# Evaluating Ensemble Learning Mechanisms for Predicting Advanced Cyber Attacks
## 3 Application of Ensemble Learning in NIDS
### Research Methodology  
The proposed methodology for this research involves creating an ensemble of eight different classifiers, including a Random Forest (RF), Logistic Regression (LR), Decision Tree (DT), K Nearest Neighbors (KNN), Support Vector Machine (SVM), XGBoost (XG), CatBoost (CB), and Artificial Neural Networks (ANNs), to improve the accuracy and robustness of NIDS. Each classifier will be trained on different techniques based on the combination design specification. Some mechanisms require training on the same set of labeled data while others use distinct samples of the dataset. The constructed trained models are required to produce a separate prediction for each incoming network packet (packet record). The ensemble model will combine these predictions using different methods such as bagging, boosting, and stacking, in addition to simpler averaging and voting mechanisms, where the majority vote determines the final classification.  
To evaluate the effectiveness of the proposed methodology, common performance metrics will be used, such as accurate detection rate, false alert rate, and processing time. Confusion matrix consisting of Accuracy, Precision, F-Measure and Recall is employed, to evaluate the final model. The Receiver Operating Characteristic (ROC) is also utilized to measure the classifier's efficiency. The evaluation will be conducted on a large dataset, UNSW-NB15 representing real-world network traffic, including both normal and attack traffic. The dataset is preprocessed to extract relevant features and remove noise and redundancy. Cross-validation and parameter-tuning techniques will be used to optimize the performance and avoid overfitting. The results are analyzed and visualized using various tools and techniques, such as statistical analysis, data visualization, and report generation. The research methodology can be briefed in the following stages, and it is illustrated in Figure 1:  
1. Data Preprocessing: the UNSW-NB15 dataset will be preprocessed to ensure its quality and usability. This involves removing duplicate and irrelevant records, handling missing values and outliers, and normalizing or scaling the data as needed. Additionally, feature selection will be performed to reduce the dimensionality of the dataset and improve the performance of the models.
2. Feature Engineering: feature selection is performed using a correlation matrix to identify the most relevant features for detecting network attacks. The correlation matrix is used to compute the pairwise correlations between all pairs of features in the dataset. Features with high correlation coefficients are considered redundant and will be removed. The remaining features will be evaluated based on their discriminative power and ability to capture different types of attacks.
3. Model Implementation: different machine learning models will be used to build the proposed NIDS system. These models are selected based on their performance in previous studies and their suitability for handling complex and high-dimensional data. Implementation is performed using the Jupyter Notebook environment.
4. Model Training: the dataset is split into training and testing sets using different methods such as 70:30 ratio and 10-fold cross-validation. The training set is used to train the models, while the testing set is used to evaluate their performance.  
System Evaluation: the proposed system is evaluated using a Confusion Matrix, which is a common and effective method for evaluating the performance of binary classifiers. The Confusion Matrix is used to compute various performance metrics such as accuracy, precision, recall, and F1-score. The results will be compared with those of existing approaches to determine the efficacy of the proposed system.