All Predict Cost Efficient Decides: A New Cost-Centric Ensemble Learning Method for Network Intrusions Detection
Bibliographic record
Abstract
Machine Learning (ML) techniques have gained extensive attention for network intrusion detection. However, integrating ML approaches faces two primary challenges due to the presence of multi-class attacks and their varying impact levels on the network: the one-size-fits-all dilemma and the consideration of intrusion costs. Since ML models exhibit differing detection performances for each attack class, a single ML model may not suffice for predicting all attacks. Additionally, intrusion cost, a crucial concern for users and network service providers, is often overlooked in intrusion detection scheme development. To address these challenges, we propose a novel ensemble-learning framework called All Predict Cost Efficient Decides (APCED). APCED integrates multiple ML models, selecting an expert ML model for each attack class to minimize intrusion costs. In APCED, both damage cost and response cost determine the cost-efficient base estimators for ensemble learning, with an aggregation strategy employed for final decisions. We evaluate the performance of APCED using the NSL-KDD dataset. Numerical results demonstrate that APCED enhances the overall weighted F1 score by 81.13% compared to Adaboost and achieves an overall cost reduction of 54.7% and 87% compared to XGBoost and Adaboost, respectively.
Fetched live from OpenAlex and de-inverted. Abstracts are not stored in this database: the inverted indexes are 8.6 GB of the frame’s 9.3 GB of text, and the host has 13 GB free.
How this classification was reachedexpand
Full frame machine prediction
Teacher imitationNot calibrated prevalence, not ground truth. Human validation pending. The Gemma side is a direct model label for every work in the frame, read from the title-only record. The Codex side is a classifier learned from the 10,348 direct Codex labels and calibrated to design-weighted sample rates; fields without enough sample support carry no Codex call. Candidate is the union of the two sides; consensus is their intersection. These outputs are machine_predicted_unvalidated and are not human labels.
Distilled classifier scores by category (both heads)
| Category | Codex | Gemma |
|---|---|---|
| Metaresearch | 0.003 | 0.005 |
| Meta-epidemiology (narrow) | 0.001 | 0.001 |
| Meta-epidemiology (broad) | 0.002 | 0.001 |
| Bibliometrics | 0.002 | 0.001 |
| Science and technology studies | 0.001 | 0.001 |
| Scholarly communication | 0.001 | 0.002 |
| Open science | 0.003 | 0.002 |
| Research integrity | 0.001 | 0.002 |
| Insufficient payload (model declined to judge) | 0.002 | 0.000 |
Machine scores (provisional)
The two teacher heads of the student model, read on this work. A score orders the frame for review; it never asserts a category, and the validation status ships verbatim with every row.
Baseline scores from an immature model (maturity gate not passed, 7 training rounds). Scores rank; they never assert a category.
score_only:v0-immature-baseline · verbatim from the scoring run: score_only means the number may rank works, and no category label ships from itClassification
machine, unvalidatedMachine predicted; a candidate call from one source (direct Gemma or distilled Codex), not a consensus.
How this classification was reached, model by model and score by score, is at the end of the page under "How this classification was reached".