Using incremental learning method for adaptive network intrusion detection

Aiming at the shortcomings of current intrusion detection, a SOM neural network method based on clustering and network level is proposed in this paper. Through the identification of easy-to-use network intrusion type, the network intrusion data is cleaned and analyzed in a targeted manner and the multi-layer adaptive network intrusion detection clustering model is established. Network intrusion detection clustering result based on this model is compared with result based on other methods. The results show that this model has higher accuracy and equilibrium and the validity and feasibility of the method is further verified.

The Internet of Things (IoT) has become an integral part of everyday life, and plays a significant role in various sectors by enabling device-to-device communication without human intervention. However, the constant connectivity of these devices to the Internet exposes them to numerous cyberattacks, potentially leading to data breaches, device malfunctions, and unauthorized network access. The diverse range of threats targeting IoT systems highlights the need for robust security solutions, such as machine learning-based intrusion detection systems, which have attracted growing research interest. This study proposes a novel adaptive approach for intrusion detection in IoT environments by combining batch and incremental learning models. Our work overcomes the limitations of traditional machine learning-based intrusion detection methods, emphasizing the potential of incremental learning to develop more effective and resilient solutions. Unlike most existing approaches that rely solely on batch learning and lack adaptability to integrate new data for long-term security, our method offers a more flexible alternative. Specifically, we leverage the predictive power of LightGBM in batch mode to improve the performance of a Passive-Aggressive classifier as a meta-learner in incremental mode. This dual learning approach aims to enhance intrusion detection in two key ways: effectively capturing diverse attack patterns with batch learning and adapting to emerging attack patterns with incremental learning. Experiments conducted on the CICIoT2023 dataset demonstrate that the proposed approach successfully balances performance and adaptability. It maintains accurate detection capabilities across various classification tasks while remaining responsive to evolving attack patterns.

ANID-SEoKELM: Adaptive network intrusion detection based on selective ensemble of kernel ELMs with random features

This paper proposes anatomy and main functionalities of a distributed framework for supporting adaptive ensemble-based intrusion detection. We start from open issues and limitations of actual state-of-the-art proposals, and we derive a suitable architecture that, based on actual, emerging research trends, finally defines an innovative ensemble-based network intrusion detection system that combines following requirements: distribution, cooperativeness, scalability, multi-scale network traffic analysis, feature selection and extraction. These requirements are recognized by our study as first-class research challenges for next-generation intrusion detection systems.

In this paper, it presented the method of network intrusion detection based on the neural network GCBP algorithm. By analyzing and comparing the BP algorithm with the GCBP algorithm, what learned is that the GCBP algorithm had overcome the weaknesses, which traditional BP algorithm has of slow convergent speed and easily getting into local minimum. Applicable effects of the method of the intrusion detection are much better, more highly accurate, and greater adaptively. I also showed the ability of more quickly learning. To a great extent, it can achieve the detection of unknown data packets, providing an effective way to efficiently and accurately realize intrusion detection.

At present, the electric power information system has been more widely used. The power sector in the realization of management information at the same time, its security problems are also increasingly severe. It can be said that the security problem of the electric power information has become a hidden danger to the safe and stable operation of the power system. There is a corresponding intrusion problem in the power information network, which affects the stability and security of the power system to a great extent. Aiming at the problem of a long time and low accuracy of network intrusion detection in the power monitoring systems, this paper proposes a method of network intrusion detection in power monitoring systems based on data mining technology. The method can ensure the safe and stable operation of the power monitoring system. This method needs to extract the data characteristics of network intrusion as the initial data set of intrusion detection method, and then apply the clustering partition method to preprocess the data to provide accurate data basis for intrusion detection method, and finally, based on data mining technology, complete the intrusion detection of power monitoring system network. A simulation experiment is designed to test the feasibility and accuracy of the method, and the experimental results show that, compared with the traditional intrusion detection method, the proposed method is faster by about 1.8s, the intrusion detection accuracy is higher by 15.6% for 500 groups of data, and the false alarm rate is lower by 12.3%. It can be proved that the design method in this paper has high efficiency and accuracy, and can provide technical support for the safe operation of the power system.

Predominant network intrusion detection systems (NIDS) aim to identify malicious traffic patterns based on a handcrafted dataset of rules. Recently, the application of machine learning in NIDS helps alleviate the enormous effort of human observation. Federated learning (FL) is a collaborative learning scheme concerning distributed data. Instead of sharing raw data, it allows a participant to share only a trained local model. Despite the success of existing FL solutions, in NIDS, a network’s traffic data distribution does not always fit into the single global model of FL; some networks have similarities with each other but other networks do not. We propose Segmented-Federated Learning (Segmented-FL), where by employing periodic local model evaluation and network segmentation, we aim to bring similar network environments to the same group. A comparison between FL and our method was conducted against a range of metrics including the weighted precision, recall, and F1 score, using a collected dataset from 20 massively distributed networks within 60 days. By studying the optimized hyperparameters of Segmented-FL and employing three evaluation methods, it shows that Segmented-FL has better performance in all three types of intrusion detection tasks, achieving validation weighted F1 scores of 0.964, 0.803, and 0.912 with Method A, Method B, and Method C respectively. For each method, this scheme shows a gain of 0.1%, 4.0% and 1.1% in performance compared with FL.

The recent rise in both the frequency and sophistication of cyberattacks in particular, those directed towards distributed and resource constrained, cyber physical environments justifies the need for timely, effective, and adaptive intrusion detection in IoT networks, particularly for lightweight, efficient IoT edge implementations. The work presented in this paper addresses the design of a lightweight, feature efficient intrusion detection system using the XGBoost machine learning algorithm. A classification model was trained on both signal and statistical based subsets of features extracted from a dataset, where the model learned to classify the network traffic data as either benign or malicious. A key aspect of the comparison was to separate the performance of the XGBoost model from the performance of ConvNeXT, which seemed to use an image-based approach to represent the network traffic. Results show that the XGBoost model was both accurate and precise, with higher recall and classification accuracy with less misclassification and ConvNeXT showed poor performance for both classes with class imbalance and a higher false negative rate than XGBoost. Results of this study demonstrate that tabular learning methods such as XGBoost can be effective solutions for both static and realtime intrusion detection for IoT environments in an efficient, applicable manner, with the capacity to be feasibly and scalable as an edge deployment without an overly complex processes to go through to transformation a data model.

With the continuous growth of network threats, intrusion detection systems need to have robustness and adaptability to effectively identify malicious behaviors. However, factors such as noise interference, class imbalance, and complex attack pattern recognition have posed significant challenges to traditional systems. To address these issues, this paper proposes a dynamic preprocessing-enhanced DyP-CNX framework. The framework designs a sliding window dynamic interquartile range (IQR) standardization mechanism to effectively suppress the temporal non-stationarity interference of network traffic. It also combines a random undersampling strategy to mitigate the class imbalance problem. The model architecture adopts a CNN-XGBoost collaborative learning framework, combining a dual-channel convolutional neural network (CNN) and two-stage extreme gradient boosting (XGBoost) to integrate the original statistical features and deep semantic features. On the UNSW-NB15 and CSE-CIC-IDS2018 datasets, the method achieved F1 values of 91.57% and 99.34%, respectively. The experimental results show that the DyP-CNX method has the potential to handle the feature drift and pattern confusion problems in complex network environments, providing a new technical solution for adaptive intrusion detection systems.

Most of the intrusion detection models (IDM) are constructed with off-line training data. Time-variance characteristic of the practical network system cannot be embodied in the off-line constructed IDM. On-line updating of the off-line IDM with the valued new samples is very necessary. In this paper, a new on-line instruction detection model based on approximate linear dependent (ALD) condition with linear latent feature extraction is proposed to address this problem. Specifically, the valued samples which can represent drift of the practical network are indentified with ALD and prior knowledge. Then, these selected samples are used to update the off-line IDM based on on-line latent feature extraction method and fast machine learning algorithm with sample-based updating strategy. Experiments based on KDD99 data are used to validate the proposed approach.

Intrusion detection algorithms based on deep learning are currently a hot topic in the field of intrusion detection research, but most of the research focuses on how to improve the algorithms to improve the accuracy of intrusion detection, while ignoring the problem that the limited labeled data generated by a single organization is not enough to train a deep model with high accuracy in practice. The paper proposes a federal learning and convolutional neural network-based intrusion detection method that can expand the data volume by jointly training the model with data sets from multiple participants. The method uses a federation learning framework to design a deep learning-based intrusion detection model. The data dimensionality is first reconstructed by data padding to form two-dimensional data, then the DCNN network is used for feature extraction and learning under the mechanism of federation learning, and finally the model is trained with a softmax classifier for detection. In addition, aiming at the over-fitting problem caused by the compression and over-parameterization of deep neural networks, this paper proposes a model pruning method based on sparse convolutional neural network according to the weight parameters of the convolutional layer and the Batch Normalization layer (BN). This section will introduce the implementation details of this method. The experimental results show that this method largely reduces the training time and maintains a high detection rate. In addition, the model ensures data security and privacy compared to typical intrusion detection models.

There is often the need to update an installed intrusion detection system (IDS) due to new attack methods or upgraded computing environments. Since many current IDSs are constructed by manual encoding of expert knowledge, changes to IDSs are expensive and slow. We describe a data mining framework for adaptively building Intrusion Detection (ID) models. The central idea is to utilize auditing programs to extract an extensive set of features that describe each network connection or host session, and apply data mining programs to learn rules that accurately capture the behavior of intrusions and normal activities. These rules can then be used for misuse detection and anomaly detection. New detection models are incorporated into an existing IDS through a meta-learning (or co-operative learning) process, which produces a meta detection model that combines evidence from multiple models. We discuss the strengths of our data mining programs, namely, classification, meta-learning, association rules, and frequent episodes. We report on the results of applying these programs to the extensively gathered network audit data for the 1998 DARPA Intrusion Detection Evaluation Program.

The increasing complexity of cyber threats targeting cloud infrastructures demands advanced and adaptive intrusion detection systems (IDS). This study explores the application of deep learning (DL) models—Convolutional Neural Networks (CNN), Long Short-Term Memory networks (LSTM), and a hybrid CNN+BiLSTM architecture—for detecting network intrusions using benchmark datasets CIC-IDS2017 and UNSW-NB15. This study contributes by demonstrating how hybrid CNN+BiLSTM architectures enhance intrusion detection accuracy on benchmark datasets, offering low latency and improved recall for rare attack classes, thereby validating their suitability for real-time cloud security deployment. Results show that hybrid CNN+BiLSTM models outperform standalone CNN and LSTM architectures in detection performance, achieving accuracies up to 97.4% on CIC-IDS2017 and 96.85% on UNSW-NB15, while maintaining acceptable latency for real-time deployment. The hybrid model also demonstrates superior F1-scores for rare attack classes and lower false positive rates. The discussion highlights the importance of dataset quality, feature engineering, and the role of adversarial training and model optimization in enhancing robustness. In conclusion, this work affirms the value of hybrid DL architectures for cloud-based IDS and suggests future directions in federated learning, adaptive retraining, and deployment in edge environments.

Component reuse has become a trend in software engineering. However, third-party components have the potential to introduce vulnerabilities into software applications and become the weakest link in the security chain. In this paper, we discuss the limitations of traditional security practices and controls against vulnerable components. As a solution, we present a software design and development approach, combined with a collaborative, cloud-based vulnerability and threat management system. This combination aims at enabling applications to gain “artificial immunity” to third-party components by dynamically identifying and controlling related security risks. It also strives to promote the automatic discovery of, and near real-time information dissemination about emerging threats and zero-day vulnerabilities. At the heart of our solution, we use application-level API sandboxing, as well as adaptive signature-based and anomaly-based API intrusion detection and prevention. The need-to-know, cost-effectiveness, and user acceptance through separation of concerns have been our guiding security engineering principles.

In the world of connected everything, network attacks and cyber-security breaches may cause huge monetary damages and even endanger lives; hence, full sanitization of the Internet traffic is a real necessity. In this paper we will apply a dynamic statistical analysis to separate latency sensitive traffic from the latency insensitive one at the source. Then, we will calculate the energy savings that can be achieved by identifying and dropping all the unwanted portion of the latency insensitive traffic directly at the source. This value represents an upper-bound to the actual amount of energy that can be saved by applying our adaptive aggressive intrusion detection technique to latency insensitive traffic, in fact the actual value depends on the actual load of the network and its capability to spread the hunt for malicious packet among all the network nodes. The main contribution of this paper is to show that energy savings through aggressive intrusion detection may be achieved without burdening latency sensitive traffic with delays that may render it unusable, nonetheless, as a side effect of early removal of unwanted traffic from the network flows is to reduce the network load, the traffic reduction so obtained allows sanitizing even the latency sensitive traffic with a reduced risk of excessive delays due to resources allocation and traffic forecasting errors.