A robust semi-supervised hybrid ensemble for Network Intrusion Detection System (NIDS)

Department of Informatics Engineering, Politeknik Negeri Bandung, Bandung, Indonesia

^* Corresponding author: siti.dwi@polban.ac.id

Abstract

The increasing sophistication of cyber threats demands the development of robust Intrusion Detection Systems (IDS). However, creating an effective anomaly-based IDS is hindered by critical challenges, including data labeling scarcity, inherent class imbalance, and a severe vulnerability to adversarial attacks. This research proposes a novel semi- supervised hybrid ensemble architecture designed to holistically address these issues. The methodology leverages a rigorous 5-Fold Cross-Validation framework on the NSL-KDD dataset. Our proposed model uniquely integrates three distinct learning paradigms: a Self-Training classifier, an unsupervised Autoencoder, and an Isolation Forest, aggregating their scores via an F1-score-optimized threshold. This design inherently handles class imbalance without explicit data resampling. The primary contribution of this work is a two-fold evaluation. First, the framework’s baseline performance is established, achieving a state-of-the-art average F1-score of 99.24%, a detection recall of 99.12%, and a remarkably low False Positive Rate of 0.58%. Second, its robustness is quantified by subjecting the model to white- box adversarial attacks. While performance was impacted, the model demonstrated significant resilience, maintaining a high detection recall of 88.11%. This validates that the synergistic combination of diverse learning models not only provides a highly effective and balanced solution for standard detection but also offers a quantifiable degree of inherent robustness against adversarial threats, a crucial attribute for real-world deployment.