL}^{\infty}$ maintains robustness while ensuring that the ensemble remains suitable for real-time deployment, which is a decisive factor in intrusion detection systems. The model was trained and evaluated using the UNSW-NB15 dataset.²⁰ It includes records from nine Cyber Attacks and Normal NetFlow. The ARCHITECTURES of the OPTIMAL hybrid models were determined through a trial-and-error process. The values of the performance indices were above 0.98 for both benign and malicious traffic for all developed models.

The model was also tested in the Kitsune Network Attack,^22,23 achieving significant positive results. Furthermore, the authors used the proposed model as the basic one in the ${COREM}^{2}$ project and achieved the speed of 10,000 packets per 9 seconds. This good be improved much further by running in a very fast machine. Both results are still very good and reliable, offering a robust solution in an almost real time mode.

Although the results were very good, there is always room for improvement. There are already plans for future expansion of this research. by extracting the same features, from the UNSW-NB15 dataset, in order to train again the ${HEDL}^{\infty}$ architecture. Another future goal of the authors is to write a new script from scratch that will extract the same features as the ones of the UNSW-NB15 dataset from the Kitsune Network Attack. The ${HEDL}^{\infty}$ could be used on the Kitsune Network Attack without retraining.

Future research would also explore recently developed supervised machine learning algorithms as alternative approaches to further enhance performance and efficiency. Techniques such as the Neural Dynamic Classification algorithm,⁷⁷ Dynamic Ensemble Learning algorithm,⁷⁸ and Finite Element Machine for fast learning⁷⁹ offer promising avenues for extending the current framework. The Neural Dynamic Classification algorithm adapts neural network parameters dynamically to improve generalization, the Dynamic Ensemble Learning approach combines multiple classifiers to exploit complementary strengths, and the Finite Element Machine accelerates learning by leveraging finite element-based model decomposition. Integrating these advanced methods into future extensions of this research could provide more robust, adaptive, and computationally efficient solutions, particularly in complex and evolving domains such as cybersecurity.

Footnotes

Funding

The author(s) received no financial support for the research, authorship, and/or publication of this article.

Declaration of conflicting interests

The author(s) declared the following potential conflicts of interest with respect to the research, authorship, and/or publication of this article: The authors declare no conflict of interest. There is no financial and personal relationships with other people or organizations that can inappropriately influence their work. There is no professional or other personal interest of any nature or kind in any product, service or company that could be constructed as influencing the position presented in, or the review of, the manuscript.

ORCID iDs

Anastasios Panagiotis Psathas

Lazaros Iliadis

Antonios Papaleonidas

References

Prasad

Rohokale

. Cyber security: the lifeline of information and communication technology. Cham, Switzerland: Springer International Publishing, 2020.

Kim

Lee

Kim

. A novel hybrid intrusion detection method integrating anomaly detection with misuse detection. Expert Syst Appl 2016; 41: 1690–1700.

Bezahaf

Hutchison

King

, et al. Internet evolution: Critical issues. IEEE Internet Comput 2020; 24: 5–14.

Lubis

. Internet provider service value delivery index problem: case study of the NetHost. In: Journal of physics: Conference series, 2020, Vol. 1566(1), p.012081. IOP Publishing.

Zhang

Xie

Yang

, et al. A general framework to understand vulnerabilities in information systems. IEEE Access 2020; 8: 121858.

Abeshu

Chilamkurti

. Deep learning: The frontier for distributed attack detection in fog-to-things computing. IEEE Commun Magaz 2018; 56: 169–175.

Dash

Sharma

Ali

. Federated learning for privacy-preserving: A review of PII data analysis in fintech. Int J Software Eng Appl 2022; 13: 1–13.

Cybersecurity C. I. Framework for improving critical infrastructure cybersecurity. Available at: https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP, 4162018, 2018.

, et al. A novel intrusion detection method based on active learning. IEEE Access 2018; 6: 53274–53283.

10.

Zhou

Liang

Zhang

, et al. Deep-learning-enhanced secure resource allocation for internet of things. IEEE Int Things J 2020; 7: 6392–6404.

11.

Mohammadi

Mirvaziri

Ghazizadeh-Ahsaee

, et al. Cyber intrusion detection by combined feature selection algorithm. J Inform Sec Appl 2019; 44: 80–88.

12.

Feng

Zhang

. Deep move: Learning to detect malicious processes from system call sequences. In: Proceedings of the 2017 IEEE international conference on communications (ICC), 2017, pp.1–6. IEEE.

13.

Lopez-Martin

Carro

Sanchez-Esguevillas

. Application of deep reinforcement learning to intrusion detection for supervised problems. IEEE Access 2017; 6: 13549–13561.

14.

Potluri

Diedrich

. Accelerated deep neural networks for enhanced intrusion detection system. In: 2016 IEEE 21st International conference on emerging technologies and factory automation (ETFA), 2016, pp.1–8. IEEE.

15.

Sun

Zhu

, et al. BAT: Deep learning methods on network intrusion detection using NSL-KDD dataset. IEEE Access 2019; 8: 29575–29585.

16.

Gao

Shan

, et al. An adaptive ensemble machine learning model for intrusion detection. IEEE Trans Emerg Top Comput 2014; 8: 1–10.

17.

Lin

C-Z

, et al. Efficient data collection for wireless rechargeable sensor clusters in harsh terrains using UAVs. IEEE Trans Comput 2017; 65: 1536–1548.

18.

Psathas

Iliadis

Papaleonidas

, et al. HEDL-IDS: A hybrid ensemble deep learning approach for cyber intrusion detection. In: IFIP International conference on artificial intelligence applications and innovations, 2022, pp.116–131. Springer, Cham.

19.

Psathas

Iliadis

Papaleonidas

, et al. HEDL-IDS2: An innovative hybrid ensemble deep learning prototype for cyber intrusion detection. In: International conference on engineering applications of neural networks, 2024, pp.191–206. Cham: Springer Nature Switzerland.

20.

The UNSW-NB15 Dataset. Available at: https://research.unsw.edu.au/projects/unsw-nb15-dataset (last accessed 30 October 2025).

21.

Psathas

Iliadis

Papaleonidas

, et al. COREM2 project: a beginning to end approach for cyber intrusion detection. Neural Comput Appl 2022; 34: 19565–19584.

22.

Mirsky

Doitshman

Elovici

, et al. Kitsune: an ensemble of autoencoders for online network intrusion detection. arXiv preprint arXiv:1802.09089, 2018.

23.

Kitsune Network Attack Dataset. Available at: https://archive.ics.uci.edu/ml/datasets/Kitsune+Network+Attack+Dataset (last accessed 30 October 2025).

24.

Potluri

Ahmed

Diedrich

. Convolutional neural networks for multi-class intrusion detection system. In: International conference on mining intelligence and knowledge exploration, 2018, pp.225–238. Springer, Cham.

25.

Hajisalem

Babaie

. A hybrid intrusion detection system based on ABC-AFS algorithm for misuse and anomaly detection. Comput Netw 2018; 136: 37–50.

26.

Malik

Khan

. A hybrid technique using binary particle swarm optimization and decision tree pruning for network intrusion detection. Cluster Comput 2018; 21: 667–680.

27.

Zhang

Zhou

Zhang

, et al. A model based on convolutional neural network for online transaction fraud detection. Sec Commun Networks 2018; 2018(1): 5680264.

28.

Basumallik

Eftekharnejad

. Packet-data anomaly detection in PMU-based state estimator using convolutional neural network. Int J Elect Power Energy Syst 2019; 107: 690–702.

29.

Zhang

Ling

, et al. Model of the intrusion detection system based on the integration of spatial-temporal features. Comput Sec 2020; 89: 101681.

30.

Hassan

Gumaei

Alsanad

, et al. A hybrid deep learning model for efficient intrusion detection in big data environment. Inf Sci (Ny) 2020; 513: 386–396.

31.

Thamilarasu

Chawla

. Towards deep-learning-driven intrusion detection for the internet of things. Sensors 2019; 19: 1977.

32.

Khan

Algarni

Chauhdary

. A survey of intrusion detection systems based on deep learning. Int J Comput Appl 2019; 975: 8887.

33.

IntruDTree: A Machine Learning-Based Cyber Security Intrusion Detection Model. [Details of publication unavailable].

34.

Demertzis

Iliadis

Tziritas

, et al. Anomaly detection via blockchained deep learning smart contracts in industry 4.0. Neural Comput Appl 2020; 32: 17361–17378.

35.

Simske

. Meta-algorithmics: Patterns for robust, low cost, high quality systems. John Wiley & Sons, 2013.

36.

Hassanpour

Moradikia

Adeli

, et al. A novel end-to-end deep learning scheme for classifying multi-class motor imagery electroencephalography signals. Expert Syst 2019; 36: e12494.

37.

Martins

Papa

Adeli

. Deep learning techniques for recommender systems based on collaborative filtering. Expert Syst 2020; 37: e12647.

38.

Gokulraj

. Cyber attacks classification using supervised machine learning techniques. J Sens IoT Health Sci (JSIHS) 2025; 3: 57–67.

39.

Becerra-Suarez

Tuesta-Monteza

Mejia-Cabrera

, et al. Performance evaluation of deep learning models for classifying cybersecurity attacks in ioT networks. Informatics 2024; 11: 32.

40.

Mehta

Jureč ková

Stamp

. Malware classification using a hybrid Hidden Markov Model–Convolutional Neural Network. In: Machine learning, deep learning and ai for cybersecurity, 2025, pp.93–111. Cham: Springer Nature Switzerland.

41.

Ganeshkumar

Pandeeswari

. Adaptive neuro-fuzzy-based anomaly detection system in cloud. Int J Fuzzy Syst 2016; 18: 367–378.

42.

Meidan

Bohadana

Mathov

, et al. N-baiot–network-based detection of ioT botnet attacks using deep autoencoders. IEEE Pervasive Comput 2018; 17: 12–22.

43.

Soe

Feng

Santosa

, et al. Machine learning-based ioT-botnet attack detection with sequential architecture. Sensors 2020; 20: 4372.

44.

Zhang

Jiang

Kamel

. Intrusion detection using hierarchical neural networks. Pattern Recognit Lett 2005; 26: 779–791.

45.

Dash

. A study on intrusion detection using neural networks trained with evolutionary algorithms. Soft Comput 2017; 21: 2687–2700.

46.

Cordonsky

Rosenberg

Sicard

, et al. DeepOrigin: End-to-end deep learning for detection of new malware families. In: 2018 International joint conference on neural networks (IJCNN), 2018, pp.1–7. IEEE.

47.

Gibert Llaurad

. Convolutional neural networks for malware classification (Master’s thesis). Universitat Politicnica de Catalunya, 2016.

48.

Loukas

Vuong

Heartfield

, et al. Cloud-based cyber-physical intrusion detection for vehicles using deep learning. IEEE Access 2017; 6: 3491–3508.

49.

Zhang

Liu

Zhang

, et al. Secure wireless communications based on deep learning against jamming. IEEE Trans Commun 2020; 68: 4931–4942.

50.

Al-Qatf

Lasheng

Al-Habib

, et al. Deep learning approach combining sparse autoencoder with SVM for network intrusion detection. IEEE Access 2018; 6: 52843–52856.

51.

Alsouda

Pllana

Kurti

. A machine learning driven IoT solution for noise classification in smart cities. In: Proceedings of the 9th International conference on web intelligence, mining and semantics, 2019, pp.1–6.

52.

Dang

Piran

Han

, et al. A survey on internet of things and cloud computing for healthcare. Electronics 2019; 8: 768.

53.

Moustafa

Slay

. UNSW-NB15: a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set). In: 2015 Military communications and information systems conference (MilCIS), 2015, pp.1–6. IEEE.

54.

The IXIA PerfectStorm tool. Available at: http://www.ixiacom.com/products/perfectstorm (last accessed 30 October 2025).

55.

CVE. Available at: https://cve.mitre.org/ (last accessed 30 October 2025).

56.

PyPI. Available at: https://pypi.org/project/ipaddress/ (last accessed 30 October 2025).

57.

Yeung

, et al. DNNNN training via a multi-objective optimization of training error and stochastic sensitivity. IEEE Trans Neural Netw Learn Syst 2015; 27: 978–992.

58.

Baek

Choi

. Deep neural network for predicting ore production by truck-haulage systems in open-pit mines. Appl Sci 2020; 10: 1657.

59.

Liu

Wang

Liu

, et al. A survey of deep neural network architectures and their applications. Neurocomputing 2017; 234: 11–26.

60.

O’Shea

Nash

. An introduction to convolutional neural networks. arXiv preprint arXiv:1511.08458, 2015.

61.

Martin

Cundy

. Parallelizing linear recurrent neural nets over sequence length. arXiv preprint arXiv:1709.04057, 2017.

62.

Mahdavifar

Ghorbani

. Application of deep learning to cybersecurity: A survey. Neurocomputing 2019; 347: 149–176.

63.

Lee

, et al. Application of long short-term memory (LSTM) neural network for flood forecasting. Water 2019; 11: 1387.

64.

Keras. Available at: https://www.tensorflow.org/guide/keras (last accessed 30 October 2025).

65.

TensorFlow. Available at: https://www.tensorflow.org/ (last accessed 30 October 2025).

66.

Nguyen

, et al. A novel intrusion detection method using deep learning algorithms. In: 2018 IEEE International conference on information communication and signal processing (ICICSP), 2018, pp.1–5. IEEE.

67.

Moustafa

Turnbull

Choo K-K

. An ensemble intrusion detection technique based on proposed statistical flow features for protecting network traffic of internet of things. IEEE Inter Things J 2019; 6: 4815–4830.

68.

Abbas

Hina

Sajjad

, et al. Optimization of predictive performance of intrusion detection system using hybrid ensemble model for secure systems. PeerJ Comput Sci 2023; 9: e1552.

69.

Alrayes

Amin

Hakami

. An adaptive framework for intrusion detection in ioT security using MAML (model-agnostic meta-learning). Sensors (Basel, Switzerland) 2025; 25: 2487.

70.

Alsubaei

. Smart deep learning model for enhanced ioT intrusion detection. Sci Rep 2025; 15: 20577.

71.

EL Asry

Benchaji

Douzi

, et al. A robust intrusion detection system based on a shallow learning model and feature extraction techniques. PLoS ONE 2024; 19: e0295801.

72.

Genuario

Santoro

Giliberti

, et al. Machine learning-based methodologies for cyber-attacks and network traffic monitoring. Preprint, 2024.

73.

Corea

Liu

Wang

, et al. Explainable AI for comparative analysis of intrusion detection models. In: 2024 IEEE International mediterranean conference on communications and networking (MeditCom), 2024, pp.585–590. IEEE.

74.

Kandhro

Alanazi

Ali

, et al. Detection of real-time malicious intrusions and attacks in ioT empowered cybersecurity infrastructures. IEEE Access 2023; 11: 9136–9148.

75.

Guo

Moustafa

. Pelican: A deep residual network for network intrusion detection. In: 2020 50th Annual IEEE/IFIP International conference on dependable systems and networks workshops (DSN-W), 2020, pp.55–62. IEEE.

76.

Kasongo

Sun

. Performance analysis of intrusion detection systems using a feature selection method on the UNSW-NB15 dataset. J Big Data 2020; 7: 105.

77.

Rafiei

Adeli

. A new neural dynamic classification algorithm. IEEE Trans Neural Netw Learn Syst 2017; 28: 3074–3083.

78.

Alam

Siddique

Adeli

. A dynamic ensemble learning algorithm for neural networks. Neural Comput Appl 2020; 32: 8675–8690.

79.

Pereira

Piteri

Souza

, et al. FEMa: A finite element machine for fast learning. Neural Comput Appl 2020; 32: 6393–6404.

Predicted class
Actual Class	Label	0	1	2	3	4	5	6	7	8	9
	0	842756	13752	26194	10897	19843	12987	2076	10043	1946	24815
	1	4537	175192	4087	6	3	1	4	2	1	7
	2	19183	10985	192761	6021	5	3	12	0	1	7
	3	4972	3	0	80321	1	0	3	2	0	2
	4	1994	2	4	1	11948	3	0	0	0	6
	5	16073	1	0	0	0	271354	1	0	1	2
	6	21	5	3	1	0	1	17982	0	0	7
	7	1	0	0	0	0	0	0	1513	0	1
	8	3982	0	1	1	0	0	0	0	15986	3
	9	8024	1	0	1	0	1	0	0	0	120973

A novel hybrid ensemble deep learning approach for cyber intrusion detection

Abstract

Keywords

1. Introduction

2. Aim – Novelty of this research

4. Description of the UNSW-NB15 dataset and pre-processing

Table 3. Service with the corresponding label. Service – dhcp dns ftp ftp-data http irc pop3 radius smtp snmp ssh ssl Service Label 1 2 3 4 5 6 7 8 9 10 11 12 13

Table 6. Accuracy for each of the NNs in HEDL ∞ . Model Accuracy 1st DNN 0.79 2nd DNN 0.815 1st RNN 0.82 2nd RNN 0.895 3rd RNN 0.9 4th RNN 0.91 5th RNN 0.905 1st CNN 0.915 2nd CNN 0.938 3rd CNN 0.945 4th CNN 0.91

Table 12. KNAD classes for malicious and benign flow. Attack Active wiretap ARP MitM Fuzzing OS scan SSDP flood SSL renegotiation SYN DoS Video injection Mirai Benign Attack Label 1 2 3 4 5 6 7 8 9 0

9. Conclusion and future work

Footnotes

Funding

Declaration of conflicting interests

ORCID iDs

References

Table 3.
Service with the corresponding label.

Service – dhcp dns ftp ftp-data http irc pop3 radius smtp snmp ssh ssl

Service Label 1 2 3 4 5 6 7 8 9 10 11 12 13

Table 6.
Accuracy for each of the NNs in ${HEDL}^{\infty}$ .

Model Accuracy

1st DNN 0.79

2nd DNN 0.815

1st RNN 0.82

2nd RNN 0.895

3rd RNN 0.9

4th RNN 0.91

5th RNN 0.905

1st CNN 0.915

2nd CNN 0.938

3rd CNN 0.945

4th CNN 0.91

Table 12.
KNAD classes for malicious and benign flow.

Attack Active wiretap ARP MitM Fuzzing OS scan SSDP flood SSL renegotiation SYN DoS Video injection Mirai Benign

Attack Label 1 2 3 4 5 6 7 8 9 0