## 3 Methodology
### Ensemble Learning Classifiers  
Ensemble learning classifiers combine multiple algorithms to achieve superior performance compared to individual algorithms. These methodologies are generally categorized into three main types: bagging, boosting, and stacking. Bagging, pioneered by [PERSON] in 1996 [64], involves training models independently on random subsets of the data and subsequently merging their predictions using a voting process. Boosting, first discussed by [PERSON] in 1990 [65], builds a model using a sequence of weak classifiers, each one refining the errors identified by its predecessor.  
In 1992, [PERSON] introduced stacking, commonly referred to as stacked generalization [66]. This approach is recognized for its effectiveness, as it provides a structured approach to combining diverse ensemble algorithms. Stacking operates with two levels of learning: at level 0, base learners are trained on the dataset, generating a new dataset that is used to train a meta-learner at level 1. The meta-learner, which is trained on the predictions made by the base learners, is then utilized to assess the test set.  
Although bagging and boosting have significantly contributed to addressing the issues of bias and variance, they do have inherent limitations. Boosting has the potential for overfitting, while bagging suffers from limited diversity among its base models. In contrast, stacking ensemble learning overcomes these drawbacks and offers several benefits:  
* Improved accuracy: Stacked ensembles outperform individual predictive models and other ensemble methodologies such as boosting and bagging due to their integration of a diverse range of base models. This comprehensive technique allows for a rigorous analysis of the data, effectively reducing both bias and variance, thereby enhancing predictive accuracy [66].
* Enhanced robustness: Stacked ensembles mitigate overfitting risks and strengthen model robustness by employing a meta-learner to combine base model outputs. This meta-learner is capable of detecting and rectifying the errors of the base models, which leads to improved generalization [67].
* Flexibility: Contrary to boosting and bagging, which generally employ homogeneous model types, stacking ensembles distinguish themselves by integrating various models, comprising both nonlinear and linear ones. This attribute enhances the adaptability  
Figure 5: Structure of the residual block.  
\begin{table}
\begin{tabular}{l l} \hline \hline
**Layer** & **Parameters** \\ \hline Convolution layer & Size kernel = 7, number of kernel = 64, stride = 1 \\ Max pooling & Pooling size = 3, stride = 1 \\ Residual block1 & Size kernel = 3, number of kernel = 64, stride = 1 \\ Residual block2 & Size kernel = 3, number of kernel = 64, stride = 1 \\ Residual block3 & Size kernel = 3, number of kernel = 32, stride = 1 \\ Residual block4 & Size kernel = 3, number of kernel = 32, stride = 1 \\ Residual block5 & Size kernel = 3, number of kernel = 16, stride = 1 \\ Residual block6 & Size kernel = 3, number of kernel = 16, stride = 1 \\ \hline \hline \end{tabular}
\end{table}
Table 5: The overall structure and the parameters of the ResNet model.  
of model selection, thereby improving performance when dealing with complex datasets [68].  
To capitalize on the benefits of stacking ensemble learning, we propose a novel approach termed multi-stacking ensemble (MSE), aimed at enhancing the performance of multiclass classification for cybersecurity threats. The MSE utilizes a two-level structure comprising various base models, comprising both nonlinear and linear approaches. This design enables the MSE to capture various facets of the data, effectively reducing bias and variance, thereby enhancing performance on complex datasets. Additionally, the MSE incorporates two meta-learners, which serve to mitigate overfitting and strengthen the model's robustness. These meta-learners are capable of identifying and correcting the errors produced by the base models, ultimately improving the overall generalization performance.