  In the last decades, researchers, practitioners and companies struggled in
devising mechanisms to detect malicious activities originating security
threats. Amongst the many solutions, network intrusion detection emerged as one
of the most popular to analyze network traffic and detect ongoing intrusions
based on rules or by means of Machine Learners (MLs), which process such
traffic and learn a model to suspect intrusions. Supervised MLs are very
effective in detecting known threats, but struggle in identifying zero-day
attacks (unknown during learning phase), which instead can be detected through
unsupervised MLs. Unfortunately, there are no definitive answers on the
combined use of both approaches for network intrusion detection. In this paper
we first expand the problem of zero-day attacks and motivate the need to
combine supervised and unsupervised algorithms. We propose the adoption of
meta-learning, in the form of a two-layer Stacker, to create a mixed approach
that detects both known and unknown threats. Then we implement and empirically
evaluate our Stacker through an experimental campaign that allows i) debating
on meta-features crafted through unsupervised base-level learners, ii) electing
the most promising supervised meta-level classifiers, and iii) benchmarking
classification scores of the Stacker with respect to supervised and
unsupervised classifiers. Last, we compare our solution with existing works
from the recent literature. Overall, our Stacker reduces misclassifications
with respect to (un)supervised ML algorithms in all the 7 public datasets we
considered, and outperforms existing studies in 6 out of those 7 datasets. In
particular, it turns out to be more effective in detecting zero-day attacks
than supervised algorithms, limiting their main weakness but still maintaining
adequate capabilities in detecting known attacks.
