Enhancing Network Intrusion Detection using Ensemble Machine Learning Models on CICIDS2017 Dataset

Abstract

The increasing complexity of modern cyberattacks has heightened the demand for intelligent Intrusion Detection Systems (IDS) capable of identifying both known and emerging threats. Traditional signature-based IDS struggle to generalize beyond predefined attack patterns, thereby limiting their effectiveness in dynamic network environments. This study investigates the capability of ensemble machine learning models to enhance intrusion detection accuracy and reduce false alarm rates using the CICIDS2017 dataset, which reflects realistic network behaviour and diverse attack scenarios. The research methodology incorporated extensive data pre-processing, including normalization, removal of inconsistencies, feature selection, and stratified data partitioning to preserve class distribution. Three ensemble strategies namely bagging (Random Forest), boosting (Gradient Boosting/XGBoost), and stacking were developed to exploit complementary strengths across multiple base learners. Model performance was evaluated using accuracy, precision, recall, F1-score, and confusion matrix interpretation, with stratified k-fold cross-validation ensuring robustness and generalizability. Experimental results demonstrate that ensemble approaches consistently outperform individual baseline classifiers. The stacked ensemble achieved the highest performance, registering 98.3% accuracy, 97.9% precision, and 97.5% recall, surpassing both Random Forest and Gradient Boosting models. These findings affirm that ensemble learning significantly enhances detection capability while minimizing false positives, making it well-suited for deployment in real-world cybersecurity infrastructures. In addition to empirical contributions, this study provides a fully reproducible machine learning pipeline encompassing pre-processing, feature engineering, hyperparameter optimization, and evaluation procedures. Identified limitations include computational overhead and dataset imbalance, while recommendations for future research involve incorporating deep learning architectures, improving adversarial resilience, and adapting the model for real-time IDS environments.

DOI:  https://doi.org/10.5281/zenodo.19226711