## 4 Results and Discussion
\begin{table}
\begin{tabular}{c c c c c} \hline \hline
**Reference** & **Dataset** & **Algorithm/(s) Used** & **Achieved** & **Added Value** \\  & **Employed** & & **Accuracy (\%)** & **Added Value** \\ \hline ([PERSON] \& [PERSON], 2020), [13] & NSL-KDD & Multi-parent & 99.30 & Not applicable \\  & & genetic algorithm + SVM + ANN & & 99.40\% accuracy. Overall, it improves \\ \hline ([PERSON] et al., 2021), [18] & NSL-KDD & Deep neural network & 82.95 & Not applicable \\ \hline ([PERSON], 2022), [28] & NSL-KDD & Convolutional neural network & 92.23 & Not applicable \\ \hline ([PERSON] et al., 2021), [29] & NSL-KDD & ANN & 97.00 & Not applicable \\ \hline Our study & NSL-KDD & XGBoost (Gradient Boosting) & 98.70 & Not applicable \\ \hline Our study & NSL-KDD & AdaBoost (Adaptive Boosting) & 97.60 & Not applicable \\ \hline \hline \end{tabular}
\begin{tabular}{c c c} \hline \hline  & & \multicolumn{1}{c}{Presents an ensemble of ANN, SVM, and RF with RF-based feature selection, achieving 99.40\% accuracy. Overall, it improves classification performance and robustness, offering a practical, scalable solution for real-world binary classification tasks across multiple domains.} \\ \end{tabular}
\end{table} 
Table 9: Benchmark results of the ensemble model with similar research. Overall, this research introduces a robust ensemble model combining ANN, SVM, and RF, optimized using Recursive Feature Elimination (RFE). The ensemble outperforms individual models, achieving 99.40% accuracy. Key contributions include enhanced feature selection, improved classification performance, and model robustness. Nonetheless compared to similar research, the study demonstrates real-world applicability in binary classification tasks, offering a reliable, scalable solution for domains such as healthcare, cybersecurity, and finance through a well-balanced and effective hybrid approach. The scalability of the proposed approach refers to both computational and architectural aspects of the system. From a computational standpoint, the ensemble model is lightweight and modular: the ANN and SVM models operate in parallel, and the RF meta-classifier only processes their outputs (two features), making inference efficient even on limited-resource instances (e.g., AWS EC2 t2.medium). From an architectural perspective, the system was designed using containerized components (Flask-based microservices), enabling horizontal  
Figure 12: Confusion matrix of the final ensemble (employing UNSW-NB15 dataset). Figure 13: The ROC curve (employing UNSW-NB15 dataset). scaling in cloud environments to support high-throughput scenarios. The use of SHAP for local explanations is also scalable, as it only operates on two aggregated model outputs instead of high-dimensional raw features. These design choices ensure that the system can handle larger volumes of network traffic or be extended to distributed deployments without major architectural changes. Following model development, the trained models were serialized and integrated into a cloud-enabled platform built using Flask and then deployed to AWS EC2 as mentioned in Section 3.6. A simple and user-friendly web interface was developed to display real-time anomaly detection results. The system captures live traffic data from the cloud during the testing phase, processes it continuously, and presents the anomaly percentage to users via the web interface as depicted in Figure 14.  
The webpage is configured to automatically refresh every 10 s, ensuring that users always see the most recent detection results. As new data is ingested, it is immediately preprocessed to match the input format required by the pre-trained anomaly detection model, an ensemble-based neural network. The model evaluates each data point to identify abnormal behavior. The proportion of anomalies detected is calculated and displayed as a percentage, offering users a clear and continuously updated insight into system health and potential security threats.