Ensemble learning improves attack detection across user and network data

A new computational approach that combines several artificial-intelligence models reported accuracy of 95%, recall of 96% and an F1 score of 95% when identifying malicious activity in user-behavior and network-intrusion datasets. The study, published in 2026, introduces an Ensemble Probability Meta-Classifier, or EPMC, that uses a Transformer, a deep neural network and a gated recurrent unit to analyze patterns in digital activity. Rather than relying on a fixed average or a simple vote, the system learns how much weight to give each model for different examples, then sends the combined prediction to a nonlinear meta-classifier. The results were obtained on the CERT Insider Threat Dataset, NSL-KDD and CICIDS-2017, with the researchers describing consistent gains over the baseline models they evaluated. The work is an experimental benchmark study rather than a deployment trial in a live organization, so its reported performance does not establish how the system would perform against previously unseen or continuously changing attacks in production.

The central challenge addressed by the research is that modern computing environments generate enormous and varied quantities of security-related data, making it difficult for a single detector to separate routine behavior from malicious conduct. User-behavior analysis treats normal and malicious activities as classification targets by examining logins, file activity, web requests and device interactions, while intrusion-detection systems more commonly analyze network traffic. The authors note three recurring obstacles: high-dimensional behavior data, severe class imbalance in which attacks are much rarer than normal events, and the changing nature of threats. Their approach was designed to address these issues by first reducing data dimensionality, then applying several models with different strengths, and finally learning an input-dependent combination of their outputs. The result is intended to preserve complementary information rather than forcing one architecture to handle every pattern on its own.

Data preparation formed a substantial part of the study. The CERT dataset, released by Carnegie Mellon University’s Software Engineering Institute, contributed more than 100 million activity records covering 1,000 users over 18 months. Its logs include web browsing, email, file access, logon and logoff events, and removable-device use. The researchers combined the separate CSV files, used Apache Spark to integrate, clean and normalize user-level records, and constructed behavioral profiles for feature extraction. Two network-focused benchmarks, NSL-KDD and CICIDS-2017, were added to test the approach across different threat environments. Because their original features are connection-level traffic attributes rather than user logs, the researchers transformed them into behavior-oriented representations based on communications, packet statistics, flow activities, sessions and temporal sequences. This conversion gave the three datasets a common interface, but the authors acknowledge that such abstraction can introduce minor bias.

After preprocessing, the researchers extracted 48 categories of features from CERT, including login counts, logon-time variability, file-write frequency, USB insertion, access to blacklisted web domains, device use, HTTP request patterns and sequences of activity. Numerical values were normalized to a common range, while missing or inconsistent values were handled through imputation or removal. Correlation analysis, recursive feature elimination and mutual-information methods were used to select useful variables and reduce dimensionality. An autoencoder was then trained to reconstruct the selected input and compress it into a lower-dimensional latent representation. Its encoder learned the transformation from the original feature vector to a compact code, while the decoder was trained to recover the input. Mean-squared reconstruction loss guided this stage, and the latent features rather than the full processed records were supplied to the classifiers.

The EPMC architecture has four functional layers: autoencoder-based feature extraction, independent base classifiers, feature stacking and a meta-classifier. The Transformer operates on sequences of user or network behavior and uses self-attention to determine the relative importance of different time steps. The deep neural network contains multiple hidden layers with ReLU activations and is intended to identify hierarchical patterns and small irregularities. The gated recurrent unit, or GRU, models temporal dynamics through update and reset gates, allowing it to track changes in login schedules, file-access sequences and other ordered events. Each base classifier produces a probability that an example is malicious. Those three probability outputs form a compact meta-feature vector for the final stage.

The distinctive step is the learnable softmax fusion mechanism. Given the probability outputs of the three base models, the system computes normalized weights whose sum is one and forms a weighted vector from the predictions. The weights can change with the input, allowing one model to dominate when it responds strongly to a particular attack pattern while the others contribute more when their temporal or sequential reasoning is useful. The authors distinguish this from conventional stacking with fixed weights or simple output aggregation. The fused vector is passed to a small multilayer perceptron with a hidden nonlinear layer and a sigmoid output for binary classification. During training, the autoencoder is optimized first with reconstruction loss; the base classifiers are then trained independently with binary cross-entropy; and the softmax weighting parameters and meta-classifier are jointly optimized by backpropagation. If measured F1 score or area under the ROC curve falls below a chosen threshold, the algorithm reduces the learning rate by a factor of 0.9 and repeats training.

Evaluation used accuracy, precision, recall, F1 score, area under the ROC curve and confusion matrices, with stratified splitting to address imbalance. For CERT and CICIDS-2017, the data were divided 80% for training, 10% for validation and 10% for testing, while NSL-KDD retained its predefined training and test split. Baseline models were reportedly trained with the same preprocessing, feature representations and evaluation conditions. The EPMC outperformed the CNN, LSTM, conventional neural-network and random-forest baselines considered in the study, and the researchers also compared the ensemble against each base model over five independent runs. Paired t-tests on accuracy and F1 score produced p values below 0.001 for the reported improvements. The paper nevertheless limits the scope of its comparison: attention-based ensembles, graph-based intrusion detection and federated-learning systems were not directly tested because their architectures and experimental settings differed.

Two analyses examined what the system was learning. An ablation study removed one base model at a time. Eliminating the GRU had only a small effect on overall performance, whereas removing the DNN or Transformer produced a clearer decline in accuracy and F1 score, suggesting that the ensemble continued to benefit from complementary information even when one component received a small weight. In one example, the DNN received a softmax weight of 0.999 while the Transformer received 0.0005, but the authors stress that these values are input-dependent and do not mean the other models were irrelevant. Feature-level analysis found that removing high-impact signals such as logon anomalies lowered the F1 score by approximately 2% to 4%. The study associates these behavioral features with recognizable deviations such as off-hours access, repeated failed logins, unusual file writes and access to certain web domains, although such associations do not by themselves establish malicious intent.

Computational tests also produced a favorable but hardware-dependent feasibility profile. The researchers reported a training time of 66.5 seconds and inference latency of 0.000124 seconds per sample, describing the framework as suitable for real-time security applications. The DNN had lower latency on its own, but EPMC traded some speed for improved predictive performance by running and combining several models. Training was conducted offline, while the inference stage was presented as sufficiently efficient for continuous monitoring. The architecture is modular, allowing additional base models to be introduced or individual components to be optimized for available resources. These measurements came from the authors’ experimental system, and the paper does not describe performance under heavy production load, across different hardware configurations or with live adversarial adaptation.

The authors present EPMC as a potentially scalable way to combine behavioral representation with adaptive ensemble learning for insider-threat detection, enterprise monitoring, cloud infrastructure and other security settings. The strongest finding is methodological: across three benchmark datasets and the evaluated baselines, dynamically fusing a Transformer, DNN and GRU produced more stable classification results than the individual models included in the study. Important limitations remain. The benchmarks are public datasets rather than live enterprise streams, the network data were translated into behavior-oriented forms, and comparisons with several recent architectures were outside the study’s scope. The system’s reported accuracy and low observed false-positive rate therefore indicate promise in controlled experiments, not guaranteed effectiveness against novel attacks. The researchers identify hybrid classifiers, real-time data, Internet of Things networks, healthcare systems and cloud infrastructure as priorities for future work, while presenting EPMC as a flexible foundation whose deployment would still require testing in the specific conditions where it is intended to operate.

Subject of Research: Adaptive ensemble learning for user-behavior and network intrusion detection

Article Title: Ensemble probability meta-classifier for attack detection leveraging user behavior and big data analytics

Article References: Prasanthi, K., Devarajulu, V. S., Krishna, P. V., & Saritha, V. (2026). Ensemble probability meta-classifier for attack detection leveraging user behavior and big data analytics. Discover Artificial Intelligence, 6(1), Article 1064. https://doi.org/10.1007/s44163-026-01779-y

Image Credits: AI Generated

DOI: 10.1007/s44163-026-01779-y

Keywords: intrusion detection, ensemble learning, user behavior, Transformer models, deep neural networks, gated recurrent units, autoencoders, cybersecurity, insider threats, big data analytics, Ensemble, probability