A novel parallel multi-stage architecture for network intrusion detection

As cyber threats grow in frequency and sophistication, the need for accurate and efficient intrusion detection systems has become increasingly critical. This article proposes a novel parallel multi-stage network intrusion detection system designed to improve detection accuracy, reduce training and inference time and enhance the detection of attacks. In the first stage, our architecture features two modules running in parallel: a one-class support vector machine trained solely on benign traffic for anomaly detection, and a random forest classifier trained exclusively on malicious samples for attack classification. A lightweight rule-based component in the second stage integrates the outputs of both modules using pre-defined thresholds to issue the final verdict, distinguishing between benign traffic, known attacks and previously unseen attacks (zero-day). Evaluated on the intrusion detection evaluation datasets CIC-IDS2017 and CSE-CIC-IDS2018 under a single protocol applied to both systems, the proposed approach improves balanced accuracy over the state-of-the-art at a lower inference cost, the latter driven principally by the size of the baseline's support-vector set. Ablation studies demonstrated that these thresholds, along with the rules, can be adjusted post-training to fine-tune the system's performance without requiring model retraining, offering operational flexibility.