Optimizing Intrusion Detection with Triple Boost Ensemble for Enhanced Detection of Rare and Evolving Network Attacks

In the rapidly evolving cybersecurity landscape, this study specifically addresses the challenge of accurately detecting rare and evolving network attacks—particularly infrequent types such as Root-to-Local (R2L) and User-to- Root (U2R) attacks—in highly imbalanced datasets. This study aims to develop an advanced TripleBoost ensemble model that integrates AdaBoost, CatBoost, and XGBoost to overcome the limitations of conventional IDS in dynamic network environments, Intrusion Detection Systems (IDS) are essential for identifying and mitigating malicious activities within network environments. This study presents a novel IDS framework designed to address critical challenges in the field, including handling class imbalances, outlier detection, and feature selection inefficiencies. A comprehensive preprocessing pipeline is employed, utilizing the Synthetic Minority Over-Sampling Technique (SMOTE) to manage class imbalances, the Z-score method for outlier detection, and ridge regression for effective feature selection. The core innovation lies in the development of a TripleBoost ensemble model, which integrates AdaBoost, CatBoost, and XGBoost to leverage their complementary strengths. This approach achieves a significant performance boost, evidenced by an accuracy of 97.38%, precision of 95.34%, recall of 99.56%, and an F1-score of 96.40%. The model successfully overcomes limitations faced by traditional IDS models, such as poor detection of rare attack types and scalability issues in dynamic network environments. This framework significantly enhances IDS technology by improving both detection accuracy and generalization capabilities, making it more effective against evolving cyber threats. Future work will explore real-time detection optimizations and the adaptability of the model in complex network paradigms, further enhancing its potential to secure modern network infrastructures.