An Energy-Efficient Cascaded Machine Learning Framework for Predictive Network Anomaly Detection

The escalating complexity and scale of modern network infrastructures have amplified the need for intelligent intrusion detection systems (IDS) capable of identifying malicious traffic in real time. The growing environmental footprint of computational processes demands that such systems operate within sustainable energy budgets. This paper presents GreenShield, a two-stage cascaded machine learning framework designed to achieve high detection accuracy while minimizing computational energy consumption. The framework employs a lightweight Decision Tree classifier as the first-stage filter to handle high-confidence predictions efficiently, escalating only uncertain samples to a more resource-intensive Random Forest classifier in the second stage. Comprehensive experiments are conducted on a network traffic dataset modeled after the NSL-KDD benchmark, evaluating six machine learning classifiers: Decision Tree, Random Forest, Gradient Boosting, Support Vector Machine, Logistic Regression, and K-Nearest Neighbors. Each model is assessed across multiple dimensions, including detection accuracy, precision, recall, F1-score, training time, inference latency, memory consumption, and estimated energy usage measured in milliwatt-hours. The proposed GreenShield framework achieves an F1-score of 0.9687, comparable to the standalone Random Forest (0.9704), while requiring significantly less computational energy for inference by resolving 98.5% of samples at the lightweight first stage. A sustainability efficiency metric is introduced to quantify the trade-off between classification performance and energy cost. Results demonstrate that GreenShield offers a favorable balance between accuracy and sustainability, making it suitable for deployment in energy-constrained network environments. This work contributes to the growing body of research on Green AI by providing evidence that cascaded classification architectures can reduce the environmental impact of network security operations without sacrificing protective capability.