---
title: Multi-Tiered Hybrid IDS
url: https://www.emergentmind.com/topics/multi-tiered-hybrid-intrusion-detection-system-mth-ids
type: topic
---

# Multi-Tiered Hybrid IDS

Searching arXiv for the cited MTH-IDS and closely related hybrid IDS papers to ground the article in current arXiv records.
A Multi-Tiered Hybrid Intrusion Detection System (MTH-IDS) is an intrusion-detection architecture that decomposes detection into multiple cooperating stages and combines heterogeneous detection paradigms—most commonly signature-based or misuse-oriented classification with anomaly-based or unsupervised detection—in order to detect both known and unknown attacks. In the literature, this designation does not refer to a single canonical algorithm. Rather, it denotes a family of staged systems in which earlier tiers perform filtering, coarse discrimination, or anomaly flagging, and later tiers perform verification, refinement, categorization, or incremental adaptation. Representative instantiations include a four-stage Internet-of-Vehicles framework that couples stacked supervised models with cluster-based zero-day detection [2105.13289], a five-level SDN cascade over flow statistics [1806.03875], and an incremental DNN–KNN architecture that uses active learning over sliding windows to adapt to previously unseen attacks [2310.17430].

## 1. Architectural definition and scope

The defining property of MTH-IDS is tiering: detection is not executed as a single flat classifier, but as a sequence of specialized modules with distinct roles. In the Internet-of-Vehicles formulation, end-to-end processing is decomposed into four stages: data pre-processing, feature engineering, a signature-based IDS for known attacks, and an anomaly-based IDS for zero-day attacks [2105.13289]. In the SDN formulation, the architecture is a five-tier, one-vs-all cascade in which Tier 1 detects DoS by kNN, Tier 2 detects Probe by ELM, Tiers 3 and 4 detect U2R and R2L by H-ELM, and Tier 5 distinguishes Unknown from Normal [1806.03875]. In the near-autonomous streaming formulation, the system is organized into four cooperating tiers: data pre-processing, a supervised DNN detector, an unsupervised KNN anomaly detector, and an active-learning incremental update module [2310.17430].

Hybridization is equally central. In one line of work, “hybrid” means the combination of signature-based IDS and anomaly-based IDS so that the former addresses known signatures while the latter covers zero-day patterns outside the signatures [2105.13289]. In another, it denotes the combination of anomaly detection and misuse detection in sequence, with anomalies verified or refined by a later module to reduce false positives [1910.12074]. Earlier hybrid systems also combined an artificial immune system with a Kohonen Self-Organising Map so that anomalous connections were first detected and then categorized into higher-level attack classes [1208.0541].

This literature suggests that MTH-IDS is better understood as an architectural principle than as a fixed model family. The common structure is a decomposition of the IDS problem into separable subproblems—screening, anomaly discovery, class-specific recognition, uncertainty handling, or post hoc attack labeling—implemented across multiple tiers.

## 2. Data path, preprocessing, and feature representation

Despite architectural variation, MTH-IDS designs typically begin with aggressive preprocessing and compact feature construction. In the incremental DNN–KNN system, raw packets are aggregated into bi-directional flows, records with missing values are removed, and each numeric feature is standardized by
$$
x' = (x - \mu)/\sigma
$$
before standardized feature vectors are emitted for the current sliding window $SW_t$ [2310.17430]. The vehicular MTH-IDS likewise uses Z-score normalization,
$$
x_n = (x - \mu)/\sigma,
$$
combined with k-means cluster sampling, SMOTE oversampling, and a feature-engineering stage composed of an Information-Gain filter, a Fast Correlation-Based Filter, and Kernel PCA [2105.13289].

Feature representation is domain-specific. The SDN system uses exactly six flow-based features available from an OpenFlow-based controller: duration of flow, protocol type, source bytes, destination bytes, count, and srv\_count; each feature is normalized to $[0,1]$ before training [1806.03875]. The streaming DNN detector uses $d=77$ pre-computed flow features as input to its supervised module [2310.17430]. In the AIS–SOM system, each incoming TCP/UDP connection is mapped to a real-valued connection vector made up of both discrete and interval features, and the SOM uses $m=18$ features in the KDD’99 experiments [1208.0541].

More recent cyber-physical variants widen the notion of tiered sensing. In electric-vehicle charging infrastructure, the NIDS tier uses flow-level and packet-level captures of OCPP and ISO 15118 traffic, while the HIDS tier uses hardware performance counters, kernel event logs, and optionally power-consumption time series [2606.23236]. This suggests that “multi-tier” may also refer to sensor provenance and decision fusion, not only to serial classifier depth.

## 3. Detection mechanisms across tiers

MTH-IDS architectures combine supervised, unsupervised, and heuristic selection mechanisms in different proportions. In the IoV system, the signature-based subsystem consists of four tree-based classifiers—DT, RF, ET, and XGBoost—followed by BO-TPE hyper-parameter tuning and a stacking meta-learner. The anomaly-based subsystem uses cluster-labeling k-means, then routes uncertain cases to two biased classifiers: one trained on false negatives and balanced normal samples, and one trained on false positives and balanced attack samples [2105.13289]. The CL-k-means stage solves
$$
\min_{C_1,\dots,C_K}\;\sum_{k=1}^K\sum_{x_i\in C_k}\|x_i-\mu_k\|^2,
$$
labels clusters by majority class, computes a cluster-confidence score $p_i$, and forwards samples with $p_i<p^*$ to the biased correction stage; in the reported system, $p^*$ is tuned to $0.933$ by BO-GP [2105.13289].

The incremental hybrid IDS uses a fully connected DNN for binary normal-versus-attack discrimination and a KNN module for outlier discovery. The DNN has 77 input neurons, four hidden layers of sizes $256 \rightarrow 128 \rightarrow 64 \rightarrow 32$ with ReLU activation, and a two-neuron softmax output layer. It is trained with weighted cross-entropy, with $w_0=1$ for normal and $w_1=10$ for attack samples, using Adam with learning rate $\eta=0.001$, $\beta_1=0.9$, $\beta_2=0.999$, early stopping on validation loss, and batch size $32$ [2310.17430]. The KNN anomaly detector computes Euclidean distance in the standardized feature space and assigns each sample an outlierness score
$$
os(x)=\|x-N_k(x)\|_2
$$
with $k=100$ neighbors [2310.17430].

Active learning is the key mechanism that makes this system near-autonomous. Uncertainty is defined as
$$
U(x)=1-\hat p(x),
$$
where $\hat p(x)=\max_k p_\theta(y=k\mid x)$, and the query set is formed by taking the top $n/2$ samples by uncertainty and the top $n/2$ by outlierness:
$$
I_t=\text{top-}n/2\{U(x)\}\;\cup\;\text{top-}n/2\{os(x)\}.
$$
The labeled pool grows as
$$
L_t=L_{t-1}\cup I_t,
$$
and the DNN is fine-tuned once per window on the cumulative labeled set [2310.17430].

Other MTH-IDS variants instantiate different hybrid logics. The AIS–SOM system uses negative selection in the first tier, where a detector matches a connection vector if all specified interval and discrete conditions are satisfied, and a new connection is flagged as anomalous if there exists a detector that matches it. Only anomalous connections are passed to the SOM, which assigns them to a winning neuron and outputs the neuron’s class label among DoS, Probe, R2L, and U2R [1208.0541]. The sequential hybrid model uses two anomaly detectors in parallel—a feed-forward neural net and a 100-tree Random Forest—followed by a k-means misuse stage that either filters a false positive by assigning the sample to a normal centroid or outputs one of 24 fine-grained intrusion classes [1910.12074].

## 4. Canonical variants and domain-specific instantiations

The literature contains several distinct MTH-IDS realizations that differ in domain, number of tiers, and the meaning of “hybrid.” The following overview organizes the main variants discussed in the arXiv literature.

| System | Tiering pattern | Main hybridization |
|---|---|---|
| IoV MTH-IDS [2105.13289] | Four stages | Signature-based IDS + anomaly-based IDS |
| SDN MTH-IDS [1806.03875] | Five-level cascade | kNN + ELM + H-ELM |
| Incremental IDS [2310.17430] | Four tiers over sliding windows | DNN + KNN + active learning |
| AIS–SOM hybrid [1208.0541] | Two stages | Artificial immune system + SOM |
| Sequential hybrid model [1910.12074] | Three stages | NN + RF anomaly fusion + k-means misuse |
| EVCS hybrid IDS [2606.23236] | Dual-layer integration | NIDS + HIDS decision fusion |

The IoV formulation is the most explicit use of the name “MTH-IDS” on arXiv. Its packet-sniffer-to-decision path places a signature-based detector before the anomaly subsystem, so traffic classified as attack by the signature tier can be emitted immediately, whereas traffic labeled normal is forwarded to the anomaly tier for zero-day analysis [2105.13289]. By contrast, the SDN variant is a one-vs-all classifier cascade over flow statistics, where positive detections are removed at each stage and only “Other” traffic proceeds deeper into the system [1806.03875].

Related systems show how the MTH-IDS pattern generalizes. The EVCS architecture uses dual-layer fusion rather than a strict serial cascade: NIDS and HIDS process network and host streams independently, each outputting a class label plus confidence probability, and the final decision is fused by a logical OR; if both tiers disagree on attack class, both labels are forwarded to the operator for triage [2606.23236]. FAST-IDS, although presented as a “two-stage intrusion detection system,” continues the same staged design logic in the CAV setting: an unsupervised BiGAN performs coarse anomaly detection and a CNN–LSTM classifies anomalous sequences into 19 known attack types, with structural pruning and static quantization for deployment in resource-constrained environments [2512.24391].

## 5. Empirical performance and operational characteristics

Reported performance indicates that MTH-IDS designs can achieve strong detection on known attacks while preserving some capacity for unknown-attack discovery, but results are strongly architecture- and dataset-dependent. In the Internet-of-Vehicles framework, known-attack detection reaches 99.999% accuracy on the CAN-intrusion-dataset and 99.879% accuracy on CICIDS2017 in 10-fold cross-validation; on 30% unseen hold-out data, the reported accuracies are 99.99% for CAN and 99.88% for CICIDS. For zero-day detection, the reported average $F_1$ scores are 0.96307 on CAN and 0.80013 on CICIDS2017 [2105.13289].

The incremental DNN–KNN system on CICIDS2017 reports that with $n=600$ queries per window, corresponding to approximately 13% of the full training set, the held-out AUC is approximately 0.98, essentially matching an offline DNN trained on 100% of the labels. Known-attack detection remains above 0.99 AUC almost throughout, while unknown-attack AUC drops when a new family first appears—often below 0.6—but recovers within 2–3 windows to above 0.95 after active learning and DNN updating. The false positive rate on benign flows remains below 2% during adaptation [2310.17430].

The SDN five-level cascade achieves overall testing accuracy of 84.29%, false alarm rate of 6.30%, precision of 94.18%, recall of 77.18%, and $F_1$ score of 84.83% on NSL-KDD, outperforming the conventional supervised baselines listed in that study on overall accuracy and $F_1$ [1806.03875]. The earlier AIS–SOM hybrid reports an AIS false positive rate of at most 0.6% on 19,100 normal test connections, combined DoS detection-and-classification of approximately 96.8%, and U2R detection-and-classification of approximately 34.6% on KDD 1999 [1208.0541].

Results in more recent cyber-physical settings are heterogeneous. In EV charging infrastructure, the NIDS flow-level XGBoost reaches 99.99% accuracy, 99.98% precision, 99.96% recall, and 99.97% $F_1$ score, with prediction time of 0.706 $\mu$s per sample, whereas the HIDS based on host events reaches 96.60% accuracy and 85.31% $F_1$ score, the power-data HIDS reaches 70.34% accuracy and 70.57% $F_1$ score, and the end-to-end hybrid IDS after decision fusion reports 83.47% accuracy and 81.47% $F_1$ score [2606.23236]. This is a useful reminder that near-perfect performance of one tier does not automatically transfer to the integrated system.

Real-time feasibility is a recurring design target. The IoV MTH-IDS reports total average per-packet processing time of approximately 0.51–0.57 ms on a Raspberry Pi 3, well below a 10 ms requirement, with model memory footprints of 2.61 MB for the CAN IDS and 16.21 MB for the CICIDS IDS [2105.13289]. FAST-IDS reports model compression from 12.3 MB to 2.8 MB, a 77.2% reduction, and approximately 50.05% inference-time reduction across RTX A6000, Google Colab CPU, and Jetson Nano deployments [2512.24391].

## 6. Limitations, misconceptions, and research directions

A common misconception is that “hybrid” implies a single standard combination such as anomaly detection plus misuse detection. The literature is broader. Hybridization may denote signature-based plus anomaly-based analysis [2105.13289], anomaly screening followed by unsupervised attack categorization [1208.0541], two anomaly detectors fused by logical OR and then verified by a misuse stage [1910.12074], or supervised classification coupled with unsupervised outlier mining and active learning [2310.17430]. Likewise, “multi-tiered” may mean a serial cascade, a dual-layer fusion system, or an incremental loop over sliding windows.

Another misconception is that multi-tiering uniformly lowers false positives while preserving all detection gains. The evidence is mixed. The sequential hybrid model explicitly motivates its misuse stage as a false-positive filter and reports that the final hybrid reduces false positives, boosting precision further, although the improvement is described as implied rather than fully tabulated [1910.12074]. By contrast, the SDN cascade still reports an overall false alarm rate of 6.30% [1806.03875], and the EVCS study shows that an integrated hybrid can have lower overall end-to-end accuracy than a very strong standalone network tier because the scope of detection broadens from network-only attacks to combined network and host attacks [2606.23236].

Dataset choice remains a substantive issue. The sequential hybrid model explicitly notes that the synthetic nature of KDD’99 yields inflated accuracies and that real traffic may behave differently [1910.12074]. This caution is relevant to older hybrid IDS results on KDD 1999 and NSL-KDD [1208.0541], [1806.03875]. A plausible implication is that MTH-IDS evaluation should be read not only through headline accuracy but also through operational assumptions: attack taxonomy, class imbalance, novelty protocol, hold-out design, and whether the architecture is tested under streaming or deployment-constrained conditions.

Research directions in the cited works converge on adaptivity. The IoV system states that the unsupervised front-end may be replaced by other clustering methods if data shape requires, and that online learning could be added to adapt to concept drift [2105.13289]. The sequential hybrid model proposes adaptive thresholding or density-based clustering for the misuse stage, deeper neural architectures or autoencoders for anomaly scoring, and extension to real-time streaming data with evolving signatures online [1910.12074]. The incremental DNN–KNN system already operationalizes one route to this objective through sliding windows, cumulative labeled pools, and per-window retraining, thereby treating IDS maintenance as a continual learning problem rather than a one-time offline training step [2310.17430].

Within this trajectory, MTH-IDS occupies a specific position in IDS research: it is a layered systems strategy for reconciling high-performance recognition of known attacks with some degree of resilience to novelty, uncertainty, domain heterogeneity, and deployment constraints. The exact benefits depend on how its tiers are composed, what information each tier receives, and how adaptation is implemented.

Source: https://www.emergentmind.com/topics/multi-tiered-hybrid-intrusion-detection-system-mth-ids