All Predict Cost Efficient Decides: A New Cost-Centric Ensemble Learning Method for Network Intrusions Detection

Machine Learning (ML) techniques have gained extensive attention for network intrusion detection. However, integrating ML approaches faces two primary challenges due to the presence of multi-class attacks and their varying impact levels on the network: the one-size-fits-all dilemma and the consideration of intrusion costs. Since ML models exhibit differing detection performances for each attack class, a single ML model may not suffice for predicting all attacks. Additionally, intrusion cost, a crucial concern for users and network service providers, is often overlooked in intrusion detection scheme development. To address these challenges, we propose a novel ensemble-learning framework called All Predict Cost Efficient Decides (APCED). APCED integrates multiple ML models, selecting an expert ML model for each attack class to minimize intrusion costs. In APCED, both damage cost and response cost determine the cost-efficient base estimators for ensemble learning, with an aggregation strategy employed for final decisions. We evaluate the performance of APCED using the NSL-KDD dataset. Numerical results demonstrate that APCED enhances the overall weighted F1 score by 81.13% compared to Adaboost and achieves an overall cost reduction of 54.7% and 87% compared to XGBoost and Adaboost, respectively.