An Incremental Learning Method Based on Dynamic Ensemble RVM for Intrusion Detection

Abstract

Due to the dynamic changes of network data over time, static intrusion detection systems cannot adapt well to the behavioral characteristics of the input network data, resulting in reduced detection accuracy. In addition, continuous input data streams will bring huge challenges to resource storage and computing costs. Therefore, we propose an intrusion detection method of dynamic ensemble incremental learning (DEIL-RVM), and realize a dynamically adjusted ensemble intrusion detection model. In which a new overall misclassification probability weight value (OMPW) based on incremental set or data chunk is designed as the basis for updating the ensemble model, and it can be used to prune and replace the poor base component in the ensemble model. We presented a probabilistic decision function taking into account the posterior probability of each base RVM model dividing the sample into each category. The RVM with high sparsity is used as the base component to obtain the good balance between the accuracy, robustness and resource consumption, which can sacrifice less time and storage cost in ensemble incremental learning while achieving higher detection accuracy and stability in network data streams.

The Missing Link in Network Intrusion Detection: Taking AI/ML Research Efforts to Users

“…[120], [121], [122], [123], [124], [125], [126], [127], [128], [129], [130], [131], [132], [133], [134], [135], [136], [137], [138], [139], [140], [141], [142], [143], [144], [145], [146], [147], [148], [149], [150], [151], [152], [153], [154], [155], [156], [157], [158] Privacy and Security (42 papers ∼ 25.3%) CCS 13 7.8 %…”

Zero-Day Guardian: A Dual Model Enabled Federated Learning Framework for Handling Zero-Day Attacks in 5G Enabled IIoT

“…Wu et al [30], in their study, devised an intrusion detection method based on dynamic ensemble incremental learning. While this approach is capable of adapting to newly discovered local attack variants, it struggles to incorporate knowledge of new attacks that manifest in other IDSs.…”

Intrusion Detection based on Concept Drift Detection & Online Incremental Learning

“…The paper in [5] focuses on developing an incremental learning method for intrusion detection that leverages a dynamic ensemble of Relevance Vector Machines (RVMs). The authors address the challenge of intrusion detection in dynamic environments where new attack patterns emerge and the underlying data distribution evolves over time.…”