## 1 Introduction  
In the realm of online security, the predominant concern is in the occurrence of security breaches, which mostly stem from the act of intrusion. In the event of a single error or unauthorized access, it is possible for an individual to swiftly gain control over or erase data pertaining to the computer and system architecture [1]. In addition, a centralized network design may exhibit increased susceptibility to several forms of security breaches, including unauthorized access, data breaches, and distributed denial-of-service (DDoS) assaults. Furthermore, the occurrence of an intrusion may lead to substantial financial ramifications and compromised computer transactions, ultimately leading to a dearth of data in the context of a cyber digital conflict. The system may be negatively impacted by security failures [2, 3]. According to [4], the implementation of IDSs is crucial to mitigating failures. In a broad sense, an IDS is designed to identify and respond to network assaults by actively monitoring the software and hardware configurations of a given network [5]. By doing so, it plays a crucial role in safeguarding against cyber threats [6]. There exist many challenges linked with IDSs, including the incapability to identify novel assaults, a very low rate of accurate detection, and the need to mitigate false alarm occurrences. Furthermore, it is worth noting that anomalous intrusion detection approaches are still facing ongoing challenges in terms of achieving consistent performance improvements [7]. The use of ML and deep learning methodologies is often seen in the context of augmenting the efficiency of IDSs [7] as advanced technological systems with the ability to access and retrieve relevant data. Due to their ability to extract important information from vast datasets in an automated manner, ML models have garnered significant attention in academic circles. This is mostly due to their effectiveness as a tool for knowledge retrieval. By using a large number of training data, IDSs may attain high levels of perceptiveness, while ML models demonstrate satisfactory generalization capabilities in the realm of attack detection. One further benefit of ML technology is its ease of design and development, as highlighted by [8]. Ensuring network security for an organization is especially important given the widespread use of the Internet for inter-organizational and inter-company communication, which amplifies the potential for the dissemination of attacks and threats among these entities. Conventional IDSs may be inadequate in detecting novel infiltration attempts. Moreover, the network intrusion detection system (NIDS) receives different traffic since every IDS is installed in other sub-networks of the organization. In many cases, the same attacker may target multiple organization servers seen by each IDS as seldom attacks, decreasing the detection rate. Therefore, this situation poses challenges in accurately discerning genuine dangers and promptly implementing appropriate measures. Organizations have to use more advanced solutions, such as IDSs based on ML, in order to enhance their security stance. The idea is to create an ML-based IDS model to detect malicious traffic received by different organization network interfaces. A centralized proxy server is created to receive all the traffic from the organization's servers, scan the traffic by using the proposed IDS, and then redirect the traffic to the requested server. The key features of our contributions are as follows:  
1. A novel centralized network architecture based on a multi-model IDS based on traffic load. The model is more realistic since organizations have prime time or specific events. 2. In the proposed model, global traffic inspection occurs before traffic is sent to the central server and other sub-networks of the organization. 3. We analyze the results of the AdaBoost, Voting, Stacking, Support Vector Machine, Random Forest, and XGBoost 3.0.0 models on the datasets CIC-MalMem-2022, CIC-IDS-2018, and CIC-IDS- 2017. 4.