Optimising intrusion detection systems: a hybrid approach with ensemble machine learning models
摘要
Intrusion Detection Systems (IDS) are vital for safeguarding modern cloud infrastructures. However, traditional IDS models often suffer from limited generalization, poor interpretability, and susceptibility to adversarial attacks. This study proposes a novel hybrid IDS framework based on a Local Interpretable Model Explanation–Attentive Adversarial Meta-Ensemble (LIME-ME) architecture. The framework integrates signature-based detection with an ensemble of diverse classifiers—Random Forest, Logistic Regression, Support Vector Machine, Naive Bayes, and Multi-layer Perceptron—trained on a base dataset. Using LIME, the system generates local feature importance vectors concatenated with the base classifiers’ outputs to create rich, interpretable meta-features. Synthetic adversarial perturbations are introduced to enhance robustness, yielding an augmented meta-feature space. A meta-learner is trained on clean and adversarial meta-features to achieve superior detection performance and resilience against evasion. Experimental evaluations on benchmark datasets, including UNSW-NB15 and CIC-IDS2017, NSL-KDD, CICDDoS2019, TestCloudIDS, and TON_IoT demonstrate that the proposed approach significantly outperforms traditional IDS models regarding accuracy, precision, and robustness while offering transparent, explainable decision-making.