A HYBRID ENSEMBLE LEARNING APPROACH FOR ENTERPRISE NETWORK THREAT CLASSIFICATION

Abstract

The increased number of business networks has increased the traffic levels of the networks, which increases the susceptibility to advanced types of cyber-attacks such as Distributed Denial of Service (DDoS). The current intrusion detection systems have not had the capability to address the rising pattern attacks, therefore creating a need to employ the smart data models. The study presents a hybrid model design approach that combines the Support Vector Machine (SVM) algorithm, the Random Forest (RF) algorithm, and the Extreme Gradient Boosting (XGBoost) algorithm. The experiment study is undertaken on the CICDDoS 2019 dataset platform that supports diverse benign and DDoS network attacks. Data processing corresponded to the normalization of data, data ranking through the Information Gain values, and the application of the Synthetic Minority Over-sampling Technique (SMOTE). Each of the algorithms was individually created and evaluated through accuracy, precision, recall, F1 statistics, and AUC-ROC plots. It is clear from this study work that SVM performed best on its own with almost 99.92 % accuracy and Area Under the Curve (AUC) of 0.999 percent, outperforming RF and XG-Boost. The proposed hybrid ensemble model further enhanced these measures with 99.96 % accuracy with added strengths in terms of enhanced model generalization. This study work clearly establishes that the hybrid ensemble design of optimized traditional ML models performs efficiently and is scalable on real-time scales of enterprise network threats.