Network intrusion detection and classification using machine learning predictions fusion - Prediction-level fusion model and retraining for unknown attacks

Sep 17, 2026

Network intrusion detection system (IDS) faces challenges in anomaly detection, including high false alarm rates and only average detection accuracy. This work proposes a prediction-level fusion model for intrusion detection and classification, combining machine learning techniques to improve performance. It also introduces retraining for unknown attacks to strengthen classification effectiveness. Experiments use the NSL-KDD dataset with the Konstanz information miner (KNIME) analytics platform, reporting classification accuracy up to 96.31% with fusion and retrained models.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages7

Reading Time18 min

AccessFree to download

ABSTRACT

1. INTRODUCTION

2. RELATED WORK

Network intrusion detection and classification using machine learning predictions fusion Harshitha Somashekar, Ramesh Boraiah Department of Computer Science and Engineering, Malnad College of Engineering , Affiliated to Visvesvaraya Technological University, Hassan, India Article history: Received Feb 15, 2022 Revised Mar 23, 2022 Accepted Apr 2, 2022 Keywords: Anomaly detection Intrusion detection Konstanz information miner Machine learning Network security NSL-KDD Prediction fusion Corresponding Author: The primary objective of an intrusion detection system (IDS) is to monitor the network performance and to look into any indications of malformation over the network. While providing high-security network IDS played a vital role for the past couple of years. IDS will fail to identify all types of attacks, when it comes to anomaly detection, it is often connected with a high false alarm rate with accuracy and the detection rate is very average. Recently, IDS utilize machine learning methods, because of the way that machine learning algorithms demonstrated to have the capacity of learning and adjusting as well as permitting a proper reaction for real-time data. This work proposes a prediction-level fusion model for intrusion detection and classification using machine learning techniques. This work also proposes retraining of model for unknown attacks to increase the effectiveness of classification in IDS. The experiments are carried out on the network security layer knowledge discovery in database (NSL-KDD) dataset using the Konstanz information miner (KNIME) analytics platform. The experimental results showed a classification accuracy of 90.03% for a simple model to 96.31% for fusion and re-trained models. This result inspires the researchers to use machine learning techniques with a fusion model to build IDS. This is an open access article under the CC BY-SA license. Harshitha Somashekar Department of Computer Science and Engineering, Malnad College of Engineering Affiliated to Visvesvaraya Technological University Salagame Rd, Hassan-573202, Karnataka, India Email: [sh@mcehassan.ac.in](sh@mcehassan.ac.in) Article Info ABSTRACT 1. INTRODUCTION In this current world, billions of people are connected through the internet, one who connected to the internet through a computer, mobile or any smart device, and then there will be chances of cyber-attacks. Intoday’s world, every private and public organization will have cyber security. Cyber security is a software and hardware mechanism which prevents cyber-attack [1]. The cyber-attacks are always executed to steal data, and money or to corrupt any important information. To secure the network intrusion detection system (IDS) was used. The IDS will monitor any abnormal behaviour in the network and gives the alarm and send signals to the intrusion prevention system. The two areas where IDS is most popularly studied are anomaly and signaturebased. Anomaly-based detection means if any unusual patterns occur in the network that is not the normal pattern, they will be blocked. But in signature-based networks, it will look for a particular pattern to block [2] . In anomaly-based IDS [3], the model will be designed for normal system activity or patterns and later the developed model is used to evaluate new observed activity or patterns to detect the anomaly. Whichever values are not matched with normal activity is considered an anomaly. The IDS require a very strong computational working capacity so that it can perform well in a real-time environment. The IDS should act as a barricade between the thief and normal users. A strong system will always protect the data, which is very much necessary in the current world. The problem with existing IDS is they completely dependent on one technique, if it is failed to find out the attack or is wrongly predicted then the complete system will fail. And also, for unknown attacks, the existing IDS are showing poor

FAQs

Why is anomaly detection challenging in intrusion detection systems (IDS)?

Anomaly detection often has a high false alarm rate, and accuracy and detection rate are usually only average compared with other approaches.

What does the proposed approach improve in IDS performance?

It improves performance by using a prediction-level fusion model and by retraining the model to handle unknown attacks more effectively.

Which dataset and tool are used for the experiments?

Experiments are performed on the NSL-KDD dataset using the KNIME (Konstanz information miner) analytics platform.

Sep 17, 2026

Uploaded by Emma Wilson