An Incremental Learning Algorithm on Imbalanced Data for Network Intrusion Detection Systems

Incremental learning is a promising algorithm for creating an adaptive network intrusion detection system (IDS) model. In contrast with batch learning models, incremental learning models can be retrained easily when new network intrusion data emerge. Moreover, some incremental learning models, such as the Hoeffding Tree model, can be retrained only using latest training data. This advantage is appealing because computer networks produce enormous amounts of data every day. Using incremental learning models for detecting the ever-growing network intrusions can save computational resources while preserving the performance of the models. However, network data suffer from the imbalanced data problem where the data distribution of the classes in the training data is often severely disproportional. This imbalanced data problem is affecting the performance of incremental learning algorithms. To mitigate this problem, we propose an incremental learning algorithm for network IDSs that can learn from imbalanced data. Our proposed method is an ensemble incremental learning algorithm composed of the Hoeffding Tree, incremental Adaptive Boosting (AdaBoost), and Hard Sampling algorithms. The experimental results show that our proposed model has superior performance compared to the other incremental learning models tested in this study. Moreover, our proposed method increases the robustness of the incremental learning model against the imbalanced data problem.