Adaptive Particle Swarm Optimization Based Ensemble Classifier for Network Intrusion Detection

Abstract

Real time networks generate very large amounts of traffic and are always susceptible to attacks and intrusions making the security and privacy of a network system a major concern. Recently, attacks on computer networks has increased significantly. To mitigate the effects of network attacks, Intrusion Detection Systems (IDS) are used to enforce computer security by identifying and repealing malicious activities in real time computer networks. Network Intrusion approaches are getting more sophisticated and there is now a dire need for developing intrusion detection systems with optimal efficacy. To detect network attacks and intrusions, a number of contemporary intrusion detection systems have been proposed, among them, machine learning approach based ensemble learning techniques have been applied. The upsurge in the sophistication of attacks has created an intense need for the deployment of more dependable and robust network paradigms capable of detecting networking attacks more effectively and efficiently. Despite an avalanche of machine learning based ensembles, it remains a difficult task to formulate an optimal ensemble configuration capable of explicitly detecting network attacks. Existing machine learning approaches cannot achieve consistent generalization across multiple classes from large-scale imbalanced multiclass datasets that are associated with concept drift. To enhance the efficiency of network intrusion detection, this paper proposes a Particle Swarm optimized ensemble called Dynamic Heterogeneous Ensemble Particle Swarm Optimization (DHEPSO) algorithm where particles exhibit different search characteristics. Particles are at liberty to follow different search behaviors selected from a behavior pool, thereby efficiently addressing the exploration and exploitation tradeoff problem. Empirical studies conducted on the new version of NSLKDD99 that reflects modern day traffic trends showed that our proposed approach achieved comparative performance when compared with existing network intrusion detection techniques.