Enhanced Intrusion Detection with Data Stream Classification and Concept Drift Guided by the Incremental Learning Genetic Programming Combiner

Ensemble of subset online sequential extreme learning machine for class imbalance and concept drift

Meta-cognitive Recurrent Recursive Kernel OS-ELM for concept drift handling

We present a novel method for concept drift detection, based on: 1) the development and continuous updating of online sequential extreme learning machines (OS-ELMs) and 2) the quantification of how much the updated models are modified by the newly collected data. The proposed method is verified on two synthetic case studies regarding different types of concept drift and is applied to two public real-world data sets and a real problem of predicting energy production from a wind plant. The results show the superiority of the proposed method with respect to alternative state-of-the-art concept drift detection methods. Furthermore, updating the prediction model when the concept drift has been detected is shown to allow improving the overall accuracy of the energy prediction model and, at the same time, minimizing the number of model updatings.

Internet of things (IoT) is penetrating into every aspect of our lives including our body, our home and our living environment along with numerous security challenges. With rapidly growing number of connected devices in IoT, the scope for cyber-attack also increases exponentially. Therefore an effective intrusion detection system (IDS) is needed to efficiently detect the attack at faster rate in highly scalable and dynamic IoT environment. In this paper, a novel intrusion detection technique is proposed based on fog computing using Online Sequential Extreme Learning Machine (OS-ELM) which can intelligently interpret the attacks from the IoT traffic. In the proposed system, the existing centralized cloud intelligence in detecting the attack is distributed to local fog nodes to detect the attack at faster rate for IoT application. The distributed architecture of fog computing enables distributed intrusion detection mechanism with scalability, flexibility and interoperability. The analysis of the proposed system proves to be efficient in terms of response time and detection accuracy.

Letter to the editor

To address the critical industry pain points in streaming data scenarios across industrial production, intelligent transportation and other related fields—namely continuous performance degradation of classification models induced by concept drift, the absence of dedicated closed-loop drift adaptation processing capability in mainstream stream processing systems, poor engineering implementability of specialized tools, and the inherent difficulty in balancing real-time performance and classification accuracy—this paper designs and implements a Dynamic Adaptive Concept Drift Processing System (DACPS) for streaming data classification. The system adopts a hierarchical modular architecture, integrating five core functional modules: streaming data preprocessing, real-time concept drift detection, dynamic sample optimization, incremental model training, and full-process management and control. This architecture enables fully automated and adaptive processing for the end-to-end workflow of streaming data classification and prediction. Extensive multi-dimensional functional tests, specialized performance tests, and scenario-based validation demonstrate that the system can stably adapt to diverse types of concept drift scenarios, and meets all design specifications in terms of classification accuracy, convergence speed, operating efficiency, and resource occupation control. Meanwhile, the system is equipped with an accessible visual interactive interface, making it widely adaptable to the streaming data classification and processing requirements across multiple application domains.

The smart grid is vulnerable to network attacks, thus requiring a high detection rate and fast detection speed for intrusion detection systems. With a fast training speed and a strong model generalization ability, the extreme learning machine (ELM) perfectly meets the needs of intrusion detection of the smart grid. In this paper, the ELM is applied to the field of smart grid intrusion detection. Aiming at the problem that the randomness of input weights and hidden layer bias in the ELM cannot guarantee the optimal performance of the ELM intrusion detection model, a genetic algorithm (GA)-ELM algorithm based on a genetic algorithm (GA) is proposed. GA is used to optimize the input weight and hidden layer bias of the ELM. Firstly, the input weight and hidden layer bias of the ELM are mapped to the chromosome vector of a GA, and the test error of the ELM model is set as the fitness function of the GA. Then, the parameters of the ELM intrusion detection model are optimized by genetic operation; the input weight and bias, corresponding to the minimum test error, are selected to improve the performance of the ELM model. Compared with the ELM and online sequential extreme learning machine (OS-ELM), the GA-ELM effectively improves the accuracy, detection rate and precision of intrusion detection and reduces the false positive rate and missing report rate.

Intrusion Detection Systems (IDS) are vital for securing cloud environments, where dynamic scalability and distributed architecture present significant security challenges. Accurate, real-time threat detection with minimal false positives is essential for effective cloud protection. Traditional machine learning models such as Support Vector Machines (SVM) and Random Forests have been applied in IDS but often struggle with high false positive rates and limited effectiveness against novel or zero-day attacks. A deep neural network (DNN) architecture is designed, incorporating multiple ReLU-activated hidden layers and dropout layers to prevent overfitting. The model is trained using the Adam optimizer and categorical cross-entropy loss to ensure efficient learning and responsiveness. Evaluation on NSL-KDD and CICIDS2017 datasets demonstrates high detection accuracy—98.7% and 97.4% respectively—along with reduced false positive rates and promising results in identifying zero-day attacks during simulation. Future work includes integrating federated learning to support distributed deployment and enhance privacy preservation.

<abstract><p>With the widespread application of smart devices, the security of internet of things (IoT) systems faces entirely new challenges. The IoT data stream operates in a non-stationary, dynamic environment, making it prone to concept drift. This paper focused on addressing the issue of concept drift in data streams, with a key emphasis on introducing an innovative drift detection method-ensemble multiple non-parametric concept localization detectors, abbreviated as EMNCD. EMNCD employs an ensemble of non-parametric statistical methods, including the Kolmogorov-Smirnov, Wilcoxon rank sum and Mann-Kendall tests. By comparing sample distributions within a sliding window, EMNCD accurately detects concept drift, achieving precise localization of drift points, and enhancing overall detection reliability. Experimental results demonstrated the superior performance of EMNCD compared to classical methods on artificial datasets. Simultaneously, to enhance the robustness of data stream processing, we presented an online anomaly detection method based on the isolation forest (iForest). Additionally, we proposedwhale optimization algorithm (WOA)-extreme gradient boosting (XGBoost), a drift adaptation model employing XGBoost as a base classifier. This model dynamically updates using drift points detected by EMNCD and fine-tunes parameters through the WOA. Real-world applications on the edge-industrial IoTset (IIoTset) intrusion dataset explore the impact of concept drift on intrusion detection, where IIoT is a subclass of IoT. In summary, this paper focused on EMNCD, introducing innovative approaches for drift detection, anomaly detection, and drift adaptation. The research provided practical and viable solutions to address concept drift in data streams, enhancing security in IoT systems.</p></abstract>

Today, there is a tremendous growth in the amount of data being generated from various fields (such as smartphones, social networks, emails, customer click streams, different types of sensors and Internet of Things) that show Big Data attributes. Recently efforts have been made towards developing models for knowledge discovery from such data under the research area of stream mining or data stream classification in particular. Ensemble learners have become the popular approach in data stream classification because of their stability-elasticity property, which enables handling data stream challenges such as concept drift, recurrent concepts, novel class detection, and class imbalance. In this paper, we compare ten ensemble classifiers with respect to concept drift and class imbalance using Prequential AUC. In addition, Friedman nonparametric statistical test and Nemenyi post-hoc test were used to identify the best approach among them. This work to some extent can serve as part of a review of existing ensemble classifier algorithms for non-stationary data streams.

Radio wave data gathered by pulsar finding telescopes are required to be classified while being streamed. The reason for that is the practical constraints of traditional machine learning algorithms on streaming datasets. Traditional machine learning algorithms would take considerable compute power, memory and time to give pragmatic results.(recent surveys collect data at the rate of 0.5 – 1 terabyte per second) Stream classification algorithms are specifically developed to address the above limitations and can classify data streams without taking up a lot of memory or training time. They relate with characteristics of data streams such as concept drift and limited memory. Extremely Fast Decision Tree is one of the stream classification algorithms that can learn incrementally when it sees new data. However, data from pulsar detecting datastreams are highly imbalanced (there are less examples of pulsars in the data than non-pulsar objects). Learning incrementally from such a datastream would be a destructive interference for the model’s precision (of detecting pulsars). In this research, we introduce an improved version of the Extremely Fast Decision Tree, that is able to learn imbalanced data streams. Our approach is fast, accurate, and avoids the pitfalls of class imbalance and concept drift.

Anomaly detection in streaming data is an important task for many real-world applications, such as network security, fraud detection, and system monitoring. However, streaming data often exhibit concept drift, which means that the data distribution changes over time. This poses a significant challenge for many anomaly detection algorithms, as they need to adapt to the evolving data to maintain high detection accuracy. Existing streaming anomaly detection algorithms lack a unified evaluation framework that validly assesses their performance and robustness under different types of concept drifts and anomalies. In this paper, we conduct a systematic technical review of the state-of-the-art methods for anomaly detection in streaming data. We propose a new data generator, called SCAR (Streaming data generator with Customizable Anomalies and concept dRifts), that can synthesize streaming data based on synthetic and real-world datasets from different domains. Furthermore, we adapt four static anomaly detection models to the streaming setting using a generic reconstruction strategy as baselines, and then compare them systematically with 9 existing streaming anomaly detection algorithms on 76 synthesized datasets that have various types of anomalies and concept drifts. The challenges and future research directions for anomaly detection in streaming data are also presented.

Low-power and Lossy Networks (LLNs) comprise nodes characterised by constrained computational power, memory, and energy resources. The LLN nodes empower ubiquitous connections amongst numerous devices (e.g. temperature, humidity, and turbidity sensors, together with motors, valves and other actuators) to sense, control and store properties of their environments. They are often deployed in hostile, unattended, and unfavourable conditions. Securing them often becomes very challenging. The extent of interconnected LLN devices poses a series of routing threats (e.g. wormhole, grayhole, DIO suppression, and increase rank attacks). Consequently, an efficient and effective intrusion detection system (IDS) is of utmost importance in identifying anomalous activities in the IPv6 over Low-powered Wireless Personal Area Networks (6LoWPAN). This article proposes a robust Adversarial Reinforcement Learning (ARL) framework to generate efficient IDSs for evolving data environments. The integration of ARL and incremental machine-learning facilitates the generation of resource-efficient and robust IDS detectors. We demonstrate in particular how such an approach, leveraging notions of ’concept drift’ detection and adaptation, can handle inevitable changes in the environment, giving the IDS best chances of detecting attacks in the current profile. The range of routing attacks considered is the most comprehensive to date. For the first time, Black-box and Grey-box ML-based adversaries aiming to destabilise the 6LoWPAN are distinguished and addressed.

Aim/Purpose: This paper describes how to use a multilayer perceptron to improve concept drift recovery in streaming environments. Background: Classifying instances in a data stream environment with concept drift is a challenging topic. The base learner must be adapted online to the current data. Several data mining algorithms have been adapted/used to this type of environment. In this study, two techniques are used to speed up the adaptation of an artificial neural network to the current data, increasing its predictive accuracy while detecting the concept drift sooner. Methodology: Experiments were performed to analyze how some techniques behave in different scenarios and compare them with other classifiers built to deal with data streams and concept drifts. Contribution: This study suggests two techniques to improve the classification results: an embedded concept drift detection method to identify when a change has occurred and setting the learning rate to a higher level whenever a new concept is being learned to give more weight to recent instances, with its value decreased over time. Findings: Results indicate that gradually reducing the learning rate with an embedded concept drift detector has better statistical results than other single classifiers built to deal with data streams and concept drifts. Recommendations for Practitioners: Based on the empirical results, this study provides recommendations on how to improve the multilayer perceptron in data stream environments suffering from concept drifts. Recommendation for Researchers: Researchers should conduct investigations to increase the number of base classifiers used in data stream environments and in situations where concept drifts occur. Impact on Society: The objective of this study is to increase the use of multilayer perceptrons in data stream environments suffering from concept drifts, as nowadays, Hoeffding Trees and Naive Bayes are the base classifiers mostly used. Future Research: Additional research includes adapting the online learning rate by increasing/decreasing it based on the performance of the Multilayer Perceptron. This scheme would allow the removal of parameters that must be set by the user, like learning rate upper bound and number of instances to return to the stable value.

Incremental learning with concept drift has often been tackled by ensemble methods, where models built in the past can be retrained to attain new models for the current data. Two design questions need to be addressed in developing ensemble methods for incremental learning with concept drift, i.e., which historical (i.e., previously trained) models should be preserved and how to utilize them. A novel ensemble learning method, namely, Diversity and Transfer-based Ensemble Learning (DTEL), is proposed in this paper. Given newly arrived data, DTEL uses each preserved historical model as an initial model and further trains it with the new data via transfer learning. Furthermore, DTEL preserves a diverse set of historical models, rather than a set of historical models that are merely accurate in terms of classification accuracy. Empirical studies on 15 synthetic data streams and 5 real-world data streams (all with concept drifts) demonstrate that DTEL can handle concept drift more effectively than 4 other state-of-the-art methods.