# A Dual-Tier Adaptive One-Class Classification IDS for Emerging Cyberthreats

arXiv: https://arxiv.org/abs/2403.13010 · HTML: https://mlsanity.com/paper/2403.13010/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 6 of its 45 references that are in the map.
- First posted on arXiv 17 Mar 2024.

## Builds on (most cited first, 6 of 6)

- [Machine learning-based network intrusion detection for big and imbalanced data using oversampling, stacking feature embedding and feature extraction](https://mlsanity.com/paper/2401.12262/) (2024)
- [Machine Learning-based Lung and Colon Cancer Detection using Deep Feature Extraction and Ensemble Learning](https://mlsanity.com/paper/2206.01088/) (2022)
- [A Dependable Hybrid Machine Learning Model for Network Intrusion Detection](https://mlsanity.com/paper/2212.04546/) (2022)
- [An Adaptable Deep Learning-Based Intrusion Detection System to Zero-Day Attacks](https://mlsanity.com/paper/2108.09199/) (2021)
- [MLSTL-WSN: Machine Learning-based Intrusion Detection using SMOTETomek in WSNs](https://mlsanity.com/paper/2402.13277/) (2024)
- [Securing Transactions: A Hybrid Dependable Ensemble Machine Learning Model using IHT-LR and Grid Search](https://mlsanity.com/paper/2402.14389/) (2024)

## Built on by (most cited first, 1 of 1)

- [A Scalable Hierarchical Intrusion Detection System for Internet of Vehicles](https://mlsanity.com/paper/2505.16215/) (2025)

## Abstract (arXiv)

In today's digital age, our dependence on IoT (Internet of Things) and IIoT (Industrial IoT) systems has grown immensely, which facilitates sensitive activities such as banking transactions and personal, enterprise data, and legal document exchanges. Cyberattackers consistently exploit weak security measures and tools. The Network Intrusion Detection System (IDS) acts as a primary tool against such cyber threats. However, machine learning-based IDSs, when trained on specific attack patterns, often misclassify new emerging cyberattacks. Further, the limited availability of attack instances for training a supervised learner and the ever-evolving nature of cyber threats further complicate the matter. This emphasizes the need for an adaptable IDS framework capable of recognizing and learning from unfamiliar/unseen attacks over time. In this research, we propose a one-class classification-driven IDS system structured on two tiers. The first tier distinguishes between normal activities and attacks/threats, while the second tier determines if the detected attack is known or unknown. Within this second tier, we also embed a multi-classification mechanism coupled with a clustering algorithm. This model not only identifies unseen attacks but also uses them for retraining them by clustering unseen attacks. This enables our model to be future-proofed, capable of evolving with emerging threat patterns. Leveraging one-class classifiers (OCC) at the first level, our approach bypasses the need for attack samples, addressing data imbalance and zero-day attack concerns and OCC at the second level can effectively separate unknown attacks from the known attacks. Our methodology and evaluations indicate that the presented framework exhibits promising potential for real-world deployments.