An Ensemble Machine Learning Approach for Real-Time Early Detection of Cyber Threats Using Network Traffic Data

Abstract

The spontaneous growth of cloud computing, the Internet of Things (IoT), and enterprise networks has significantly increased the volume and complexity of cyber threats, making traditional signature-based intrusion detection systems less effective against sophisticated and zero-day attacks. Machine learning has emerged as a promising solution for intelligent cyber threat detection, while ensemble learning further enhances detection performance by combining the strengths of multiple classifiers to improve accuracy, robustness, and generalization. This study proposes RT-ECTDNet (Real-Time Ensemble Cyber Threat Detection Network), an ensemble machine learning framework for the real-time early detection of cyber threats using network traffic data. The framework employs a layered architecture comprising data acquisition, preprocessing, feature engineering, ensemble learning, threat prediction, and alert generation. Feature optimization was performed using Information Gain, Chi-Square, and Recursive Feature Elimination, while Random Forest, XGBoost, LightGBM, Extra Trees, and CatBoost were integrated through voting and stacking strategies. The model was evaluated using the CICIDS2017 benchmark dataset and assessed with standard performance metrics. Experimental results showed that RT-ECTDNet achieved an accuracy of 99.23%, precision of 99.39%, recall of 99.26%, F1-score of 99.32%, ROC-AUC of 0.998, a false positive rate of 0.81%, and an average detection latency of 11.34 ms, outperforming all individual classifiers. The findings demonstrate that RT-ECTDNet provides an accurate, scalable, and computationally efficient solution for real-time cyber threat detection, making it suitable for deployment in enterprise, cloud, and IoT environments.