An enhanced multi-model ensemble learning architecture for robust network intrusion detection

Abstract

Accurately and in real-time identifying advanced cyber-attacks continues to be a serious challenge for modern Network Intrusion Detection Systems (NIDS), especially in situations of highly imbalanced network traffic load and large-scale network attacks. Signature-based and single-model learning methods are typically ineffecive in capturing the complexity of traffic interactions and are not generalizable to new attack patterns. To overcome these limitations, this study introduces an Enhanced Multi-Model Ensemble Network Intrusion Detection System (EME-NIDS), a deep meta-learning system that combines five different heterogeneous learning paradigms, including Convolutional Neural Networks (CNN), Dense Neural Networks, Transformers, XGBoost, and Random Forests. The probabilistic output of the base learners is then condensed into a 220-dimensional meta-feature space and further processed by a five-layer deep meta-learner with approximately 289 k trainable parameters. A large-scale network flow dataset with 703,168 instances was used to assess the learning stability and attack detection of the minority class in the presence of various attacks, with 43 attacks and one attack class (benign) in the dataset. The experimental evaluation provided a detection accuracy of 95.65% and a macro-ROC-AUC score of 99.76%, outperforming all standalone models. Moreover, the proposed framework, which provides an average inference latency of 8.4 ms is suitable for real-time intrusion detection. The robustness, scalability and practical deployment capability of the proposed EME-NIDS framework were confirmed by statistical significance analysis (McNemar’s test, p < 0.001) and ablation studies.