LF-TSE-IDS: An Imbalance-Aware Leakage-Free Temporal Stacking Ensemble for Multiclass Network Intrusion Detection

Abstract

Network intrusion detection remains challenging because of highly imbalanced traffic classes, evolving attack behaviors, temporal dependencies, and data leakage during model development. This study proposes LF-TSE-IDS, an imbalance-aware leakage-free temporal stacking ensemble for multiclass network intrusion detection. The framework preprocesses CICIDS2017 traffic performs five-tuple-based grouping and timestamp ordering, and constructs overlapping temporal windows with a sequence length of 20 and stride of 3. Class imbalance is addressed using class-weighted focal loss for deep models and training-only SMOTE for static learners. BiGRU-Attention and Dilated 1D-CNN capture sequential traffic characteristics, whereas Balanced Random Forest and XGBoost model static nonlinear relationships. Their class-probability outputs are integrated through five-fold out-of-fold stacking using a Logistic Regression meta-learner. Experimental results show that LF-TSE-IDS achieves 97.20% test accuracy, 97.18% weighted-F1, 0.9392 MCC, 0.9952 micro-ROC-AUC, and 0.9356 macro-PR-AUC. The framework therefore provides reliable generalization, reduced stacking bias, and robust multiclass intrusion detection.