An Ensemble Voting Classifier Framework for High-Accuracy Intrusion Detection in Dynamic Network Environments

Abstract

We propose an ensemble machine learning framework for intrusion detection in dynamic network environments is presented in this paper. The rapidly evolving landscape of cyber threats demands detection systems that can adapt to novel attack patterns while maintaining high accuracy. We propose a multi-layered processing pipeline that begins with the extraction of ten high-dimensional network traffic features, including source and destination IP addresses, packet size, flow duration, and protocol type. Categorical attributes undergo label encoding, while continuous numerical features are normalized to a uniform range of zero to one via Min-Max scaling, thereby ensuring computational stability during model training. The core of our detection system is an Ensemble Voting Classifier that aggregates predictions from five distinct base learners: Decision Tree, Random Forest, Gradient Boosting Machine, and Extreme Gradient Boosting. Furthermore, a dedicated ensemble wrapper integrates these models through a hard voting strategy, where the final class label is selected based on the majority vote among the individual classifiers. This approach effectively combines the variance-reducing capability of bagging from Random Forest with the sequential error-correction strength of boosting methods. Binary Cross-Entropy serves as the loss function to guide parameter optimization during training, minimizing the discrepancy between predicted probabilities and true labels. The principal contribution of this work lies in demonstrating that a carefully constructed ensemble of heterogeneous tree-based models, operating on normalized and encoded features, yields superior generalization performance compared to individual classifiers. Moreover, the framework requires no complex architectural modifications, making it readily deployable in real-world network environments. We anticipate that this method will significantly enhance the accuracy and robustness of intrusion detection systems against both known and emerging cyber threats.