Multi-Level Ensemble and Transfer Learning Framework for Cybersecurity Anomaly Detection

Abstract

The swift increase in cyber threats in contemporary networked environments has led to the need of developing powerful and smart anomaly detectors. The present paper focuses on proposing a multi-level ensemble and transfer learning-based architecture to effectively detect anomalies in cybersecurity systems. Its main goal is to enhance the accuracy of detection and generalization to a wide range of data sets using hybrid methods of deep learning. This approach combines the results of two benchmark datasets, UNSW-NB15 and CICIDS-2017, and then preprocesses the data such as data cleaning and the treatment of missing values and feature selection using Select KBest. Exploratory Data Analysis would be conducted to learn the characteristics of data and the division of data and normalization would be done to make sure that the model is trained effectively. The suggested framework integrates three models: a dense neural network with transfer learning to learn more features, an LSTM model to learn temporal features, and an auto encoder to detect anomalies unsupervised. A combination of these models is done through a weighted ensemble method to make final predictions. Experimental analysis shows that the proposed model obtains a precision of 82.68 on the UNSW dataset and 96.29 on the CIC dataset. The findings indicate the efficiency of the ensemble method to enhance the performance of the anomaly detection and flexibility to various cybersecurity conditions.