TY  - EJOU
AU  - Tamanampudi, Venkata Mohit 
AU  - Faheem, Zaid Bin 
AU  - Ali, Jehad 

TI  - Context-Aware Ensemble Learning with Adaptive Attention for High-Fidelity Network Intrusion Detection
T2  - Computers, Materials \& Continua

PY  - 
VL  - 
IS  - 
SN  - 1546-2226

AB  - Intrusion Detection Systems (IDS) are an important tool for network security, however, machine learning based IDS and single-based models often fail to be beneficial in the context of high-dimensional data, redundant features, class distributions, and flexibility when network attack patterns change. To address these drawbacks, the present paper proposes a novel ensemble learning framework called CAF-Net (Context-Aware Fusion Network), which combines bagging, stacking, an attention-driven meta-learning and a confidence-aware soft voting mechanism based on the XGBoost ensemble learning approach. Although CAF-Net uses the same base learners as traditional ensemble methods, it differs in that it assigns importance weights to the predictions of each learner that depend on the instances, and in that other factors besides the context are taken into account when fusing the decisions, such as the trustworthiness of the model. The framework uses the mutual information-based feature selection method to distinguish the characteristics of the network with the discrimination of the attributes that are not essential to the network behavior. Specifically, from the 42 original features present in the NSL-KDD dataset, mutual information scores are computed for each feature, and the top 15 features with the highest discriminative power are selected for model training. In addition, CAF-Net implements a four-stage ensemble learning framework: Stage 1 uses bagging with XGBoost to decrease prediction variance, Stage 2 applies heterogeneous stacking with KNN and LR to capture complementary local and global decision boundaries, Stage 3 performs attention-based meta-learning to compute instance-specific importance weights, and Stage 4 performs confidence-aware soft voting to fuse decisions using attention relevance and model trustworthiness. Thorough experiments of benchmark datasets like NSL-KDD and CIC-IDS2018 covering both legacy and modern networks. CAF-Net attains a state-of-the-art accuracy, precision, recall and F1-score of 99.47%, 99.47%, 99.48% and 99.47%, respectively, on NSL-KDD. The proposed framework results in high generalization on CIC-IDS2018 dataset, and with a baseline version and an ablation version, it performs better in the difficult scenario of the imbalance of classes. Ablation experiments also support that all attention-based weighting, feature selection and soft voting boost the performance. The proposed CAF-Net paradigm can successfully model complex network traffic and it is highly accurate, stable and interpretable. The scalability, desirable inference latency of 0.85 ms per sample, linear growth with the size of data sets and the small size memory requirement of 38.6 MB indicate that CAF-Net is a scalable solution with potential application in real-world intrusion detection system. Encouraging benchmark results, but further testing and validation in operational environments is important for future work.
KW  - Machine learning model; intrusion detection systems; feature selection; ensemble learning; bagging with XGBoost; model stacking

DO  - 10.32604/cmc.2026.086208