A Concept Drift Based Ensemble Incremental Learning Approach for Intrusion Detection
Xiaoming Yuan, Ran Wang, Yi Zhuang, Kun Zhu, Jie Hao · 2018
Faced with various malicious intrusions, the design of intrusion detection system (IDS) has always being important in the area of network security. Recently, machine learning methods using network status data as input features are widely used to detect abnormality in the network. However, existing work does not consider the variance of the intrusions and thus is not robust to detect new types of intrusions. Therefore, considering the statistical properties of the status data change over time in unforeseen ways if intrusions occur, we propose a concept drift based ensemble incremental learning approach in IDS (CDIL). Concept drift detection technology is firstly used to detect the variance of the statistical properties of the status data in real time, and then an incremental learning is triggered to diagnose if an intrusion happens. In this way, CDIL can adapt the learning model to the changing input network status data in real time. We conduct extensive experiments on real-world network intrusion experimental data set and verify the effectiveness and real-time performance of the proposed CDIL; the accuracy of intrusion detection reaches up to 94.91%.