HAMC-ID: hybrid attention-based meta-classifier for intrusion detection.

Area of Science:

• Cybersecurity
• Machine Learning
• Network Intrusion Detection

Background:

• Traditional Intrusion Detection Systems (IDS) struggle with flexibility and accuracy due to increasing cyber threats.
• The complexity of modern networks necessitates advanced detection mechanisms.

Purpose of the Study:

• To propose a novel two-level stacking ensemble framework, HAMC-ID, for enhanced intrusion detection.
• To improve the accuracy, precision, recall, and F1-score of intrusion detection systems.

Main Methods:

• Developed a two-level stacking ensemble framework (HAMC-ID).
• Utilized heterogeneous base classifiers (Extreme Gradient Boosting, Extra Trees, Logistic Regression) at Level-0.
• Employed a Bidirectional Long Short-Term Memory network with attention as the meta-classifier at Level-1, integrating meta-features like logits, confidence, and entropy.

Main Results:

• HAMC-ID demonstrated superior performance over individual classifiers and traditional ensemble methods.
• Consistent improvements were observed in accuracy, precision, recall, and F1-score on UNSW-NB15 and CICIDS2017 datasets.
• The framework proved effective for both binary and multiclass classification tasks.

Conclusions:

• HAMC-ID offers a robust and versatile solution for practical cybersecurity applications.
• The proposed framework effectively addresses the limitations of traditional IDS in diverse network scenarios.