Optimized Weighted Soft-Voting Hybrid Ensemble for Explainable Network Intrusion Detection on UNSW-NB15 with ROC-Based Benchmarking

Abstract

Network intrusion detection systems (IDS) must separate malicious from benign traffic at very low false-alarm rates while remaining explainable and inexpensive to run. This paper presents an Optimized Weighted Soft-Voting Hybrid Ensemble (OWSVE) that fuses the class probabilities of Random Forest, CatBoost and LightGBM using weights searched to maximize weighted F1-score. On the 257,673-flow UNSW-NB15 corpus, we remove leakage-prone attributes, select 34 features by mutual information, partition the data 90/10 with stratification, apply Min-Max scaling, and balance the training data with SMOTE. On a held-out test set of 32,936 flows, OWSVE attains 96.37curacy, a Matthews correlation coefficient of 0.9274, a ROC-AUC of 0.9958 and a PR-AUC of 0.9959, exceeding each base learner (ROC-AUC 0.9947–0.9957). Compared with the ROC performance reported for a recent generative-AI-embedded HGT–LSTM–TabTransformer hybrid (AUC 0.95; 0.958 in its cross-dataset table), OWSVE raises the AUC by 0.038 and lowers the false positive rate from 0.0368 to 0.0302 while delivering a higher true positive rate (0.958 versus 0.9548), so its operating point dominates the reference in ROC space. SHAP and LIME analyses show that source load, TCP base sequence number, source packet count and duration drive decisions, giving analysts transparent evidence for each alert.

Introduction

The rapid growth of cloud, edge and Internet-of-Things infrastructure has widened the attack surface of modern networks, and adversaries are increasing both the volume and the sophistication of their attacks. Signature-based IDS cannot recognise zero-day or polymorphic threats, while anomaly-based IDS tend to raise many false alarms when legitimate traffic drifts. Machine-learning IDS trained on labelled flow records offer a practical middle path, provided that they are accurate, calibrated across operating thresholds, explainable to security analysts and fast enough for line-rate inspection.

The UNSW-NB15 data set [1], [2] is one of the most widely used benchmarks for this purpose because it combines contemporary normal traffic with nine families of synthetic attacks. Recent work has pushed accuracy upward with heavyweight hybrid deep architectures. In particular, Prabhu and Sunitha [3] fuse Heterogeneous Graph Transformer, LSTM and TabTransformer embeddings, augment minority attack classes with generative models, and classify the fused vector with XGBoost. Their system reports 95.80curacy and a ROC-AUC of 0.95 on UNSW-NB15, at the cost of a 22 min 15 s training time and a 12.4 MB model.

Conclusion

We presented OWSVE, a weighted soft-voting ensemble of Random Forest, CatBoost and LightGBM for binary intrusion detection on UNSW-NB15, built on a leakage-aware pipeline (correlation scan, 34 mutual-information features, training-only SMOTE). On a held-out set of 32,936 flows, OWSVE reaches 96.37curacy, MCC 0.9274, ROC-AUC 0.9958, PR-AUC 0.9959 and log loss 0.0848, and it surpasses each of its base learners on the main aggregate metrics. The ROC comparison with the GenAI-embedded HGT–LSTM–TabTransformer hybrid is the central result. OWSVE improves the AUC from 0.958 (0.95 in the reference’s main table) to 0.9958, reduces the false positive rate from 0.0368 to 0.0302 (−17.9%) and increases the true positive rate from 0.9548 to 0.958, so that its operating point dominates the reference in ROC space. This is achieved by a model that trains in minutes on CPU-class tree learners, reports inference at about 20 µs per sample or less, and is explained with SHAP and LIME. Future work will add validation-based weight selection, evaluation on naturally imbalanced hold-out data and on CICIDS-2017, adversarial training with FGSM/PGD, and generative augmentation of rare attack families to combine the strengths of both approaches.

References

[1] N. Moustafa and J. Slay, “UNSW-NB15: A comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set),” in Proc. Military Commun. Inf. Syst. Conf. (MilCIS), Canberra, Australia, 2015, pp. 1–6. [2] N. Moustafa and J. Slay, “The evaluation of network anomaly detection systems: Statistical analysis of the UNSW-NB15 data set and the comparison with the KDD99 data set,” Inf. Secur. J.: Glob. Perspect., vol. 25, no. 1–3, pp. 18–31, 2016. [3] A. Prabhu B.P. and N. R. Sunitha, “A hybrid artificial intelligence model for cyberattack detection using a generative AI embedded approach,” Discover Artif. Intell., vol. 6, art. 123, 2026, doi: 10.1007/s44163-026-00901-4. [4] T. Fawcett, “An introduction to ROC analysis,” Pattern Recognit. Lett., vol. 27, no. 8, pp. 861–874, 2006. [5] I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, “Toward generating a new intrusion detection dataset and intrusion traffic characterization,” in Proc. 4th Int. Conf. Inf. Syst. Secur. Privacy (ICISSP), Portugal, 2018. [6] A. Houkan et al., “Artificial intelligence approach to intrusion detection in industrial control systems with real world dataset generation and model evaluation,” Discover Artif. Intell., vol. 5, art. 307, 2025. [7] L. Breiman, “Random forests,” Mach. Learn., vol. 45, no. 1, pp. 5–32, 2001. [8] T. Chen and C. Guestrin, “XGBoost: A scalable tree boosting system,” in Proc. 22nd ACM SIGKDD Int. Conf. Knowl. Discovery Data Mining, 2016, pp. 785–794. [9] L. Prokhorenkova, G. Gusev, A. Vorobev, A. V. Dorogush, and A. Gulin, “CatBoost: Unbiased boosting with categorical features,” in Proc. Adv. Neural Inf. Process. Syst. (NeurIPS), 2018, pp. 6638–6648. [10] G. Ke et al., “LightGBM: A highly efficient gradient boosting decision tree,” in Proc. Adv. Neural Inf. Process. Syst. (NIPS), 2017, pp. 3146–3154. [11] T. G. Dietterich, “Ensemble methods in machine learning,” in Multiple Classifier Systems, LNCS 1857. Springer, 2000, pp. 1–15. [12] N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, “SMOTE: Synthetic minority over-sampling technique,” J. Artif. Intell. Res., vol. 16, pp. 321–357, 2002. [13] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proc. Int. Conf. Learn. Represent. (ICLR), 2015. [14] S. M. Lundberg and S.-I. Lee, “A unified approach to interpreting model predictions,” in Proc. Adv. Neural Inf. Process. Syst. (NIPS), 2017, pp. 4765–4774.