HAMC-ID: hybrid attention-based meta-classifier for intrusion detection

Abstract

Abstract Traditional IDS, which frequently lack flexibility and accuracy in diverse network scenarios, face significant difficulties from the growing complexity and frequency of cyber intimidations. To enhance detection performance, this study proposes a two-level stacking ensemble framework called HAMC-ID. At Level-0, three heterogeneous base classifiers—Extreme Gradient Boosting, Extra Trees, and Logistic Regression—are employed to capture diverse decision boundaries. At Level-1, a Bidirectional Long Short-Term Memory network with an integrated attention mechanism serves as the meta-classifier, dynamically aggregating meta-features such as logits, prediction confidence, and entropy to generate robust final predictions. The effectiveness of HAMC-ID is evaluated on two benchmark IDS datasets, UNSW-NB15 and CICIDS2017, for both binary and multiclass classification tasks. Experimental results demonstrate that HAMC-ID consistently outperforms individual classifiers and traditional ensemble approaches in terms of accuracy, precision, recall, and F1-score, thereby confirming its efficacy and versatility in practical cybersecurity applications.