Anomaly Detection for Sunburst Attack Identification Using Hybrid AI: A Stacking Ensemble and Attention Based LSTM Approach

Because cyber attacks like the Sunburst supply chain attack are becoming more complex, it is now important to implement strong and smart intrusion detection systems. Attackers these days are abusing updated software on computers, bypassing security systems that check for specific attacker data. To counter this, we propose a hybrid anomaly detection framework that integrates a stacking ensemble of tree-based machine learning models—XGBoost, LightGBM, CatBoost, and Random Forest—with a Bidirectional Long Short-Term Memory (BiLSTM) network enhanced by an attention mechanism. The framework utilizes rigorous data preprocessing, exploratory data analysis, and feature selection to refine a real-world Sunburst attack dataset, identifying key flow-based attributes—such as flow duration, byte rates, and packet statistics—that effectively distinguish between normal and malicious network traffic. Soft predictions from the ensemble are concatenated with original features and passed into the BiLSTMAttention model to capture temporal dependencies and improve classification performance. Experimental results show that the proposed model achieves an accuracy of 95.50%, a precision of 96.52%, an F1-score of 95.81%, and an AUC-ROC of 0.9867, outperforming individual classifiers in both accuracy and robustness. The results show that using deep models and an ensemble learning approach can both raise precision and decrease the number of false alerts. The proposed system offers a scalable, interpretable, and high-performance AI-driven intrusion detection solution suitable for real-time cybersecurity applications.