An Ensemble Machine Learning Framework for Real-Time Cyber-attack Detection in Network Traffic

Resumen

Modern computer networks face an evolving landscape of sophisticated cyberattacks, rendering traditional signature-based Intrusion Detection Systems (IDS) insufficient for real-time threat mitigation. Machine learning (ML) models offer adaptive threat detection; however, individual classifiers often struggle with high false-positive rates, class imbalance, and processing latency under heavy network traffic [1].

To address these challenges, this paper presents a novel Ensemble Machine Learning Framework designed for high-accuracy, real-time cyberattack detection in dynamic network environments. The proposed framework integrates feature engineering and lightweight dimensionality reduction with a heterogeneous ensemble architecture—combining decision tree-based algorithms (such as Random Forest, LightGBM, and XGBoost) alongside soft-voting and stacking mechanisms [9].

Evaluated on benchmark network intrusion datasets (such as CICIDS2017 / UNSW-NB15 / NSL-KDD), the framework demonstrates superior performance in both binary (benign vs. attack) and multi-class threat classification. Experimental results indicate high detection accuracy, superior F₁-scores, and significantly reduced computational overhead compared to standalone models and deep learning approaches. The lightweight nature of the feature-selection pipeline enables low inference latency, validating the system's suitability for real-time deployment in high-speed enterprise networks.