# An AutoML-based approach for Network Intrusion Detection

arXiv: https://arxiv.org/abs/2411.15920 · HTML: https://mlsanity.com/paper/2411.15920/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- Builds on 1 of its 33 references that are in the map.
- First posted on arXiv 24 Nov 2024.

## Builds on (most cited first, 1 of 1)

- [FLAML: A Fast and Lightweight AutoML Library](https://mlsanity.com/paper/1911.04706/) (2019)

## Built on by (most cited first, 1 of 1)

- [Evaluation of AutoML Frameworks for IDS under Imbalanced Data Conditions of the NSL-KDD Dataset](https://mlsanity.com/paper/2606.12611/) (2026)

## Abstract (arXiv)

In this paper, we present an automated machine learning (AutoML) approach for network intrusion detection, leveraging a stacked ensemble model developed using the MLJAR AutoML framework. Our methodology combines multiple machine learning algorithms, including LightGBM, CatBoost, and XGBoost, to enhance detection accuracy and robustness. By automating model selection, feature engineering, and hyperparameter tuning, our approach reduces the manual overhead typically associated with traditional machine learning methods. Extensive experimentation on the NSL-KDD dataset demonstrates that the stacked ensemble model outperforms individual models, achieving high accuracy and minimizing false positives. Our findings underscore the benefits of using AutoML for network intrusion detection, as the AutoML-driven stacked ensemble achieved the highest performance with 90% accuracy and an 89% F1 score, outperforming individual models like Random Forest (78% accuracy, 78% F1 score), XGBoost and CatBoost (both 80% accuracy, 80% F1 score), and LightGBM (78% accuracy, 78% F1 score), providing a more adaptable and efficient solution for network security applications.