Multi-Tiered Hybrid IDS

• Multi-Tiered Hybrid Intrusion Detection System (MTH-IDS) is an architectural approach that decomposes intrusion detection into multiple stages combining signature-based and anomaly-based methods.
• It employs aggressive data preprocessing and layered feature engineering to efficiently detect both known attacks and emerging zero-day threats.
• Empirical evaluations show high detection accuracy and low false-positive rates across varied domains, with performance dependent on system design and dataset quality.

Searching arXiv for the cited MTH-IDS and closely related hybrid IDS papers to ground the article in current arXiv records. A Multi-Tiered Hybrid Intrusion Detection System (MTH-IDS) is an intrusion-detection architecture that decomposes detection into multiple cooperating stages and combines heterogeneous detection paradigms—most commonly signature-based or misuse-oriented classification with anomaly-based or unsupervised detection—in order to detect both known and unknown attacks. In the literature, this designation does not refer to a single canonical algorithm. Rather, it denotes a family of staged systems in which earlier tiers perform filtering, coarse discrimination, or anomaly flagging, and later tiers perform verification, refinement, categorization, or incremental adaptation. Representative instantiations include a four-stage Internet-of-Vehicles framework that couples stacked supervised models with cluster-based zero-day detection (Yang et al., 2021), a five-level SDN cascade over flow statistics (Latah et al., 2018), and an incremental DNN–KNN architecture that uses active learning over sliding windows to adapt to previously unseen attacks (Boukela et al., 2023).

1. Architectural definition and scope

The defining property of MTH-IDS is tiering: detection is not executed as a single flat classifier, but as a sequence of specialized modules with distinct roles. In the Internet-of-Vehicles formulation, end-to-end processing is decomposed into four stages: data pre-processing, feature engineering, a signature-based IDS for known attacks, and an anomaly-based IDS for zero-day attacks (Yang et al., 2021). In the SDN formulation, the architecture is a five-tier, one-vs-all cascade in which Tier 1 detects DoS by kNN, Tier 2 detects Probe by ELM, Tiers 3 and 4 detect U2R and R2L by H-ELM, and Tier 5 distinguishes Unknown from Normal (Latah et al., 2018). In the near-autonomous streaming formulation, the system is organized into four cooperating tiers: data pre-processing, a supervised DNN detector, an unsupervised KNN anomaly detector, and an active-learning incremental update module (Boukela et al., 2023).

Hybridization is equally central. In one line of work, “hybrid” means the combination of signature-based IDS and anomaly-based IDS so that the former addresses known signatures while the latter covers zero-day patterns outside the signatures (Yang et al., 2021). In another, it denotes the combination of anomaly detection and misuse detection in sequence, with anomalies verified or refined by a later module to reduce false positives (Pandey et al., 2019). Earlier hybrid systems also combined an artificial immune system with a Kohonen Self-Organising Map so that anomalous connections were first detected and then categorized into higher-level attack classes (Powers et al., 2012).

This literature suggests that MTH-IDS is better understood as an architectural principle than as a fixed model family. The common structure is a decomposition of the IDS problem into separable subproblems—screening, anomaly discovery, class-specific recognition, uncertainty handling, or post hoc attack labeling—implemented across multiple tiers.

2. Data path, preprocessing, and feature representation

Despite architectural variation, MTH-IDS designs typically begin with aggressive preprocessing and compact feature construction. In the incremental DNN–KNN system, raw packets are aggregated into bi-directional flows, records with missing values are removed, and each numeric feature is standardized by

$x' = (x - \mu)/\sigma$

before standardized feature vectors are emitted for the current sliding window $SW_t$ (Boukela et al., 2023). The vehicular MTH-IDS likewise uses Z-score normalization,

$x_n = (x - \mu)/\sigma,$

combined with k-means cluster sampling, SMOTE oversampling, and a feature-engineering stage composed of an Information-Gain filter, a Fast Correlation-Based Filter, and Kernel PCA (Yang et al., 2021).

Feature representation is domain-specific. The SDN system uses exactly six flow-based features available from an OpenFlow-based controller: duration of flow, protocol type, source bytes, destination bytes, count, and srv_count; each feature is normalized to $[0,1]$ before training (Latah et al., 2018). The streaming DNN detector uses $d=77$ pre-computed flow features as input to its supervised module (Boukela et al., 2023). In the AIS–SOM system, each incoming TCP/UDP connection is mapped to a real-valued connection vector made up of both discrete and interval features, and the SOM uses $m=18$ features in the KDD’99 experiments (Powers et al., 2012).

More recent cyber-physical variants widen the notion of tiered sensing. In electric-vehicle charging infrastructure, the NIDS tier uses flow-level and packet-level captures of OCPP and ISO 15118 traffic, while the HIDS tier uses hardware performance counters, kernel event logs, and optionally power-consumption time series (Joglekar et al., 22 Jun 2026). This suggests that “multi-tier” may also refer to sensor provenance and decision fusion, not only to serial classifier depth.

3. Detection mechanisms across tiers

MTH-IDS architectures combine supervised, unsupervised, and heuristic selection mechanisms in different proportions. In the IoV system, the signature-based subsystem consists of four tree-based classifiers—DT, RF, ET, and XGBoost—followed by BO-TPE hyper-parameter tuning and a stacking meta-learner. The anomaly-based subsystem uses cluster-labeling k-means, then routes uncertain cases to two biased classifiers: one trained on false negatives and balanced normal samples, and one trained on false positives and balanced attack samples (Yang et al., 2021). The CL-k-means stage solves

$$\min_{C_1,\dots,C_K}\;\sum_{k=1}^K\sum_{x_i\in C_k}\|x_i-\mu_k\|^2,$$

labels clusters by majority class, computes a cluster-confidence score $p_i$, and forwards samples with $p_i<p^*$ to the biased correction stage; in the reported system, $p^*$ is tuned to $SW_t$0 by BO-GP (Yang et al., 2021).

The incremental hybrid IDS uses a fully connected DNN for binary normal-versus-attack discrimination and a KNN module for outlier discovery. The DNN has 77 input neurons, four hidden layers of sizes $SW_t$1 with ReLU activation, and a two-neuron softmax output layer. It is trained with weighted cross-entropy, with $SW_t$2 for normal and $SW_t$3 for attack samples, using Adam with learning rate $SW_t$4, $SW_t$5, $SW_t$6, early stopping on validation loss, and batch size $SW_t$7 (Boukela et al., 2023). The KNN anomaly detector computes Euclidean distance in the standardized feature space and assigns each sample an outlierness score

$SW_t$8

with $SW_t$9 neighbors (Boukela et al., 2023).

Active learning is the key mechanism that makes this system near-autonomous. Uncertainty is defined as

$x_n = (x - \mu)/\sigma,$0

where $x_n = (x - \mu)/\sigma,$1, and the query set is formed by taking the top $x_n = (x - \mu)/\sigma,$2 samples by uncertainty and the top $x_n = (x - \mu)/\sigma,$3 by outlierness:

$x_n = (x - \mu)/\sigma,$4

The labeled pool grows as

$x_n = (x - \mu)/\sigma,$5

and the DNN is fine-tuned once per window on the cumulative labeled set (Boukela et al., 2023).

Other MTH-IDS variants instantiate different hybrid logics. The AIS–SOM system uses negative selection in the first tier, where a detector matches a connection vector if all specified interval and discrete conditions are satisfied, and a new connection is flagged as anomalous if there exists a detector that matches it. Only anomalous connections are passed to the SOM, which assigns them to a winning neuron and outputs the neuron’s class label among DoS, Probe, R2L, and U2R (Powers et al., 2012). The sequential hybrid model uses two anomaly detectors in parallel—a feed-forward neural net and a 100-tree Random Forest—followed by a k-means misuse stage that either filters a false positive by assigning the sample to a normal centroid or outputs one of 24 fine-grained intrusion classes (Pandey et al., 2019).

4. Canonical variants and domain-specific instantiations

The literature contains several distinct MTH-IDS realizations that differ in domain, number of tiers, and the meaning of “hybrid.” The following overview organizes the main variants discussed in the arXiv literature.

System	Tiering pattern	Main hybridization
IoV MTH-IDS (Yang et al., 2021)	Four stages	Signature-based IDS + anomaly-based IDS
SDN MTH-IDS (Latah et al., 2018)	Five-level cascade	kNN + ELM + H-ELM
Incremental IDS (Boukela et al., 2023)	Four tiers over sliding windows	DNN + KNN + active learning
AIS–SOM hybrid (Powers et al., 2012)	Two stages	Artificial immune system + SOM
Sequential hybrid model (Pandey et al., 2019)	Three stages	NN + RF anomaly fusion + k-means misuse
EVCS hybrid IDS (Joglekar et al., 22 Jun 2026)	Dual-layer integration	NIDS + HIDS decision fusion

The IoV formulation is the most explicit use of the name “MTH-IDS” on arXiv. Its packet-sniffer-to-decision path places a signature-based detector before the anomaly subsystem, so traffic classified as attack by the signature tier can be emitted immediately, whereas traffic labeled normal is forwarded to the anomaly tier for zero-day analysis (Yang et al., 2021). By contrast, the SDN variant is a one-vs-all classifier cascade over flow statistics, where positive detections are removed at each stage and only “Other” traffic proceeds deeper into the system (Latah et al., 2018).

Related systems show how the MTH-IDS pattern generalizes. The EVCS architecture uses dual-layer fusion rather than a strict serial cascade: NIDS and HIDS process network and host streams independently, each outputting a class label plus confidence probability, and the final decision is fused by a logical OR; if both tiers disagree on attack class, both labels are forwarded to the operator for triage (Joglekar et al., 22 Jun 2026). FAST-IDS, although presented as a “two-stage intrusion detection system,” continues the same staged design logic in the CAV setting: an unsupervised BiGAN performs coarse anomaly detection and a CNN–LSTM classifies anomalous sequences into 19 known attack types, with structural pruning and static quantization for deployment in resource-constrained environments (S et al., 30 Dec 2025).

5. Empirical performance and operational characteristics

Reported performance indicates that MTH-IDS designs can achieve strong detection on known attacks while preserving some capacity for unknown-attack discovery, but results are strongly architecture- and dataset-dependent. In the Internet-of-Vehicles framework, known-attack detection reaches 99.999% accuracy on the CAN-intrusion-dataset and 99.879% accuracy on CICIDS2017 in 10-fold cross-validation; on 30% unseen hold-out data, the reported accuracies are 99.99% for CAN and 99.88% for CICIDS. For zero-day detection, the reported average $x_n = (x - \mu)/\sigma,$6 scores are 0.96307 on CAN and 0.80013 on CICIDS2017 (Yang et al., 2021).

The incremental DNN–KNN system on CICIDS2017 reports that with $x_n = (x - \mu)/\sigma,$7 queries per window, corresponding to approximately 13% of the full training set, the held-out AUC is approximately 0.98, essentially matching an offline DNN trained on 100% of the labels. Known-attack detection remains above 0.99 AUC almost throughout, while unknown-attack AUC drops when a new family first appears—often below 0.6—but recovers within 2–3 windows to above 0.95 after active learning and DNN updating. The false positive rate on benign flows remains below 2% during adaptation (Boukela et al., 2023).

The SDN five-level cascade achieves overall testing accuracy of 84.29%, false alarm rate of 6.30%, precision of 94.18%, recall of 77.18%, and $x_n = (x - \mu)/\sigma,$8 score of 84.83% on NSL-KDD, outperforming the conventional supervised baselines listed in that study on overall accuracy and $x_n = (x - \mu)/\sigma,$9 (Latah et al., 2018). The earlier AIS–SOM hybrid reports an AIS false positive rate of at most 0.6% on 19,100 normal test connections, combined DoS detection-and-classification of approximately 96.8%, and U2R detection-and-classification of approximately 34.6% on KDD 1999 (Powers et al., 2012).

Results in more recent cyber-physical settings are heterogeneous. In EV charging infrastructure, the NIDS flow-level XGBoost reaches 99.99% accuracy, 99.98% precision, 99.96% recall, and 99.97% $[0,1]$0 score, with prediction time of 0.706 $[0,1]$1s per sample, whereas the HIDS based on host events reaches 96.60% accuracy and 85.31% $[0,1]$2 score, the power-data HIDS reaches 70.34% accuracy and 70.57% $[0,1]$3 score, and the end-to-end hybrid IDS after decision fusion reports 83.47% accuracy and 81.47% $[0,1]$4 score (Joglekar et al., 22 Jun 2026). This is a useful reminder that near-perfect performance of one tier does not automatically transfer to the integrated system.

Real-time feasibility is a recurring design target. The IoV MTH-IDS reports total average per-packet processing time of approximately 0.51–0.57 ms on a Raspberry Pi 3, well below a 10 ms requirement, with model memory footprints of 2.61 MB for the CAN IDS and 16.21 MB for the CICIDS IDS (Yang et al., 2021). FAST-IDS reports model compression from 12.3 MB to 2.8 MB, a 77.2% reduction, and approximately 50.05% inference-time reduction across RTX A6000, Google Colab CPU, and Jetson Nano deployments (S et al., 30 Dec 2025).

6. Limitations, misconceptions, and research directions

A common misconception is that “hybrid” implies a single standard combination such as anomaly detection plus misuse detection. The literature is broader. Hybridization may denote signature-based plus anomaly-based analysis (Yang et al., 2021), anomaly screening followed by unsupervised attack categorization (Powers et al., 2012), two anomaly detectors fused by logical OR and then verified by a misuse stage (Pandey et al., 2019), or supervised classification coupled with unsupervised outlier mining and active learning (Boukela et al., 2023). Likewise, “multi-tiered” may mean a serial cascade, a dual-layer fusion system, or an incremental loop over sliding windows.

Another misconception is that multi-tiering uniformly lowers false positives while preserving all detection gains. The evidence is mixed. The sequential hybrid model explicitly motivates its misuse stage as a false-positive filter and reports that the final hybrid reduces false positives, boosting precision further, although the improvement is described as implied rather than fully tabulated (Pandey et al., 2019). By contrast, the SDN cascade still reports an overall false alarm rate of 6.30% (Latah et al., 2018), and the EVCS study shows that an integrated hybrid can have lower overall end-to-end accuracy than a very strong standalone network tier because the scope of detection broadens from network-only attacks to combined network and host attacks (Joglekar et al., 22 Jun 2026).

Dataset choice remains a substantive issue. The sequential hybrid model explicitly notes that the synthetic nature of KDD’99 yields inflated accuracies and that real traffic may behave differently (Pandey et al., 2019). This caution is relevant to older hybrid IDS results on KDD 1999 and NSL-KDD (Powers et al., 2012, Latah et al., 2018). A plausible implication is that MTH-IDS evaluation should be read not only through headline accuracy but also through operational assumptions: attack taxonomy, class imbalance, novelty protocol, hold-out design, and whether the architecture is tested under streaming or deployment-constrained conditions.

Research directions in the cited works converge on adaptivity. The IoV system states that the unsupervised front-end may be replaced by other clustering methods if data shape requires, and that online learning could be added to adapt to concept drift (Yang et al., 2021). The sequential hybrid model proposes adaptive thresholding or density-based clustering for the misuse stage, deeper neural architectures or autoencoders for anomaly scoring, and extension to real-time streaming data with evolving signatures online (Pandey et al., 2019). The incremental DNN–KNN system already operationalizes one route to this objective through sliding windows, cumulative labeled pools, and per-window retraining, thereby treating IDS maintenance as a continual learning problem rather than a one-time offline training step (Boukela et al., 2023).

Within this trajectory, MTH-IDS occupies a specific position in IDS research: it is a layered systems strategy for reconciling high-performance recognition of known attacks with some degree of resilience to novelty, uncertainty, domain heterogeneity, and deployment constraints. The exact benefits depend on how its tiers are composed, what information each tier receives, and how adaptation is implemented.