Research ArticleNo Access

A Continuous Learning Approach for Real-Time Network Intrusion Detection

Department of Mathematics, Computer Science, and Physics, University of Udine, Via delle, Scienze 206, Udine, 33100, Italy

E-mail Address: martina.marcellorinaldo@spes.uniud.it

Search for more papers by this author

and

Gian Luca Foresti

Department of Mathematics, Computer Science, and Physics, University of Udine, Via delle, Scienze 206, Udine, 33100, Italy

E-mail Address: gianluca.foresti@uniud.it

Corresponding author.

Search for more papers by this author

https://doi.org/10.1142/S012906572150060XCited by:4 (Source: Crossref)

Abstract

Network intrusion detection is becoming a challenging task with cyberattacks that are becoming more and more sophisticated. Failing the prevention or detection of such intrusions might have serious consequences. Machine learning approaches try to recognize network connection patterns to classify unseen and known intrusions but also require periodic re-training to keep the performances at a high level. In this paper, a novel continuous learning intrusion detection system, called Soft-Forgetting Self-Organizing Incremental Neural Network (SF-SOINN), is introduced. SF-SOINN, besides providing continuous learning capabilities, is able to perform fast classification, is robust to noise, and it obtains good performances with respect to the existing approaches. The main characteristic of SF-SOINN is the ability to remove nodes from the neural network based on their utility estimate. SF-SOINN has been validated on the well-known NSL-KDD and CIC-IDS-2017 intrusion detection datasets as well as on some artificial data to show the classification capability on more general tasks.

Keywords:

References

1. C. Constantinides, S. Shiaeles, B. Ghita and N. Kolokotronis, A novel online incremental learning intrusion prevention system, in 2019 10th IFIP Int. Conf. New Technologies, Mobility and Security (NTMS) (2019), pp. 1–6. Crossref, Google Scholar
2. S. Furao, T. Ogura and O. Hasegawa, An enhanced self-organizing incremental neural network for online unsupervised learning, Neural Netw. 20(8) (2007) 893–903. Crossref, Medline, Web of Science, Google Scholar
3. Canadian Institute for Cybersecurity, NSL-KDD dataset, https://www.unb.ca/cic/datasets/nsl.html. Google Scholar
4. Canadian Institute for Cybersecurity, 2017 intrusion detection evaluation dataset, https://www.unb.ca/cic/datasets/ids-2017.html. Google Scholar
5. N. Haq, M. Avishek, F. Shah, A. Onik, M. Rafni and D. Md, Application of machine learning approaches in intrusion detection system: A survey, Int. J. Adv. Res. Artif. Intell. 4 (2015) 9–18. Google Scholar
6. K. A. da Costa, J. P. Papa, C. O. Lisboa, R. Munoz and V. H. C. de Albuquerque, Internet of Things: A survey on machine learning-based intrusion detection approaches, Comput. Netw. 151 (2019) 147–157. Crossref, Web of Science, Google Scholar
7. A. Khraisat, I. Gondal, P. Vamplew and J. Kamruzzaman, Survey of intrusion detection systems: Techniques, datasets and challenges, Cybersecurity 2 (2019) 20. Crossref, Google Scholar
8. S. Sahu and B. M. Mehtre, Network intrusion detection system using J48 decision tree, in 2015 Int. Conf. Advances in Computing, Communications and Informatics (ICACCI) (2015), pp. 2023–2026. Crossref, Google Scholar
9. S. S. Sivatha Sindhu, S. Geetha and A. Kannan, Decision tree-based light weight intrusion detection using a wrapper approach, Expert Syst. Appl. 39(1) (2012) 129–141. Crossref, Web of Science, Google Scholar
10. Y. Liao and V. Vemuri, Use of K-nearest neighbor classifier for intrusion detection, Comput. Secur. 21(5) (2002) 439–448. Crossref, Web of Science, Google Scholar
11. E. Hodo, X. Bellekens, A. Hamilton, P. Dubouilh, E. Iorkyase, C. Tachtatzis and R. Atkinson, Threat analysis of IoT networks using artificial neural network intrusion detection system, in 2016 Int. Symp. Networks, Computers and Communications (ISNCC) (2016), pp. 1–6. Crossref, Google Scholar
12. H. Wang, J. Gu and S. Wang, An effective intrusion detection framework based on SVM with feature augmentation, Knowl.-Based Syst. 136 (2017) 130–139. Crossref, Web of Science, Google Scholar
13. M. H. Rafiei and H. Adeli, A new neural dynamic classification algorithm, IEEE Trans. Neural Netw. Learn. Syst. 28 (2017) 3074–3083. Crossref, Medline, Web of Science, Google Scholar
14. F. Ni, J. Zhang and M. Noori, Deep learning for data anomaly detection and data compression of a long span suspension bridge, Comput.-Aided Civ. Infrastruct. Eng. 35 (2019) 685–700. Crossref, Web of Science, Google Scholar
15. R. Shanmugavadivu and N. Nagarajan, Network intrusion detection system using fuzzy logic, Indian J. Comput. Sci. Eng. 2 (2011) 101–111. Google Scholar
16. S. Chebrolu, A. Abraham and J. P. Thomas, Feature deduction and ensemble design of intrusion detection systems, Comput. Secur. 24(4) (2005) 295–307. Crossref, Web of Science, Google Scholar
17. A. A. Aburomman and M. B. Ibne Reaz, A novel SVM-kNN-PSO ensemble method for intrusion detection system, Appl. Soft Comput. 38 (2016) 360–372. Crossref, Web of Science, Google Scholar
18. K. Alam, N. Siddique and H. Adeli, A dynamic ensemble learning algorithm for neural networks, Neural Comput. Appl. 32 (2020) 8675–8690. Crossref, Web of Science, Google Scholar
19. S. Gou, Y. Wang, L. Jiao, J. Feng and Y. Yao, Distributed transfer network learning based intrusion detection, in 2009 IEEE Int. Symp. Parallel and Distributed Processing with Applications (2009), pp. 511–515. Crossref, Google Scholar
20. J. Gao, W. Fan, J. Jiang and J. Han, Knowledge transfer via multiple model local structure mapping, in Proc. 14th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining (2008), pp. 283–291. Crossref, Google Scholar
21. J. Zhao, S. Shetty and J. W. Pan, Feature-based transfer learning for network security, in MILCOM 2017 — 2017 IEEE Military Communications Conf. (MILCOM) (2017), pp. 17–22. Crossref, Google Scholar
22. J. Zhao, S. Shetty, J. W. Pan, C. Kamhoua and K. Kwiat, Transfer learning for detecting unknown network attacks, EURASIP J. Inf. Secur. 2019(1) (2019) 1. Crossref, Web of Science, Google Scholar
23. G. A. Carpenter and S. Grossberg, The art of adaptive pattern recognition by a self-organizing neural network, Computer 21(3) (1988) 77–88. Crossref, Web of Science, Google Scholar
24. M.-Y. Su, G.-J. Yu and C.-Y. Lin, A real-time network intrusion detection system for large-scale attacks based on an incremental mining approach, Comput. Secur. 28(5) (2009) 301–309. Crossref, Web of Science, Google Scholar
25. H. G. Kayacik, A. N. Zincir-Heywood and M. I. Heywood, On the capability of an SOM-based intrusion detection system, in Proc. Int. Joint Conf. Neural Networks, Vol. 3 (2003), pp. 1808–1813. Crossref, Google Scholar
26. L.-Y. Tian and W.-P. Liu, Incremental intrusion detecting method based on SOM/RBF, in 2010 Int. Conf. Machine Learning and Cybernetics, ICMLC Vol. 6 (2010), pp. 2849–2853. Crossref, Google Scholar
27. H. Zhang, S. Chen, J. Liu, Z. Zhou and T. Wu, An incremental anomaly detection model for virtual machines, PLoS One 12 (2017) 1–23. Web of Science, Google Scholar
28. S. Furao and O. Hasegawa, An incremental network for on-line unsupervised classification and topology learning, Neural Netw. 19(1) (2005) 90–106. Crossref, Medline, Web of Science, Google Scholar
29. T. Martinetz and K. Schulten, Topology representing networks, Neural Netw. 7(3) (1994) 507–522. Crossref, Web of Science, Google Scholar
30. C. Wiwatcharakoses and D. Berrar, Soinn+, a self-organizing incremental neural network for unsupervised learning from noisy data streams, Expert Syst. Appl. 143 (2020) 113069. Crossref, Web of Science, Google Scholar
31. C. Aggarwal, A. Hinneburg and D. Keim, On the surprising behavior of distance metric in high-dimensional space, in Database Theory, ICDT 200, 8th Int. Conf., London, UK, January 4–6, 2001. Google Scholar
32. D. Weller-Fahy, B. Borghetti and A. Sodemann, A survey of distance and similarity measures used within network intrusion anomaly detection, IEEE Commun. Surv. Tutor. 17 (2015) 70–91. Crossref, Web of Science, Google Scholar
33. Canadian Institute for Cybersecurity, CICFlowMeter https://www.unb.ca/cic/research/applications. html#CICFlowMeter. Google Scholar
34. D. G. Kumar Ahuja, Evaluation metrics for intrusion detection systems-a study, Int. J. Comput. Appl. 11 (2015) 11–17. Google Scholar
35. M. Tavallaee, E. Bagheri, W. Lu and A. Ghorbani, A detailed analysis of the KDD CUP 99 data set, in IEEE Symp. Computational Intelligence for Security and Defense Applications, CISDA, Vol. 2 (2009). https://doi.org/doi:10.1109/CISDA.2009.5356528 Crossref, Google Scholar
36. D. Fried, I. Graf, J. Haines, K. Kendall, D. Mcclung, D. Weber, S. Webster, D. Wyschogrod, R. Cunningham and M. Zissman, Evaluating intrusion detection systems: The 1998 DARPA off-line intrusion detection evaluation, DARPA Information Survivability Conf. Exposition, Vol. 2 (2000). https://doi.org/doi:10.1109/DISCEX.2000.821506 Google Scholar
37. H. Dou, B. Xu, F. Shen and J. Zhao, V-soinn: A topology preserving visualization method for multidimensional data, Neurocomputing 449 (2021) 280–289. Crossref, Web of Science, Google Scholar
38. D. Dey, A. Dinda, P. Kundapur and R. Smitha, Warezmaster and Warezclient: An implementation of FTP based R2L attacks, in 2017 8th Int. Conf. Computing, Communication and Networking Technologies (ICCCNT) (2017), pp. 1–6. Crossref, Google Scholar
39. Canadian Institute for Cybersecurity, https://www.unb.ca/cic/datasets/. Google Scholar
40. M. Ahmadlou and H. Adeli, Enhanced probabilistic neural network with local decision circles: A robust classifier, Integr. Comput.-Aided Eng. 17 (2010) 197–210. Crossref, Web of Science, Google Scholar
41. R. W. Ng, K. M. Begam, R. K. Rajkumar, Y. W. Wong and L. W. Chong, An improved self-organizing incremental neural network model for short-term time-series load prediction, Appl. Energy 292 (2021) 116–912. Crossref, Web of Science, Google Scholar
42. F. Caraffini, F. Neri, J. Cheng, G. Zhang, L. Picinali, G. Iacca and E. Mininno, Super-fit multicriteria adaptive differential evolution, in 2013 IEEE Congress on Evolutionary Computation (2013), pp. 1678–1685. Crossref, Google Scholar
43. F. Caraffini, G. Iacca, F. Neri, L. Picinali and E. Mininno, A CMA-ES super-fit scheme for the re-sampled inheritance search, in 2013 IEEE Congress on Evolutionary Computation (2013), pp. 1123–1130. Crossref, Google Scholar
44. G. Gu, P. Fogla, D. Dagon, W. Lee and B. Skoric, Measuring intrusion detection capability: An information-theoretic approach, in Proc. 2006 ACM Symp. Information, Computer and Communications Security (2006), pp. 90–101. Crossref, Google Scholar