Flow-Based Intrusion Detection Using Ensemble Machine Learning

Abstract

This paper presents a flow-based intrusion detection approach designed for modern encrypted network traffic. The proposed method uses an ensemble of machine learning classifiers in a two-tier stacking architecture to detect malicious flows using only flow-level metadata, without inspecting any packet payloads. The approach is evaluated on a large-scale benchmark dataset (CIC-IDS2018) containing diverse attack types mixed with extensive encrypted traffic. Results indicate that the stacking ensemble outperforms individual classifiers and traditional voting ensembles in detecting a wide range of attacks, while preserving privacy by avoiding decryption. The study establishes baseline performance for various algorithms on encrypted flows, demonstrates the advantages of learned ensemble fusion, and provides insights through ablation and feature augmentation experiments. These contributions illustrate a practical solution for intrusion detection in fully encrypted network environments, combining high detection effectiveness with privacy preservation.