A hybrid inference pipeline for IDS: Combining DNNs and XGBoost through stacking for real-world intrusion detection

Project publication · Ad Hoc Networks

Summary

The article proposes a hybrid inference pipeline for intrusion detection that combines DNN models, a RandomForest meta-learner and multiclass classification with XGBoost.

Latencia y rendimiento de inferencia de la tubería IDS híbrida — Figure 13. Inference latency and throughput on WSL Ubuntu and Jetson Nano by window size. Source: Ad Hoc Networks / Elsevier; reproduced with attribution under CC BY-NC 4.0.

Authors: Antonio Villafranca, Maria-Dolores Cano

Journal: Ad Hoc Networks, volumen 188, artículo 104227

DOI: 10.1016/j.adhoc.2026.104227

Funding: PID2023-148214OB-C21.

Editorial note: The project funding is recorded in the editorial corrigendum associated with the article: 10.1016/j.adhoc.2026.104272.

Main contribution

The contribution integrates deep learning and hierarchical ensembling to maintain high accuracy without losing operational feasibility. The design covers data preparation and training through to inference on GPUs and embedded platforms.

Resultados y alcance

La evaluación sobre tráfico real muestra que el apilamiento de redes profundas y XGBoost mejora la robustez frente a modelos individuales y permite combinar representaciones complementarias. El rendimiento sigue condicionado por el equilibrio de clases, la deriva del tráfico y la capacidad de generalizar a ataques no observados.

Link with BoND1

The link with BoND1 is in the cybersecurity line for IoT and edge: the approach helps detect malicious traffic in connected infrastructures and design adaptive defense mechanisms for non-cellular B6G networks.

DOI

Project publication Ad Hoc Networks

Summary

The paper proposes a hybrid inference pipeline for intrusion detection that combines DNN models, a RandomForest meta-learner, and multi-class classification with XGBoost.

Hybrid IDS pipeline inference latency and performance — Figure 13. Inference latency and performance on WSL Ubuntu and Jetson Nano based on window size. Source: Ad Hoc Networks / Elsevier; reproduced with attribution under CC BY-NC 4.0.

Authors: Antonio Villafranca, Maria-Dolores Cano

Journal: Ad Hoc Networks, volume 188, article 104227

DOI: 10.1016/j.adhoc.2026.104227

Funding: PID2023-148214OB-C21.

Publisher note: The financing of the project is included in the editorial corrigendum associated with the article: 10.1016/j.adhoc.2026.104272.

Bibliometric indicators

JCR quartileQ1

Impact factor5.4

Google Scholar citations3

JCR area: Computer Science, Information Systems
JCR year: 2025
Scholar query: 26 October 2026

Main contribution

The contribution is to integrate deep learning and hierarchical assembly to maintain high precision without losing operational viability. The design covers everything from data preparation and training to inference on GPUs and embedded platforms.

Results and scope

Evaluation on real traffic shows that stacking deep networks and XGBoost improves robustness against individual models and allows combining complementary representations. Performance is still influenced by class balance, traffic drift, and the ability to generalize to unobserved attacks.

Link with BoND1

The relationship with BoND1 appears in the line of cybersecurity for IoT and edge: the approach helps detect malicious traffic in connected infrastructures and design adaptive defense mechanisms for non-cellular B6G networks.

DOI

UPCT Repository: https://hdl.handle.net/10317/24194