Stacknet based decision fusion classifier for network intrusion detection

• Published in: International arab journal of information technology Vol. 19; no. 3A (s); pp. 478 - 490
• Main Authors: Adekoya, Adebayo Felix, Narko Boateng, Owusu, Somanathan, Arjun Remadevi, Nti, Isaac Kofi
• Format: Journal Article
• Language: English
• Published: Zarqa, Jordan Zarqa University, Deanship of Scientific Research 2022
• ISSN: 1683-3198; 1683-3198
• DOI: 10.34028/iajit/19/3A/8

Network intrusion is a subject of great concern to a variety of stakeholders. Decision fusion (ensemble) models that combine several base learners have been widely used to enhance detection rate of unauthorised network intrusion. However, the design of such an optimal decision fusion classifier is a challenging and open problem. The Matthews Correlation Coefficient (MCC) is an effective measure for detecting associations between variables in many fields; however, very few studies have applied it in selecting weak learners to the best of the authors’ knowledge. In this paper, we propose a decision fusion model with correlation-based MCC weak learner selection technique to augment the classification performance of the decision fusion model under a StackNet strategy. Specifically, the proposed model sought to improve the association between the prediction accuracy and diversity of base classifiers. We compare our proposed model with five other ensemble models, a deep neural model and two stand-alone state-of-the-art classifiers commonly used in network intrusion detection based on accuracy, the Area Under Curve (AUC), recall, precision, F1-score and Kappa evaluation metrics. The experimental results using benchmark dataset KDDcup99 from Kaggle shows that the proposed model has a identified unauthorised network traffic at 99.8% accuracy, Extreme Gradient Boosting (Xgboost) (97.61%), Catboost (97.49%), Light Gradient Boosting Machine (LightGBM) (98.3%), Multilayer Perceptron (MLP) (97.7%), Random Forest (RF) (97.97%), Extra Trees Classifier (ET) (95.82%), Different decision (DT) (96.95%) and, K-Nearest Neighbor (KNN) (95.56), indicating that it is a more efficient and better intrusion detection system.