Machine learning, and deep learning are extensively used to augment the performance of Intrusion detection systems. While the existing work on intrusion detection system using data mining and machine learning is efficient, but it involves training static batch classifiers to detect intrusions irrespective of the regular data stream's time-varying characteristics. Aims: This paper proposes an adaptive approach for online intrusion detection using stream-oriented learning for adapting to concept drift in real world environment. Method: Adaptive Random Forest classifier with ADWIN change detector is used for detecting change in a data stream and adapting to drift detection in the streamed data resulting in agile adaptation against unknown intrusions and the proposed approach also overcomes the need to retrain the model with time. Results: The latest CIC-IDS 2018 dataset is used for evaluating the approach. With the proposed method, the final Accuracy obtained is 99.5 % and a recall rate of 99.8%.
Data mining and machine learning application’s prominence is increasing with time. Recently much
research is being proposed to utilize machine learning and deep learning techniques in many domains
such as weather forecasting, Spam detection, detecting fraudulent financial transactions, Intrusion
detection system etc. Traditionally, machine learning was primarily focused on using static data enough
to represent underlying distribution. However, usually, real-world problems don’t fit in models with
such restrictions. Also, many real-world applications such as Intrusion Detection Systems have
nonstationary data distributions that cause the problem of non-stationary learning or concept drift over the
time. Many studies with good results are available to investigate IDS (Intrusion Detection Systems)
using deep learning and machine learning approaches. However, most of the studies have deployed
static data sources. These studies fail to take rapid technological developments, and the problem of
concept drift into account [
As an indicator, concept drift holds importance due to its ability to measure time-based data distribution variance. Besides, IDS can also be considered as a typical scenario of concept drift. Usually, for a single source providing a data stream to a network, the data under the scanner is in a stable state, distributed identically. And in case of an unknown intrusion, the current data distribution undergoes dynamic changes as compared to the historical data. This motivates for building and adaptive Intrusion detection method that involves incremental learning based on Concept Drift that quickly adapts to new intrusion types.
Moreover, the endless emergence of new attacks and security loopholes raises the need for an ideal
classifier that quickly adapts to intrusion's emerging methods. In such a situation, the static batch
learning approach discussed above delivers poor performance. In other words, when a static classifier
goes obsolete, its response to new intrusion types becomes slow, and a re-training [
The underlying model of current IDS usually detects only known network attacks whereas IDS are prone to novel malicious attacks. The IDS models are built on static data. Whereas data come in streams in an IDS, and the data distribution may vary over the time. IDS models become obsolete with time and needs to be retrained which is cost intensive.
To overcome the above research gaps, we propose a concept drift-based approach for evolving data
stream classification in Intrusion detection system. With limited processing and memory time, the
concept drift detection method ensures accurate and quick identification of changes in the underlying
data point distribution, followed by the fastest possible adaptation in the model [
High performance intrusion detection system based on streamed data with concept drift. Incremental IDS model with adaptive updation of classification models, achieving high accuracy in real time.
IDS with agile adaptation against unknown intrusions.
Lot of research is done in the field of intrusion detection. Many researchers have proposed machine and deep learning techniques for detecting intrusions.
Ferrag et al. in [
(Karatas et al. in [
In [
Feng et al. in [
In [
Park et al. in [
The majority of the proposed work in literature is on old datasets or is based on static datasets. To overcome the above research gaps, In this paper Adaptive Random forest classifier with drift detection to classify attacks in stream data using the latest CIC-IDS 2018 dataset.
The rest of the paper is structured as follows. Section 2 reviews the current literature Intrusion detection systems. Section 3 discusses the research methodology. Section 4 discusses the results obtained. Section 5 concludes the paper with a summary.
In the network security domain, malicious intrusions have increased, making the IDS (Intrusion Detection System) design vital for securer systems. Recently, machine learning methods are increasingly used for network abnormality detection. However, currently available works do not explore the variation in data over the time, restricting their ability to detect new intrusion types. Therefore, for unpredicted changes in the status data's statistical properties over time, we propose an IDS with a concept drift-based incremental learning using adaptive random forest classifier with adwin drift detection.
The proposed study is done on the latest CIC IDS 2018 dataset. The CIC IDS 2018 is a massive dataset that incorporates 14 modern-day attacks. The CIC IDS dataset was published by Communications Security Establishment (CSE) & the Canadian Institute for Cybersecurity (CIC). The dataset comprises of 80 features with 16 million rows.
Dos attacks-Slowloris FTP-BruteForce Infiltration Sql Injection
The CIC-IDS dataset comprises of 13 modern-day attacks as listed in the table 1. The dataset is relabeled to Attack and Benign sessions. All the 13 attack types listed in the table are relabeled to attack class. Thus, the problem of multi classification of attacks is reduced to binary classification. Thus, the dataset mix after preprocessing is listed in table 2.
Any modification in the underlying process of data generation is referred to as concept drift. In the classification context, concept drift points to variation in the target variable’s statistical properties. The target variable is the one the model is trying to make a time-based prediction for, and the term concept is used for the quantity the researcher aims to predict. As previously mentioned, the distribution that creates the data stream’s items can change with time. To address this problem of concept drift in Intrusion Detection System the proposed model uses Adaptive Random Forest with Adaptive Windowing method for concept drift detection (ADWIN).
Random Forest is a popular learning algorithm in regression and non-stream classification (batch)
tasks. This approach creates multiple trees, avoiding overfitting of the branches through bootstrap
aggregation for decorrelation [
Performing multiple passes becomes infeasible when using data stream learning with input data. Thus, Random Forests need to adapt to the streaming data based on:
A suitable process for online bootstrap aggregation
Limitation of each leaf split decision into a feature subset
To achieve the second requirement, the algorithm for the base tree is modified [
However, when working with Adaptive algorithms, the primary aim is to deal with data streams that evolve over time. Thus, including other strategies it is also essential to cope with the problem of concept drifts. Adaptive Random Forest deploy a permissive threshold in ARF for warning detection instead of a tree reset process on drift detection. Alongside, background trees are created and trained along with the ensemble without influencing its predictions. However, on the detection of a drift a background tree is used to replace the originating tree for the warning signal.
Thus, three major features of Adaptive Random Forest are as follows: 1. Increasing the variance with resampling 2. Increasing the variance with random selection of feature subsets for node splits based on hoeffding tree 3. Drift detection per base tree
Adaptive Random Forest algorithm uses ADWIN (Adaptive Windowing) for drift detection.
ADWIN [
In this study, the performance of the adaptive Random Forest algorithm is evaluated. on the latest CIC-IDS 2018 dataset. The proposed system was implemented using scikit-multiflow library in python. All the experiments were performed on AWS cloud platform using the configuration in Table 4.
The proposed model is evaluated on various performance metrics - Accuracy, Precision, Kappa,
Recall, F- Measure. The performance metrics [
(1) (2) (3) The coefficient of kappa calculates an agreement between the values of classification and truth value. A kappa value of 1 stands for perfect agreement, while a value of 0 does not stand for agreement. (4) (5) =
1 = 2 ∗ + ∗ + Precision is the ratio of correctly classified samples as attacks with total samples graded as attacks.
Besides Accuracy other performance evaluation parameters such as Precision, F-Measure, Kappa and Recall metrics are also important to evaluate the performance of the system. Analysis of result using the above performance metrics with other adaptive algorithms is listed in Table.
The CIC-IDS 2018 dataset is converted into a data stream and holdout evaluation method is used for evaluating the performance of the model. The holdout evaluation method updates the statistics of incoming samples without evaluating the performance or predicting the labels. The performance of the model is evaluated after every n samples. The evaluation is done on the unseen test samples and the test sets are dynamically generated from the data stream.
KNN 0.9158
ARF(Proposed) 99.5 RBM
Most of the applications based on streaming data need a fast response, requiring re(training) of an algorithm with the latest data available. Most of the existing Artificial Intelligence based IDS models are trained on static data. Whereas data come in streams in an IDS, and the data distribution may vary over the time since attack patterns tend to evolve over the time resulting in a concept drift. Moreover, for the IDS to work efficiently it needs to adapt itself to be able to detect new attack classes over the time. In such scenarios the static data models performs poorly since static batch learning models get outdated and needs to be updated with time. To overcome the above challenges, this paper uses adaptive random forest classifier with ADWIN drift detector for building concept drift-based model for evolving data stream classification in Intrusion detection system. The proposed algorithm outperforms other approaches in literature with high accuracy, precision and recall rate of 99.5 %, 99.9% and 99.8% respectively.