Exploiting Incremental Classifiers for the Training of an Adaptive Intrusion Detection Model

Marwa R. Mohamed ； Abdurrahman A. Nasr ； I. F. Tarrad ； Salah R. Abdulmageed

《International Journal of Network Security》 21卷2期 (2019/03) Pp. 275-289

https://doi.org/10.6633/IJNS.201903_21(2).12

摘要

Due to the fact that network data is dynamic in nature, the demand for adaptive Intrusion Detection System (IDS) has increased for smart analysis of network data stream. An intrusion detection system is a component of the information security and its main aim is to detect abnormal activities of the network and tries to prevent suspicious data streams that might lead to network security breach. However, most IDS poverty to the capability to detect zero-day or previously unknown attacks. As such, two types of IDS have been contemplated for detecting network threats, namely, signature-based IDS and anomaly detection system. The former depends on stored signatures in a database (thus, its name) to detect intrusions, whereas the latter develops a model based on normal system or network behavior, with the aim of detecting both recognized and novel attacks. The two types of intrusion detection systems confront many problems comprehensive; continuous learning, scalability, a high rate of false alarm, and inability to work in the online model. Here, an Adaptive Intrusion Detection Model (AIDM) is proposed. Such model is an intelligent and learnable anomaly detection model that overcomes the problems of traditional anomaly detection systems namely, high false alarm, real-time learning, and scalability. In this paper, AIDM exploited and studied a set of different incremental machine learning classifiers for intelligent detection and analysis of network data streams is carried out. Such incremental classifiers are Non-Nearest Generalized Exemplar (NNGE), Incremental Naive Bayes (INB), Hoffeding Trees (HT), Instance-Based K- Nearest Neighbor (IBK) and Radial Basis Function Neural Network (RBFNN). Besides that, we utilized Deep Learning 4 Java Multilayer Perceptron (DL4JMLP) classifier for a deep learning approach. Furthermore, a comparison of results between seven machine learning classifiers has been performed to choose the best classifier result capable of recognizing the incoming unknown attacks from the network traffic. These classifiers are incremental in nature such that it can learn network data streams in real-time without the need for redeployment of network infrastructure. AIDM is evaluated using three different datasets collected from Defense Advanced Research Projects Agency (DARPA), Kyoto University and the Cyber Range Lab of the Australian Centre for Cyber Security (ACCS), the training model was obtained by the aforementioned data mining techniques. The evaluation of AIDM indicated promising and improved results with the deep learning classifier (DL4JMLP) when compared with above-mentioned Incremental classifiers and the recent best known related work for detecting anomalous network traffic.

關鍵字

Anomaly Detection ； Deep Learning ； Incremental Classifiers ； Intrusion Detection System ； Machine Learning