Intrusion Detection Based on KNN-SVM with Stacking Ensemble Strategy

Intrusion detection is a critical technology for ensuring network security in software-defined networking (SDN) environments. To address the challenges posed by diverse attack types, complex feature distributions, and the synthetic sample noise introduced by Synthetic Minority Over-sampling Technique (SMOTE), this paper proposes a KNN-SVM model that integrates support vector machines (SVMs). The model employs a two-level learning framework based on stacking ensemble to enhance the complementarity of different classifiers in multi-class attack detection. Experiments conducted on the CIC-IDS2017 dataset—after SMOTE preprocessing—demonstrate that the model achieves accuracy, precision, recall, and F1-score values of 98.21%, 98.02%, 98.34%, and 98.06%, respectively. The results confirm that the proposed KNN-SVM model delivers superior performance in multi-class intrusion detection and offers an effective solution for SDN-based network security.