Risk-Aware Ensemble Intrusion Detection for Multi-Stage IoT Attacks Using Attack Graph-Derived Features

Abstract

Internet of Things (IoT) deployments create highly connected environments in which heterogeneous devices, gateways, services, and cloud resources interact continuously. Conventional network intrusion detection systems generally classify packet, connection, or flow observations independently and therefore have limited awareness of whether an event belongs to a strategically important stage of a feasible attack path. This paper presents RAGE-IDS (Risk-Aware Graph-Enhanced Ensemble Intrusion Detection System), a context-aware framework that combines conventional traffic characteristics with attack graph-derived security-risk features for multi-stage IoT intrusion detection. The graph layer models feasible attacker progression through vulnerable assets and derives normalized degree centrality, betweenness centrality, closeness centrality, Common Vulnerability Scoring System (CVSS) severity, shortest attack-path length, feasible attack-path count, and a composite node-risk score. These graph descriptors are mapped to network observations and fused with dataset-specific traffic features. The resulting hybrid representation is supplied to complementary learners including Random Forest, Extra Trees, and XGBoost/gradient boosting, with weighted voting and stacked generalization used as ensemble strategies. The evaluation methodology is designed for NSL-KDD, UNSW-NB15, and CIC-IDS-2017 and explicitly controls data leakage, class imbalance, graph-mapping assumptions, hyperparameter optimization, and out-of-fold meta-learning. Accuracy, precision, recall, macro and weighted F1-score, AUC-ROC, false-positive rate, class-wise confusion, training time, inference latency, memory consumption, feature importance, and statistical significance are defined as evaluation criteria. The principal scientific contribution is the integration of explicit attack-path and vulnerability-risk context into an interpretable tabular ensemble IDS rather than the introduction of another isolated classifier. The manuscript further defines controlled ablation experiments that distinguish improvements caused by graph context from those caused by ensemble learning. Because no raw experiment logs were supplied with the source manuscript, numerical performance values are not invented; every result field that requires model execution is explicitly recorded as NR and the exact procedure required to obtain it is specified. This preserves reproducibility and research integrity while providing a complete, submission-oriented research manuscript.