Ensemble-Based Online Machine Learning Algorithms for Network Intrusion Detection Systems Using Streaming Data

Abstract

As new cyberattacks are launched against systems and networks on a daily basis, the ability for network intrusion detection systems to operate efficiently in the big data era has become critically important, particularly as more low-power Internet-of-Things (IoT) devices enter the market. This has motivated research in applying machine learning algorithms that can operate on streams of data, trained online or “live” on only a small amount of data kept in memory at a time, as opposed to the more classical approaches that are trained solely offline on all of the data at once. In this context, one important concept from machine learning for improving detection performance is the idea of “ensembles”, where a collection of machine learning algorithms are combined to compensate for their individual limitations and produce an overall superior algorithm. Unfortunately, existing research lacks proper performance comparison between homogeneous and heterogeneous online ensembles. Hence, this paper investigates several homogeneous and heterogeneous ensembles, proposes three novel online heterogeneous ensembles for intrusion detection, and compares their performance accuracy, run-time complexity, and response to concept drifts. Out of the proposed novel online ensembles, the heterogeneous ensemble consisting of an adaptive random forest of Hoeffding Trees combined with a Hoeffding Adaptive Tree performed the best, by dealing with concept drift in the most effective way. While this scheme is less accurate than a larger size adaptive random forest, it offered a marginally better run-time, which is beneficial for online training.

A review of machine learning concepts and methods for addressing challenges in probabilistic hydrological post-processing and forecasting

“…Dealing with this particularity is somewhat more critical for forecasting with machine learning algorithms, because of the well-known importance of large data samples for their training. Approaches referred to under the term "online learning" (see, e.g., Martindale et al, 2020) could partly serve toward this important direction and could, thus, be investigated in this endeavor. Such approaches do not require a static dataset.…”

An Online Ensemble Learning Model for Detecting Attacks in Wireless Sensor Networks

“…Martindale et al [21] proposed an approach for detecting intrusions in IoTs by exploring the performance and runtime trade-offs of a set of several online individual algorithms, as well as a few homogeneous and heterogeneous ensemble approaches. The massive online analysis (MOA) framework was used for implementing their approach.…”

Atualização de Modelo baseado em Aumento de Dados e Transferência de Aprendizagem para Detecção de Intrusão em Redes

“…Da mesma forma, a facilidade de atualizac ¸ão de modelos também continua a ser negligenciada na maior parte dos NIDS. N. Martindale et al [Martindale et al 2020] propôs uma abordagem de detecc ¸ão de intrusão por aprendizagem de fluxo para baixar os custos computacionais da atualizac ¸ão do modelo. No entanto, os autores não abordam a questão da rotulac ¸ão dos eventos, e assumindo que o rótulo do tráfego de rede pode ser facilmente solicitado quando necessário.…”