RUJA: Repositorio Institucional de Producción Científica

 

Enhanced Intrusion Detection with Data Stream Classification and Concept Drift Guided by the Incremental Learning Genetic Programming Combiner

Fecha

2023-04-04

Título de la revista

ISSN de la revista

Título del volumen

Editor

MDPI (Switzerland)

Resumen

Concept drift (CD) in data streaming scenarios such as networking intrusion detection systems (IDS) refers to the change in the statistical distribution of the data over time. There are five principal variants related to CD: incremental, gradual, recurrent, sudden, and blip. Genetic programming combiner (GPC) classification is an effective core candidate for data stream classification for IDS. However, its basic structure relies on the usage of traditional static machine learning models that receive onetime training, limiting its ability to handle CD. To address this issue, we propose an extended variant of the GPC using three main components. First, we replace existing classifiers with alternatives: online sequential extreme learning machine (OSELM), feature adaptive OSELM (FAOSELM), and knowledge preservation OSELM (KP-OSELM). Second, we add two new components to the GPC, specifically, a data balancing and a classifier update. Third, the coordination between the sub-models produces three novel variants of the GPC: GPC-KOS for KA-OSELM; GPC-FOS for FA-OSELM; and GPC-OS for OSELM. This article presents the first data stream-based classification framework that provides novel strategies for handling CD variants. The experimental results demonstrate that both GPC-KOS and GPC-FOS outperform the traditional GPC and other state-of-the-art methods, and the transfer learning and memory features contribute to the effective handling of most types of CD. Moreover, the application of our incremental variants on real-world datasets (KDD Cup ‘99, CICIDS-2017, CSE-CIC-IDS-2018, and ISCX ‘12) demonstrate improved performance (GPC-FOS in connection with CSE-CIC-IDS-2018 and CICIDS-2017; GPC-KOS in connection with ISCX2012 and KDD Cup ‘99), with maximum accuracy rates of 100% and 98% by GPC-KOS and GPC-FOS, respectively. Additionally, our GPC variants do not show superior performance in handling blip drift.

Descripción

El trabajo forma parte de un desarrollo conjunto por parte del Dr. Laith Alzubaidi, el Dr. José Santamaria (el Dr. Santamaría realizó tareas de co-supervisión de la tesis doctoral del Dr. Alzubaidi), y otros investigadores de la USM University de Malasia. La aportación de los Drs. José Santamaría y Laith Alzubaidi consistió en extender su experiencia previa en el uso de técnicas del Deep Learning, por ejemplo, Transfer-learning, y otras afines del campo del Softcomputing para, por ejemplo, el diseño del Combinador de Programación Genética (GPC) propuesto en el artículo.

Palabras clave

Genetic programming combiner, Transfer learning, Stream data classification

Citación

Shyaa, M.A.; Zainol, Z.; Abdullah, R.; Anbar, M.; Alzubaidi, L.; Santamaría, J. Enhanced Intrusion Detection with Data Stream Classification and Concept Drift Guided by the Incremental Learning Genetic Programming Combiner. Sensors 2023, 23, 3736. https://doi.org/10.3390/s23073736

Colecciones