METHODOLOGY FOR USING AN ENSEMBLE CLASSIFIER TO OPTIMIZE THE CRITICAL INFRASTRUCTURE INTRUSION DETECTION SYSTEM - Kulko, Andriy; Toliupa, Serhii (Science-based technologies, 2025)
In this article, we will look at how ensemble classifiers can significantly improve the performance of intrusion detection systems (IDS), especially in critical infrastructure environments. Due to the increasing complexity of cyberattacks, traditional protection methods are often ineffective, which jeopardizes the smooth operation of important facilities. We propose an approach that combines the results of several separate classifiers to improve threat detection accuracy and reduce the number of false positives. Various methods for creating such ensembles and their application for analyzing network traffic characteristic of critical infrastructure are being investigated. The effectiveness of these models is evaluated on data sets, demonstrating their ability to accurately identify anomalies and known types of attacks, thereby strengthening cyber resilience. Modern intrusion detection systems (IDS) must be adapted to monitor new frameworks that help distinguish and analyze system attacks. As part of our approach, we explore various combinations of classifiers such as Bayesian Network, Naïve Bayes, JRip, MLP, IBK PART, and J48. In addition, two data preprocessing methods — normalization and discretization — will be applied to each combination. The main advantage of this approach is its ability to detect most attacks with high accuracy by optimally combining the ensemble method with the correct preprocessing technique. This will allow for the effective identification of any type of network threat. Experimental studies show that this approach significantly improves the