# Ensemble Classifier Design Tuned to Dataset Characteristics for Network Intrusion Detection

arXiv: https://arxiv.org/abs/2205.06177 · HTML: https://mlsanity.com/paper/2205.06177/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 5 of its 58 references that are in the map.
- First posted on arXiv 8 May 2022.

## Builds on (most cited first, 5 of 5)

- [XGBoost: A Scalable Tree Boosting System](https://mlsanity.com/paper/1603.02754/) (2016)
- [UNSW-NB15 Computer Security Dataset: Analysis through Visualization](https://mlsanity.com/paper/2101.05067/) (2021)
- [Online User Profiling to Detect Social Bots on Twitter](https://mlsanity.com/paper/2203.05966/) (2022)
- [Artificial Intelligence-Based Image Enhancement in PET Imaging: Noise Reduction and Resolution Enhancement](https://mlsanity.com/paper/2107.13595/) (2021)
- [An Empirical Evaluation of the t-SNE Algorithm for Data Visualization in Structural Engineering](https://mlsanity.com/paper/2109.08795/) (2021)

## Abstract (arXiv)

Machine Learning-based supervised approaches require highly customized and fine-tuned methodologies to deliver outstanding performance. This paper presents a dataset-driven design and performance evaluation of a machine learning classifier for the network intrusion dataset UNSW-NB15. Analysis of the dataset suggests that it suffers from class representation imbalance and class overlap in the feature space. We employed ensemble methods using Balanced Bagging (BB), eXtreme Gradient Boosting (XGBoost), and Random Forest empowered by Hellinger Distance Decision Tree (RF-HDDT). BB and XGBoost are tuned to handle the imbalanced data, and Random Forest (RF) classifier is supplemented by the Hellinger metric to address the imbalance issue. Two new algorithms are proposed to address the class overlap issue in the dataset. These two algorithms are leveraged to help improve the performance of the testing dataset by modifying the final classification decision made by three base classifiers as part of the ensemble classifier which employs a majority vote combiner. The proposed design is evaluated for both binary and multi-category classification. Comparing the proposed model to those reported on the same dataset in the literature demonstrate that the proposed model outperforms others by a significant margin for both binary and multi-category classification cases.