###### Abstract  
Various machine-learning methods have been applied to anomaly intrusion detection. However, the Intrusion Detection System still faces challenges in improving Detection Rate and reducing False Positive Rate. In this paper, a Class-Level Soft-Voting Ensemble (CLSVE) scheme based on the Chaos Bat Algorithm (CBA), called CBA-CLSVE, is proposed for intrusion detection. The Support Vector Machine (SVM), K-Nearest Neighbor (KNN) and Decision Tree (DT) are selected as the base learners of the ensemble. The Chaos Bat Algorithm is used to generate class-level weights to create the weighted voting ensemble. A weighted fitness function considering the tradeoff between maximizing Detection Rate and minimizing False Positive Rate is proposed. In the experiments, the NSL-KDD, UNSW-NB15 and CICIDS2017 datasets are used to verify the scheme. The experimental results show that the class-level weights generated by CBA can be used to improve the combinative performance. They also show that the same ensemble performance can be achieved using about half the total number of features or fewer. ensemble; soft voting; chaos bat algorithm; intrusion detection +
Footnote †: journal: Medical Informatics  
The No Free Lunch (NFL) theorem points out that different machine-learning algorithms have their own application scenarios and there is no optimal and universal algorithm [5]. Ensemble learning, sometimes called a multiple classifier system or committee-based learning, completes the learning task by constructing and combining multiple learners. The ensemble methods are widely used to solve various problems because of their advantages in accuracy, stability and generalization [6; 7]. According to whether the types of the generated base learners are the same, the ensemble methods can be divided into homogeneous methods and heterogeneous methods. For the homogeneous method, the same learning algorithm is used to generate base learners. The Random Forest (RF) method, a well-known ensemble learning method, belongs to this type, in which all its base learners are in the Decision Tree. In the heterogeneous method, different technologies with different performances are used to form base learners. Ensemble learning mainly involves generation, system topology and combination. In the first period, a large number of base learners to be ensembled are trained. There are six main ways to generate accuracy and diverse base learners, including different initializations, different parameters, different architectures, different classifier models, different training sets and different feature sets [8]. In the second stage, the base learners generated above can be organized in a parallel or serial manner. In the parallel structure, the classifiers are independent. In the serial topology, base learners are applied sequentially. First, the lead base learner in the sequence has to make a decision. If the main learner fails to decide, the task is handed over to the secondary learner, and so on. Most of the ensemble models reported in the literature adopt the parallel topology. In the last stage, the results of the base learner are combined to make the final decision. Some methods use a function to combine the outputs of all base learners. The combining method includes the weighting method, probabilistic methods, evidential reasoning-based approaches and meta-learning methods [9]. The ideal combination method should be able to use the advantages of the base learners and minimize their disadvantages. There are three output types of the base learner, including crisp labels, class rankings and soft outputs. The three types of output carry different amounts of information. Among them, the soft output contains the highest amount of information, while the crisp labeling method has the least amount of information. [PERSON] et al. [10] believe that the combination methods can also be classified into three groups. The crisp labels can be combined by voting approaches while the class rankings can be combined by class set reduction/reordering approaches.