Hybrid bagging and boosting with SHAP based feature selection for enhanced predictive modeling in intrusion detection...

Area of Science:

• Cybersecurity
• Machine Learning
• Artificial Intelligence

Background:

• Cyber threats are increasingly sophisticated, necessitating advanced Intrusion Detection and Prevention Systems (IDPS).
• Existing IDPS models often lack the required accuracy and interpretability to combat novel threats effectively.
• Explainable AI (XAI) offers potential solutions for enhancing model transparency and performance.

Purpose of the Study:

• To improve the performance, robustness, and transparency of IDPS models.
• To introduce a novel hybrid ensemble learning method for intrusion detection.
• To leverage Explainable AI techniques, specifically Shapley Additive explanations (SHAP), for feature selection and model enhancement.

Main Methods:

• Development of a new hybrid ensemble method: Hybrid Bagging-Boosting and Boosting on Residuals.
• Systematic evaluation of various classifiers and ensemble techniques.
• Application of SHAP for feature selection to refine model performance and reduce overfitting.
• Multi-step evaluation including binary and multiclass classification, and fine-tuning.

Main Results:

• The proposed hybrid methods significantly outperformed state-of-the-art algorithms.
• Achieved a peak accuracy of 98.47% and an F1 score of 96.19%.
• SHAP-based feature selection and resampling techniques enhanced model accuracy and balanced precision/recall.

Conclusions:

• Integrating SHAP with hybrid ensemble methods substantially improves the predictive and explanatory power of IDPS.
• The developed approach addresses limitations in traditional cybersecurity models.
• This research provides a foundation for statistical innovations in IDPS performance enhancement.