Twined ensemble framework for network security: integrating Random Forest, AdaBoost, and Gradient Boosting for enhanced intrusion detection

An Intrusion Detection System (IDS) is crucial for safeguarding networks against cyber threats. This research presents a novel Twined Ensemble model, specifically designed to enhance intrusion detection performance using the NSL-KDD dataset. The proposed approach leverages a combination of two algorithms from AdaBoost, Gradient Boosting, or Random Forest for each attack category based on their individual performance. These selected classifiers are then combined using a Soft Voting Ensemble technique, which aggregates their probabilistic outputs to yield more accurate and robust predictions. To address the inherent class imbalance in the NSL-KDD dataset, particularly for underrepresented attacks like U2R and R2L, the Synthetic Minority Oversampling Technique (SMOTE) is employed to generate synthetic examples, thereby improving model generalization for rare classes. The Twined Ensemble model is evaluated using metrics such as Accuracy, Precision, Recall, F1-Score, and Cohen’s Kappa. The model achieves 99.68% accuracy for DoS, R2L, and Probe attacks, and 99.83% for U2R attacks, accompanied by a Cohen’s Kappa score of 1.0, indicating near-perfect classification. This architecture effectively integrates adaptive ensemble learning with class balancing strategies, offering a powerful and reliable solution for modern network intrusion detection. Beyond classification accuracy, this study also evaluates the computational performance of each classifier in terms of training time, prediction latency, and memory consumption. Gradient Boosting, while more accurate, exhibits higher training overhead (428.57 s), whereas AdaBoost and Random Forest maintain significantly faster training times (23.05 s and 24.93 s respectively) with minimal memory usage (< 0.04 MB). These findings demonstrate potential scope for the model’s feasibility for real-time IDS deployment in resource-constrained environments.

Authors

Institutions

Publication Details

Journal
Discover Internet of Things
Published
2025-10-15
DOI
https://doi.org/10.1007/s43926-025-00199-1
Citations
5
Primary Topic
Network Security and Intrusion Detection
Type
article
Field-Weighted Citation Impact
7.44
Controls
|||
ALL TIME
JAN
FEB
MAR
APR
MAY
JUN
JUL
AUG
SEP
OCT
article

Twined ensemble framework for network security: integrating Random Forest, AdaBoost, and Gradient Boosting for enhanced intrusion detection

Sadaf Ahmad, A. Rajaram, Mohammed Shuaib, Shadab Alam et al.
5 citations
Discover Internet of Things
Network Security and Intrusion Detection
7.44
article

Twined ensemble framework for network security: integrating Random Forest, AdaBoost, and Gradient Boosting for enhanced intrusion detection

Sadaf Ahmad, A. Rajaram, Mohammed Shuaib, Shadab Alam, C. Kishor Kumar Reddy, Pulakurthi Satyanarayana Reddy, Pulakurthi Anaghaa Reddy
article en
5 citations

Abstract

An Intrusion Detection System (IDS) is crucial for safeguarding networks against cyber threats. This research presents a novel Twined Ensemble model, specifically designed to enhance intrusion detection performance using the NSL-KDD dataset. The proposed approach leverages a combination of two algorithms from AdaBoost, Gradient Boosting, or Random Forest for each attack category based on their individual performance. These selected classifiers are then combined using a Soft Voting Ensemble technique, which aggregates their probabilistic outputs to yield more accurate and robust predictions. To address the inherent class imbalance in the NSL-KDD dataset, particularly for underrepresented attacks like U2R and R2L, the Synthetic Minority Oversampling Technique (SMOTE) is employed to generate synthetic examples, thereby improving model generalization for rare classes. The Twined Ensemble model is evaluated using metrics such as Accuracy, Precision, Recall, F1-Score, and Cohen’s Kappa. The model achieves 99.68% accuracy for DoS, R2L, and Probe attacks, and 99.83% for U2R attacks, accompanied by a Cohen’s Kappa score of 1.0, indicating near-perfect classification. This architecture effectively integrates adaptive ensemble learning with class balancing strategies, offering a powerful and reliable solution for modern network intrusion detection. Beyond classification accuracy, this study also evaluates the computational performance of each classifier in terms of training time, prediction latency, and memory consumption. Gradient Boosting, while more accurate, exhibits higher training overhead (428.57 s), whereas AdaBoost and Random Forest maintain significantly faster training times (23.05 s and 24.93 s respectively) with minimal memory usage (< 0.04 MB). These findings demonstrate potential scope for the model’s feasibility for real-time IDS deployment in resource-constrained environments.

Discover Internet of ThingsVol. 5(1)
Electronics Corporation of India (IN), Aligarh Muslim University (IN), Stanley Medical College (IN), Open International University for Alternative Medicines (IN), E.G.S. Pillay Engineering College, Jazan University (SA)
Openalex Percentile: Top 3%
Network Security and Intrusion Detection
7.44
AI Navigator

Ask Laika to Summarize, Analyze, and Connect papers live on the map.

Summarize Papers & Methodologies

Extract key findings, datasets, and comparative methods across publications.

Benchmark Rankings & Visual Analytics

Rank top research institutions, authors, funders, topics, and journals by Field-Weighted Citation Impact (FWCI) and paper volume with instant charts.

Connect Distant Disciplines

Bridge topological clusters on the map to find hidden collaborative intersections.