# A Novel Hierarchical Intrusion Detection System based on Decision Tree and Rules-based Models

arXiv: https://arxiv.org/abs/1812.09059 · HTML: https://mlsanity.com/paper/1812.09059/

## Key facts

- Cited by 9 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 21 Dec 2018.

## Built on by (most cited first, 9 of 9)

- [Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction](https://mlsanity.com/paper/2401.12262/) (2024)
- [Feature Selection for Network Intrusion Detection](https://mlsanity.com/paper/2411.11603/) (2024)
- [Towards Network Traffic Monitoring Using Deep Transfer Learning](https://mlsanity.com/paper/2101.00731/) (2021)
- [Robust Attack Detection Approach for IIoT Using Ensemble Classifier](https://mlsanity.com/paper/2102.01515/) (2021)
- [L-XAIDS: A LIME-based eXplainable AI framework for Intrusion Detection Systems](https://mlsanity.com/paper/2508.17244/) (2025)
- [A Novel Splitting Criterion Inspired by Geometric Mean Metric Learning for Decision Tree](https://mlsanity.com/paper/2204.11011/) (2022)
- [Harnessing the Power of Decision Trees to Detect IoT Malware](https://mlsanity.com/paper/2301.12039/) (2023)
- [A Scalable Hierarchical Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2505.16215/) (2025)
- [Categorical Robustness Assessment for Machine Learning based Network Intrusion Detection Systems](https://mlsanity.com/paper/2606.12075/) (2026)

## Abstract (arXiv)

This paper proposes a novel intrusion detection system (IDS) that combines different classifier approaches which are based on decision tree and rules-based concepts, namely, REP Tree, JRip algorithm and Forest PA. Specifically, the first and second method take as inputs features of the data set, and classify the network traffic as Attack/Benign. The third classifier uses features of the initial data set in addition to the outputs of the first and the second classifier as inputs. The experimental results obtained by analyzing the proposed IDS using the CICIDS2017 dataset, attest their superiority in terms of accuracy, detection rate, false alarm rate and time overhead as compared to state of the art existing schemes.