Open Access

ARTICLE

A Two-Layer Network Intrusion Detection Method Incorporating LSTM and Stacking Ensemble Learning

Jun Wang^1,2, Chaoren Ge^1,2, Yihong Li^1,2, Huimin Zhao^1,2, Qiang Fu^1,2,*, Kerang Cao^1,2, Hoekyung Jung^3,*

1 College of Computer Science and Technology, Shenyang University of Chemical Technology, Shenyang, 110142, China
2 Key Laboratory of Intelligent Technology for Chemical Process Industry of Liaoning Province, Shenyang, 110142, China
3 Computer Engineering Department, Paichai University, Daejeon, 35345, Republic of Korea

* Corresponding Authors: Hoekyung Jung. Email: ; Qiang Fu. Email:

Computers, Materials & Continua 2025, 83(3), 5129-5153. https://doi.org/10.32604/cmc.2025.062094

Received 10 December 2024; Accepted 10 March 2025; Issue published 19 May 2025

Abstract

Network Intrusion Detection System (NIDS) detection of minority class attacks is always a difficult task when dealing with attacks in complex network environments. To improve the detection capability of minority-class attacks, this study proposes an intrusion detection method based on a two-layer structure. The first layer employs a CNN-BiLSTM model incorporating an attention mechanism to classify network traffic into normal traffic, majority class attacks, and merged minority class attacks. The second layer further segments the minority class attacks through Stacking ensemble learning. The datasets are selected from the generic network dataset CIC-IDS2017, NSL-KDD, and the industrial network dataset Mississippi Gas Pipeline dataset to enhance the generalization and practical applicability of the model. Experimental results show that the proposed model achieves an overall detection accuracy of 99%, 99%, and 95% on the CIC-IDS2017, NSL-KDD, and industrial network datasets, respectively. It also significantly outperforms traditional methods in terms of detection accuracy and recall rate for minority class attacks. Compared with the single-layer deep learning model, the two-layer structure effectively reduces the false alarm rate while improving the minority-class attack detection performance. The research in this paper not only improves the adaptability of NIDS to complex network environments but also provides a new solution for minority-class attack detection in industrial network security.

---

Keywords

---