A Multi-Tiered Stacking Ensemble for Network Intrusion Detection and Alert Correlation

Mohit Samant · Prof. Datta H. Deshmukh

Preprint · 2026 · manuscript in preparation

Five machine learning algorithms are benchmarked across five public intrusion detection datasets and then combined into a two-tier stacking ensemble. The subject of the study is as much the evaluation protocol as the models: the whole pipeline is arranged so that no learned step can see data outside its own training partition, and each dataset is split along whatever boundary it genuinely supports rather than at random.

That distinction is the point. A random split over network traffic lets a model be right for reasons that have nothing to do with detection — a duplicated flow record, a capture timestamp that happens to separate the attack simulations from the benign baseline, a source port that is unique to one host. Each of those is a way of being accidentally correct, and each one is removed here deliberately.

Datasets#

The first four differ in age, capture environment and traffic type, so that a result holding across all of them is likelier to generalise than one tuned to a single capture.

The fifth is not a fifth environment. NF-UNSW-NB15-v3 is the same UNSW-NB15 capture re-extracted with a standard NetFlow feature set, which makes it a controlled comparison isolating the effect of the feature set — so the five are never averaged as though they were five independent captures. Class imbalance is the dominant property of this data throughout, and most of the design below follows from it.

Evaluation protocol#

Each split is chosen by what the dataset supports, not by preference. Where a capture carries time, the split respects it; where it carries host identity but no clock, whole hosts move together; where the literature reports on a published boundary, that boundary is used. A random stratified split is retained alongside as a baseline for comparison with published figures, never as evidence of generalisation.

Models under comparison#

All base learners run at near-default hyperparameters, since tuning one harder than the rest would measure effort rather than algorithms. Each is a complete pipeline in its own right — impute, scale, encode, select, resample — rebuilt inside every fold, and the meta-learner is fitted on out-of-fold predictions so it never sees a base model scoring rows it was trained on.

Preprocessing and leakage control#

Deduplication runs on feature columns plus target, before the split, and a hard assertion re-hashes both sides afterwards and raises if any test row still matches a training row — an exception rather than a warning, because a leaking split does not produce a missing number, it produces a confident wrong one that nothing downstream can catch. Rows with identical features but conflicting labels are kept deliberately: memorising such a row is wrong as often as right, so it cannot inflate a score, though it does cap what is achievable.

Rebalancing is capped rather than absolute. The majority class is undersampled and minorities raised to meet it, but no class is inflated beyond a fixed multiple of its real support, because synthesising a hundred thousand points from a handful of genuine ones manufactures a class rather than balancing it. Test data is separated before any resampling and is never transformed.

Feature selection and capture artifacts#

Features are ranked by Random Forest importance on the training partition and the top twenty retained, with selection and scaling as steps of the fitted pipeline rather than standalone stages — an earlier design ran them as scripts writing intermediate files, which put both outside the split boundary.

Removing capture artifacts mattered more than the selection itself. Flow start timestamps rank highly for the simple reason that the attack simulations were run on different days from the benign baseline; source ports rank highly because they are ephemeral and near-unique; TCP base sequence numbers are near-unique by construction. A model handed any of these learns the capture, not the traffic. All are excluded, while destination port is retained as a genuine property of a flow. Two of the captures need a second control, since host identity survives in their TTL and packet-length columns, so every run on those exists in both artifact-present and artifact-controlled variants.

Tasks#

Every dataset that supports both is evaluated on two tasks over the same rows and the same split: a binary one, asking whether a flow is an attack, and a multiclass one, asking which family it belongs to. Metrics are macro-averaged, because accuracy on this data is dominated by the benign class and reports a healthy number for a model that has learned almost nothing about the rare classes. Attack families that appear only at test time are mapped to a sentinel no model can predict and counted as misses, which is the honest score for a family never shown to the model.

A third strand covers alert correlation. No dataset ships correlation labels, so pairs are derived by treating flows as alerts and pairing them; only two of the five carry the addresses and timestamps this needs.

Status#

Base-model training and ensemble evaluation are complete across every dataset, task, split and variant combination, and each figure is generated from saved prediction arrays rather than transcribed. Results are held back for the full manuscript, which is in preparation.