An Efficient Ensemble Network Anomaly Detection System for Cyber-Attacks

This paper introduces an ensemble-based network anomaly detection system that synergizes classical machine learning classifiers with dimensionality reduction to balance detection accuracy and computational efficiency. The proposed system integrates preprocessing, feature engineering, hybrid learning, and ensemble decision-making to achieve robust anomaly detection and attack classification. Five algorithms, K-Nearest Neighbor (KNN), Naïve Bayes (NB), Random Forest (RF), AdaBoost, and Gradient Boosting (GB), were evaluated both as standalone models and within a soft-voting ensemble framework. To address the high-dimensionality challenges in cybersecurity data, Principal Component Analysis (PCA) was used to retain 95% variance in features while reducing dimensionality by 54% (from 41 to 19 features), achieving a latency improvement of 38% without compromising critical attack detection. A dual-phase SMOTE strategy mitigates class imbalance, enabling 100% recall for rare U2R attacks. Extensive experiments on the KDD CUP99 benchmark demonstrate the superiority of the ensemble method, achieving 93.7% accuracy (vs. 77.7–90% for individual models). Furthermore, while GB achieved the highest individual average performance at 90%, the proposed ensemble exhibited strong performance in adversarial tests, gaining 97.1% accuracy compared to GB's 85.2% against GAN-generated attacks. These findings establish a foundation for adaptive cybersecurity systems that employ machine learning to tackle emerging adversarial defense mechanisms, highlighting accuracy and operational feasibility in evolving threat landscapes.