Jul 2026· International Research Journal of Multidisciplinary Technovation· pp. 177-194· 0 citations· 38 references
TL;DR
The hybrid intrusion detection system model of extreme gradient boosting (XGBoost) and KMeans++ clustering algorithm to balance the trade-off between accuracy, efficiency, and robustness in detecting malicious traffic is proposed.
Abstract
The Intrusion Detection Systems (IDSs) are very important tools for defending a network against emerging cyber threats. This study proposes the hybrid intrusion detection system model of extreme gradient boosting (XGBoost) and KMeans++ clustering algorithm to balance the trade-off between accuracy, efficiency, and robustness in detecting malicious traffic. XGBoost algorithms are good for structured problems where classification problems occur, whereas KMeans++ helps you to get more clustering accuracy by helping centroid initialization. For enhancing the performance of the model some feature extraction steps and data preprocessing steps like normalization, encoding, Synthetic Minority Over-sampling Technique (SMOTE) based imbalance data balancing were considered. The system was trained and validated on Canadian Institute for Cybersecurity Intrusion Detection System (CICIDS) 2017 and put to test in various metrics: accuracy, precision, recall, F1-score, ROC-AUC and false positive rate. Comparative analysis was performed using traditional machine learning models such as SVM, Decision Tree, Random Forest, Naive Bayes and deep learning architectures which include CNN, LSTM and Auto-Encoder. It was found to be high detection accuracy of 99.87% with very low FPR by far i.e. 0.1%. The model provided high recall and precision in different types of attack and successful overfitting resistance could be confirmed using 10-fold cross-validation, XGBoost regularization and structure clustering. This work shall play an important role in improving hybrid models to minimize alert fatigue with trustworthy threat classification in the real operational traffic.
With the proliferation of internet-connected infrastructures and the complexity of cyberattacks, cybersecurity and intelligent intrusion detection systems have become more and more critical. Intrusion detection datasets, however, are now highly imbalanced, and conventional machine learning models have become biased towards the majority of benign traffic, misclassifying minority attack classes. This paper introduces a Cost-Sensitive Forest (CS-Forest) approach to enhance the detection of minority attacks in the CSE-CIC-IDS2018 dataset. The proposed framework combines cost-sensitive learning, ensemble-based Random Forest classification, feature selection, and SHAP explainability analysis to boost the performance of intrusion detection and interpretability. Various machine learning algorithms such as Decision Tree, Random Forest, AdaBoost, and XGBoost were tested and compared based on accuracy, precision, recall, F1-score, ROC-AUC, false positive rate, and false negative rate. Experimental results proved that the proposed CS-Forest has excellent performance, with 99.81% accuracy, 99.55% recall, 99.61% F1-score, and 0.998 ROC-AUC, significantly enhancing the performance of minority attack detection and reduced false negatives. The framework learned meaningful and interpretable network traffic behaviors, which was also confirmed using SHAP analysis. The research suggests that future IDS systems should incorporate cost-sensitive learning and explainable AI techniques to ensure improved reliability, transparency, and deployment in the cybersecurity landscape.
The findings indicate that the RF–SVM hybrid model provides an effective and scalable solution for real-time intrusion detection in modern cybersecurity environments.
Esther J., Grace Phiri, Arockia Venice J.· International Journal of Dat...· 0 citations
New attacks are getting smarter and more sophisticated, so the old signature-based intrusion detection and prevention systems can't find them. This work proposes a machine learning approach to build a cybersecurity threat intelligence framework for effective multiclass intrusion detection, in which the Decision Tree classifier is used. The CICIDS2017 benchmark dataset, which contains both benign network traffic and several types of cyberattacks, is used to build and test the suggested model. The goal of the preparation process is to enhance classification performance by cleaning and separating data, utilizing Standard Scaler to scale features, and SMOTE to balance classes. Metrics like as recall, accuracy, precision, F1-score, confusion matrix, and ROC curve are used to test the Decision Tree model. An impressive 99.91% accuracy (ACC) rate, 97.79% precision (PRE), 97.08% recall (REC), 97.41% F1-score (F1), and 0.99 AUC were revealed by the experiment's outcomes. The suggested method beats state-of-the-art deep learning and ML approaches in terms of performance, execution time, and computational complexity. The results show that the suggested design is a reliable, efficient, and lightweight way to find cyber security threats and IDR apps with intelligence.
Madhav Sharma· International Journal of Cyb...· 0 citations
The increasing complexity of cyber threats has exposed the limitations of traditional signature-based intrusion detection systems, creating a need for intelligent and adaptive cybersecurity solutions. This study proposes an artificial intelligence-driven cybersecurity framework for enterprise threat detection using the CICIDS2017 benchmark dataset. The framework incorporates data preprocessing, feature engineering, and supervised machine learning to classify network traffic as benign or malicious. Seven machine learning algorithms, including Logistic Regression, Decision Tree, Support Vector Machine, Random Forest, Extra Trees, LightGBM, and XGBoost, were evaluated using accuracy, precision, recall, F1-score, and AUC-ROC. The results indicate that ensemble learning models outperform conventional classifiers, with XGBoost achieving the highest performance, recording 99.42% accuracy, 99.39% precision, 99.31% recall, 99.35% F1-score, and an AUC-ROC of 0.999. LightGBM also demonstrated excellent performance with lower computational time. The findings suggest that the proposed XGBoost-based framework provides an accurate, scalable, and efficient solution for real-time enterprise threat detection and can be effectivel
Sanjida Akter Tisha· The American Journal of Engi...· 0 citations
An OFLN by addition of PSO to perform automated hyperparameter optimization and MAML to enable high-speed adaptation to new and previously seen attacks is proposed, which is more effective than baseline ensemble models in detection accuracy, resistance to class imbalance and training efficiency.
