A Stream Learning Intrusion Detection System for Concept Drifting Network Traffic
Pedro Horchulhack, Eduardo K. Viegas, Martin Andreoni Lopez · 2022
Network-based intrusion detection is a widely explored topic in the literature. Yet, despite the promising reported results, designed schemes are rarely used in production environments. Apart from evolving as time passes, the behavior of network traffic varies significantly, rendering proposed schemes unreliable for real-world application. This paper proposes a new stream learning intrusion detection aiming for feasible model updates, implemented in three phases. First, intrusion detection is performed through a stream learning classifier, enabling incremental model updates to be performed. Second, new network traffic behavior is identified through a one-class learner. Third, identified new network traffic is incrementally incorporated into our system. Experiments performed on a dataset containing evolving network traffic behavior have shown our proposal feasibility, reaching up to 96% of accuracy while demanding only 48% of labeled events to be provided.