An Adaptive Hybrid Ensemble Intrusion Detection System (AHE-IDS) Using LSTM and Isolation Forest

Abstract

Network intrusion detection is vital for the security of today's computer networks against malicious behavior. Existing detection systems often fail at achieving a good trade-off between the detection of known patterns of attacks and the detection of novel, unseen attacks. In this paper, we propose an Adaptive Hybrid Ensemble Intrusion Detection System (AHE-IDS) based on a supervised deep learning detector and an unsupervised anomaly detector to enhance detection rates. The suggested system integrates an Isolation Forest outlier detection technique and a Long Short-Term Memory (LSTM) neural network in a complementary way. The LSTM is trained with normal and malicious traffic patterns over the CSE-CIC-IDS2018 benchmark dataset that has a wide variety of attack scenarios. While the LSTM is perfroming this, the Isolation Forest is learning normal patterns to detect anomalies that could be new intrusions. A weighted voting method that adaptively weighs the two models' outputs dynamically combines the outputs of both models in such a way that the ensemble is able to prioritize the more dependable detector in accordance with prevailing conditions. Both known attacks and previously unseen anomalies outside standard traffic patterns can be detected using this hybrid method. AHE-IDS is tested on the CSE-CIC-IDS2018 dataset. Experiment results demonstrate that the ensemble achieves low false alarm rates and high detection rates, outperforming both LSTM and Isolation Forest individual models. According to the findings, AHE-IDS greatly enhances the accuracy and recall of an individual LSTM classifier at a low false positive rate. It successfully decreases missed attacks without influencing precision. The adaptive weighting scheme improves robustness as it adapts to concept drift and changing attack patterns over time. Consequently, AHE-IDS performs well in dynamic environments. The system is adaptive that can react to both familiar and unfamiliar kinds of cyber attacks.