The Use of Artificial-Intelligence-Based Ensembles for Intrusion Detection: A Review

Table 1

Summary of ensembles.

Optimization level	Ensemble learning phase	Ensemble level	Strategy adopted	Method employed
Decision optimization	Ensemble integration	Combination level	Fusion	Majority voting method [70–72]
				Threshold plurality vote method [73]
				Naïve Bayes method [74, 75]
				Fuzzy theory method [76, 77]
				Decision template method [78]
				Metalearning method [79]
				Hierarchically structured method [82, 83]
				Boolean combination method [2]
			Selection	The test and select method [71]
				Cascading classifiers method [85]
				Dynamic classifier selection method [86, 87]
				Clustering-based selection method [17, 45, 88, 91]
				Statistical selection method [89]
			Mixture of expert systems	Stochastic selection method [46]
				Winner-takes-all method [46]
				Weighting method [46]
Coverage optimization	Ensemble selection	Classifier level	Homogenous	Clustering-based selection method [17, 45, 88, 91]
				Threshold-based selection method [86]
			Heterogeneous	—
	Ensemble generation	Feature level	Feature selection/reduction	Random subspace method [46]
				The input decimation method [90]
				Genetic algorithms [92]
				Markov blanket BN [28]
				Principal component analysis [93]
				Information theory [16]
		Data level	Resampling	Bagging [61]
				Wagging [94]
				Random forest [95]
				Boosting [96]
				Stacking [79]
			Output code method	One per class (OPC) [97]
				Pairwise coupling [98]
				Correcting classifiers [99]
				Pairwise coupling correcting classifiers [99]
				Error-correcting output coding [100]
				Data-driven ECOC [101]