An Auditable Hybrid Cascade for Network Threat Detection

Authors

  • (*) Frowin Kifaru,  Department of Information and Communication Technology, Moshi Cooperative University
  • Daniel Mwakiposa,  Department of Information and Communication Technology, Moshi Cooperative University
  • Shadrack Stephen Madila,  Department of Information and Communication Technology, Moshi Cooperative University

(*) Corresponding Author

DOI:

https://doi.org/10.21460/jutei.2026.102.534

Keywords:

intrusion detection, network flows, hybrid cascade, Random Forest, feature attribution, auditability

Abstract

Machine-learning intrusion detectors can provide limited decision transparency in shared-server environments, where analysts must distinguish routine service activity from suspicious flows. This study proposes DIRAF (Direction-Aware Rule-Augmented Forest), a two-stage cascade comprising a conservative, interpretable rule gate and a Random Forest (RF) classifier for unresolved flows. The framework is supported by Quadruple-View Flow Engineering (QVFE), which organizes behavioral predictors into temporal, flow-morphology, port-semantics, and TCP-flag views, and by the Triangulated Attribution Protocol (TAP), which reconciles inferential, permutation-based, and SHAP feature rankings. Evaluation used the CIDDS-001 External Server Week 1 benchmark (172.838 flows); the primary binary task included 156.950 flows labeled normal or suspicious, while 15.888 unknown flows were excluded. On the held-out binary test set, DIRAF achieved 100% accuracy, precision, recall, F1-score, and AUC under the evaluated configuration. Its rule gate resolved 42,3% of test traffic, covering 61,9% of suspiciously labeled flows with 100% precision; the remaining flows were classified by the RF. The cascade reduced mean batch decision latency from 8,01 to 4,77 µs per record. These results are specific to this benchmark: direction laundering reduced Model B accuracy to 68,8%, and the direction-label association limits external validity. DIRAF therefore demonstrates an auditable cascade design on CIDDS-001 Week 1, not universal or production-level detection performance.

References

[1] M. Landauer, S. Onder, F. Skopik, and M. Wurzenberger, "Deep learning for anomaly detection in log data: A survey," Mach. Learn. Appl., vol. 12, Art. no. 100470, 2023, doi: 10.1016/j.mlwa.2023.100470.

[2] R. Usharani, E. Nirmala, N. Arockia Rosy, and P. Jagadeesan, "Optimization based machine learning for authenticated cloud security using anomaly detection and classification," Int. J. Mach. Learn. Cybern., vol. 17, no. 3, Art. no. 114, 2026, doi: 10.1007/s13042-025- 02956-8.

[3] S. Ali, C. Boufaied, D. Bianculli, P. Branco, and L. Briand, "A comprehensive study of machine learning techniques for log-based anomaly detection," Empir. Softw. Eng., vol. 30, Art. no. 129, 2025, doi: 10.1007/s10664-025-10669-3.

[4] M. T. Abdelaziz et al., "Enhancing network threat detection with random forest -based NIDS and permutation feature importance," J. Netw. Syst. Manage., vol. 33, Art. no. 2, 2024, doi: 10.1007/s10922-024-09874-0.

[5] A. Ahmed, M. Asim, I. Ullah, Zainulabidin, and A. A. Ateya, "An optimized ensemble model with advanced feature selection for network intrusion detection," PeerJ Comput. Sci., vol. 10, Art. no. e2472, 2024, doi: 10.7717/peerj-cs.2472.

[6] C. K. K. Reddy, P. A. Reddy, P. S. Reddy, M. Shuaib, S. Alam, S. Ahmad, and A. Rajaram, "Twined ensemble framework for network security: integrating Random Forest, AdaBoost, and Gradient Boosting for enhanced intrusion detection," Discover Internet Things, vol. 5, 2025, doi: 10.1007/s43926-025-00199-1.

[7] P. Azizidoost, S. Sarhsan Moghadam, E. Khezri, A. Basem, and M. Trik, "A new intrusion detection method using ensemble classification and feature selection," Sci. Rep., vol. 15, Art. no. 13642, 2025, doi: 10.1038/s41598-025-98604-w.

[8] S. A. Almahaqeri, M. H. Almourish, A. A. Nasser, A. S. A. Alghawli, A. A. K. Elsayed, and A. N. Alhejoj, "An optimized gradient boosting framework for IoT intrusion detection: a comprehensive evaluation on the CICIoT2023 dataset," Sci. Rep., vol. 16, 2026, doi: 10.1038/s41598-026-47399-5.

[9] A. Alharthi, M. Alaryani, and S. Kaddoura, "A comparative study of machine learning and deep learning models in binary and multiclass classification for intrusion detection systems," Array, vol. 26, Art. no. 100406, 2025, doi: 10.1016/j.array.2025.100406.

[10] M. Sajid, K. R. Malik, A. Almogren, T. S. Malik, A. H. Khan, J. Tanveer, and A. U. Rehman, "Enhancing intrusion detection: a hybrid machine and deep learning approach," J. Cloud Comput., vol. 13, Art. no. 123, 2024, doi: 10.1186/s13677-024-00685-x.

[11] A. Qaddos, M. U. Yaseen, A. S. Al Shamayleh, M. Imran, A. Akhunzada, and Z. S. Alharthi, "A novel intrusion detection framework for optimizing IoT security," Sci. Rep., vol. 14, Art. no. 21789, 2024, doi: 10.1038/s41598-024-72049-z.

[12] M. Umer, M. Tahir, M. Sardaraz, M. Sharif, H. Elmannai, and A. D. Algarni, "Network intrusion detection model using wrapper -based feature selection and multi head attention transformers," Sci. Rep., vol. 15, Art. no. 28718, 2025, doi: 10.1038/s41598-025-11348-5.

[13] M. S. Ataa, E. E. Sanad, and R. A. El khoribi, "Intrusion detection in software defined network using deep learning approaches," Sci. Rep., vol. 14, Art. no. 29159, 2024, doi: 10.1038/s41598-024-79001-1.

[14] L. Ofusori, T. Bokaba, and S. Mhlongo, "Artificial intelligence in cybersecurity: A comprehensive review and future direction," Appl. Artif. Intell., vol. 38, no. 1, Art. no. 2439609, 2024, doi: 10.1080/08839514.2024.2439609.

[15] P. Himler, M. Landauer, F. Skopik, and M. Wurzenberger, "Anomaly detection in log event sequences: A federated deep learning approach and open challenges," Mach. Learn. Appl., vol. 16, Art. no. 100554, 2024, doi: 10.1016/j.mlwa.2024.100554.

[16] P. Han, H. Li, G. Xue, and C. Zhang, "Distributed system anomaly detection using deep learning based log analysis," Comput. Intell., vol. 39, no. 3, pp. 433–455, 2023, doi: 10.1111/coin.12573.

[17] X. Ye et al., "Research on insider threat detection based on personalized federated learning and behavior log analysis," Sci. Rep., vol. 15, Art. no. 19214, 2025, doi: 10.1038/s41598-025-04029-w.

[18] D. Goyal, S. K. Singh, S. Kumar, V. Chilkoti, K. T. Chui, C. H. Hsu, and B. B. Gupta, "An explainable AI framework for intrusion detection using SHAP and LIME," in Proc. 14th IEEE Global Conf. Consum. Electron. (GCCE), Osaka, Japan, 2025, pp. 1315–1319, doi: 10.1109/GCCE65946.2025.11275089.

[19] M. Pawlicki, A. Pawlicka, S. Szelest, R. Kozik, and M. Choraś, "Class based SHAP analysis for improved explainability insights in NIDS," in Applied Intelligence (ICAI 2024), Commun. Comput. Inf. Sci., vol. 2387. Singapore: Springer, 2025, pp. 303–313, doi: 10.1007/978-981- 96-1907-8_29.

[20] S. Gupta and B. Singh, "An intelligent multi -layer framework with SHAP integration for botnet detection and classification," Comput. Secur., vol. 140, Art. no. 103783, 2024, doi: 10.1016/j.cose.2024.103783.

[21] D. Gaspar, P. Silva, and C. Silva, "Explainable AI for intrusion detection systems: LIME and SHAP applicability on multi -layer perceptron," IEEE Access, vol. 12, pp. 30164 –30175, 2024, doi: 10.1109/ACCESS.2024.3368377.

[22] F. Jalalvand, M. Baruwal Chhetri, S. Nepal, and C. Paris, "Alert prioritisation in security operations centres: A systematic survey on criteria and methods," ACM Comput. Surv., vol. 57, no. 2, pp. 1 –36, 2024, doi: 10.1145/3695462.

[23] J. Ghadermazi, A. Shah, and J. Jajodia, "A machine learning and optimization framework for efficient alert management in a cybersecurity operations center," ACM Digit. Threats: Res. Pract., vol. 5, no. 2, pp. 1–23, 2024, doi: 10.1145/3644393.

[24] M. A. Shyaa, N. F. Ibrahim, Z. Zainol, R. Abdullah, M. Anbar, and L. Alzubaidi, "Evolving cybersecurity frontiers: A comprehensive survey on concept drift and feature dynamics aware machine and deep learning in intrusion detection systems," Eng. Appl. Artif. Intell., vol. 137, Art. no. 109143, 2024, doi: 10.1016/j.engappai.2024.109143.

[25] G. Apruzzese, A. Fass, and F. Pierazzi, "When adversarial perturbations meet concept drift: An exploratory analysis on ML NIDS," in Proc. 2024 Workshop Artif. Intell. Security (AISec), 2024, pp. 149–160, doi: 10.1145/3689932.3694757.

[26] J. Fang and C. Xie, "Unknown intrusion traffic detection method based on unsupervised learning and open set recognition," Sci. Rep., vol. 15, Art. no. 17001, 2025, doi: 10.1038/s41598-025-01084-1.

[27] G. Y. Shin, D. W. Kim, and M. M. Han, "Open set recognition with dissimilarity weight for unknown attack detection," IEEE Access, vol. 11, pp. 102381–102390, 2023, doi: 10.1109/ACCESS.2023.3277871.

[28] J. Vitorino, I. Praça, and E. Maia, "SoK: Realistic adversarial attacks and defenses for intelligent network intrusion detection," Comput. Secur., vol. 134, Art. no. 103433, 2023, doi: 10.1016/j.cose.2023.103433.

[29] A. Alotaibi and M. A. Rassam, "Adversarial machine learning attacks against intrusion detection systems: A survey on strategies and defense," Future Internet, vol. 15, no. 2, Art. no. 62, 2023, doi: 10.3390/fi15020062.

[30] S. Uno, H. Noma, and M. Gosho, "Firth type penalized methods of the modified Poisson and least squares regression analyses for binary outcomes," Biometrical J., vol. 66, no. 4, Art. no. e202400004, 2024, doi: 10.1002/bimj.202400004.

[31] S. Suhas et al., "Firth’s penalized logistic regression: a superior approach for analysis of data from India’s National Mental Health Survey, 2016," Indian J. Psychiatry, vol. 65, no. 11, pp. 1208 –1213, 2023, doi: 10.4103/indianjpsychiatry.indianjpsychiatry_827_23.

[32] G. Heinze, R. Puhr, and D. Dunkler, logistf: Firth’s bias reduced logistic regression, R package version 1.26.1, 2025. [Online]. Available: https://cran.r -project.org/package=logistf, accessed Aug. 20, 2026.

[33] E. C. P. Neto, S. Dadkhah, R. Ferreira, A. Zohourian, R. Lu, and A. A. Ghorbani, "CICIoT2023: A real time dataset and benchmark for large scale attacks in IoT environment," Sensors, vol. 23, no. 13, Art. no. 5941, 2023, doi: 10.3390/s23135941.

[34] M. Ring, S. Wunderlich, D. Grüdl, D. Landes, and A. Hotho, "Creation of flow based data sets for intrusion detection," J. Univers. Comput. Sci., vol. 23, no. 11, pp. 1087–1113, 2017, doi: 10.3217/jucs-023-11- 1087.

Downloads

Published

2026-10-31

How to Cite

[1]
F. Kifaru, D. Mwakiposa, and S. S. Madila, “An Auditable Hybrid Cascade for Network Threat Detection”, JUTEI, vol. 10, no. 2, pp. 105–114, Oct. 2026.

Issue

Vol. 10 No. 2 (2026): Jurnal Terapan Teknologi Informasi

Section

Articles

License

Copyright (c) 2026 Frowin Kifaru, Daniel Mwakiposa, Shadrack Stephen Madila

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License.

Authors who publish articles in JUTEI agree on the following rules:
1. The author grants non exclusive royalty free rights, and is willing to publish articles online and complete (full access). With such rights JUTEI reserves the right to save, transfers, manages in various forms, maintains and publishes articles while keeping the author's name as the copyright owner.
2. Each author contained in the article has contributed fully to the substance and intellectual, and is accountable to the public. If in the future there is a copyright infringement notification then this will be responsibility of the author, not JUTEI.

Similar Articles

1 2 3 > >> 

You may also start an advanced similarity search for this article.