# An Ensemble-Based Machine Learning Approach for Cyber-Attacks Detection in Wireless Sensor Networks
## 2 Related Work  
Ensemble learning is one of the most well-known ML techniques used in the field of cyber-attack classification and detection. These techniques are usually constructed using multiple ML classifiers to solve the same problems and combine the results with one of the voting techniques. Figure 1 depicts the workflow of the three classical ensemble techniques: Boosting, Bagging, and Stacking. The Boosting ensemble technique process starts by training a set of weak classifiers that learn sequentially, where each classifier provides increasing weights to observations that were poorly predicted by its predecessor until it reaches a terminated condition. The Bagging ensemble technique is a bootstrap sampling technique used to generate subsets of the dataset. Each subset is used independently to construct a classifier by applying the Decision Tree algorithm. The set of generated classifiers is aggregated through majority voting or averaging to model a Bagging classifier. Bagging has the potential to improve prediction accuracy because it is highly susceptible to any variations in the training data [14]. Boosting and Bagging combine similar base classifiers, also called homogenous, by averaging or majority voting to build a robust model; however, Stacking-based ensemble learning integrates diverse classification algorithms. This ensemble technique is usually built at two levels: 0 and 1. Multiple base classifiers are considered in the learning process at level 0, while at level 1, one model learns from the best estimate of the level 0 classifiers. Diverse ML techniques at both levels will cause a significant improvement in the classification process and achieve high cyber-attack detection efficiencies. Several studies have considered ensemble techniques to implement effective intrusion detection systems. For example, the authors in [15] categorized ensemble techniques into homogeneous and heterogeneous. The same base classifiers are used in the classification process for homogeneous ensembles, whereas heterogeneous ensembles consider different base classifiers for the classification process. The authors used the homogeneous ensemble techniques Boosting and Bagging to study and test the NSL-KDD dataset. The authors of [16] used Bagging and Boosting with tree-based algorithms as the base classifier. The proposed models were then examined using two key metrics, accuracy and false alarm rate, then evaluated with the NSL-KDD dataset. The authors of [12] used three ensemble methods, Boosting, Bagging, and Stacking, to increase the efficiency of intrusion detection systems using the UNSW-NB15 and CICIDS2017 datasets. They then compared their results to other classical individual classifiers in the context of IoT smart city applications. The authors of [17] studied how well the classical Boosting, Bagging, and Stacking ensemble techniques performed in the context of smart grids using the CICDDoS 2019 dataset to detect Distributed-DoS attacks. Their results indicated that the stacking-based technique outperformed the others in terms of accuracy, probability of false alarm, probability of detection, and probability of misdetection. The authors of [18] evaluated the ensemble techniques Bagging, AdaBoost, and Random Forest (RF) with hyperparameter tuning techniques called SMOTE using the imbalanced dataset KDD Cup 99. Their goal was to create an efficient solution for class imbalance and increase intrusion detection classification accuracy. The authors of [19] proposed an intrusion detection model using the Bagging algorithm based on the information gain ratio to detect Denial of Service (DoS) attacks in a hierarchical clustering WSN. Mutual Information and Kendell's correlation techniques were used for feature selection and 10-fold cross-validation. The Bagging algorithm was used as an ensemble approach to train a set of C4.5 decision trees. The NSL-KDD and WSN-DS datasets were used for other classical techniques to evaluate the proposed model.