Enhancing Intrusion Detection Systems by Integrating Support Vector Machine and Random Forest Classifiers Using Dempster-Shafer Theory

The role of Intrusion Detection System (IDS) in defending the networks against the increasing stages of cyberattacks is critical. However, single machine learning models tend to be ineffective due to data imbalances, variability in attack patterns, and ambiguity in network traffic. To address these issues, this paper introduces a hybrid IDS architecture based on Support Vector Machine (SVM) and Random Forest (RF) classifiers, with evidence fusion using the Dempster-Shafer Theory (DST). The strategy leverages the high-quality boundary detection of SVM and the strength of an ensemble of RF. At the same time, DST offers a principled approach to dealing with uncertainty and integrating conflicting evidence. As a benchmark, the CSE-CIC-IDS2018 dataset, a set of labelled benign and multiple-attack traffic flows, was used. Stratified train-test partitioning with a fixed random seed, feature standardization, and class balancing using the Synthetic Minority Oversampling Technique (SMOTE) were considered data pre-processing steps for RF. An SVM trained and optimized with RAPIDS cuML on GPUs was trained and optimized via a grid search over selected hyperparameters. To unify the strengths of models, we further integrated classifier outputs using Dempster-Shafer Theory (DST), which transforms probabilistic outputs into belief assignments and yields an ultimate decision based on the belief assignment with the highest value. The models exhibit high predictive ability, as demonstrated by the experimental results. The DST-based fusion outperformed the two individual classifiers, achieving 97.84% accuracy, 97.41% precision, 94.96% recall, and 96.17% F1-score. In this paper, we show that combining classifiers using DST results in a substantial, computable gain over single-model methods. It is the novelty of using DST-based IDS fusion as well to enhance robustness and balanced detection. These results confirm the value of DST-based fusion in improving IDS performance. These results confirm that combining SVM and RF with DST yields a more robust, reliable IDS. In addition to improving the capability for precise threat discovery, this approach also has certain implications for uncertainly evolving network circumstances, highlighting its suitability for actual-world cybersecurity applications.