A DRIFT-AWARE CYBERATTACK DETECTION FRAMEWORK FOR RESOURCE-CONSTRAINED NETWORKS USING ADAPTIVE LEARNING AND UNCERTAINTY-BASED ALERTS

Sathyaraj S; Deepika A

doi:10.5281/zenodo.23834173

Abstract

Intrusion detection models deployed on resource-constrained networks face two practical difficulties that are often
studied in isolation. Attack behaviour changes over time, so a model trained once tends to lose accuracy as the
traffic distribution shifts, and the volume of generated alerts can exceed the capacity of the analysts who must act
on them. This study presents a detection framework that addresses both concerns within a single streaming
pipeline. An incremental ensemble classifier is paired with an adaptive windowing drift monitor that governs
when the model updates, and a predictive-uncertainty gate decides whether each flagged flow is raised as an
automated alert or routed to analyst review. The framework was evaluated on the CICIDS2017 flow dataset using
a chronological prequential protocol that preserves the order of traffic and exposes the model to shifting attack
mixes. Under this protocol the proposed framework reached a prequential F1-score of 0.951 for the attack class,
compared with 0.936 for an adaptive random forest and 0.862 for a static offline model. After each induced
distribution change the static model settled at a lower accuracy, whereas the proposed framework returned to its
prior range within a few evaluation windows. At a gating threshold of 0.40 the precision of automated alerts rose
to 0.976 while 15 percent of flows were referred for review. The detector operated within a 256 MB memory
profile and sustained roughly 1,390 flows per second. These results describe behaviour for the evaluated dataset
and configuration and are not presented as evidence of universal improvement.

Keywords

intrusion detection, concept drift, online learning, adaptive random forest, predictive uncertainty, alert triage, edge networks, resource - constrained machine learning.

References

1) I. Sharafaldin, A. H. Lashkari, and A. A. Ghorbani, "Toward Generating a New Intrusion Detection Dataset and Intrusion Traffic Characterization," in Proc. 4th Int. Conf. Information Systems Security and Privacy (ICISSP), 2018, pp. 108 - 116, doi: 10.5220/000 6639801080116.
2) H. M. Gomes et al., "Adaptive random forests for evolving data stream classification," Machine Learning, vol. 106, no. 9 - 10, pp. 1469 - 1495, 2017, doi: 10.1007/s10994 - 017 - 5642 -
3) A. Bifet and R. Gavalda, "Learning from Time - Changing Data with Adaptive Windowing," in Proc. SIAM Int. Conf. Data Mining (SDM), 2007, pp. 443 - 448, doi: 10.1137/1.9781611972771.42.
4) P. Domingos and G. Hulten, "Mining High - Speed Data Streams," in Proc. 6th ACM SIGKDD Int. Conf. Knowledge Discovery and Data Mining, 2000, pp. 71 - 80, doi: 10.1145/347090.347107.
5) J. Gama, I. Zliobaite, A. Bifet, M. Pechenizkiy, and A. Bouchachia, "A survey on concept drift adaptation," ACM Computing Surveys, vol. 46, no. 4, Art. no. 44, 2014, doi: 10.1145/2523813.
6) J. Gama, P. Medas, G. Castillo, and P. Rodrigues, "Learning with Drift Detection," in Advances in Artificial Intelligence (SBIA 2004), LNCS vol. 3171, pp. 286 - 295, 2004, doi: 10.1007/978 - 3 - 540 - 28645 - 5_29.
7) N. V. Chawla, K. W. Bowyer, L. O. Hall, and W. P. Kegelmeyer, "SMOTE: Synthetic Minority Over - sampling Technique," Journal of Artificial Intelligence Research, vol. 16, pp. 321 - 357, 2002, doi:
8) 1613/jair.953.
9) N. Moustafa and J. Slay, "UNSW - NB15: a comprehensive data set for network intrusion detection systems," in Proc. Military Communications and Information Systems Conf. (MilCIS), 2015, pp. 1 - 6, doi: 10.1109/MilCIS.2015.7348942.
10) M. Tavallaee, E. Bagheri, W. Lu, and A. A. Ghorbani, "A detailed analysis of the KDD CUP 99 data set," in Proc. IEEE Symp. Computational Intelligence for Security and Defense Applications (CISDA), 2009, pp. 1 - 6, doi: 10.1109/CISDA.2009.5356528.
11) J. Montiel et al., "River: machine learning for streaming data in Python," Journal of Machine Learning Research, vol. 22, no. 110, pp. 1 - 8, 2021.
12) B. Settles, "Active Learning Literature Survey," University of Wisconsin - Madison, Computer Sciences Technical Report 1648, 2009.
13) R. Sommer and V. Paxson, "Outside the Closed World: On Using Machine Learning for Network Intrusion Detection," in Proc. IEEE Symp. Security and Privacy, 2010, pp. 305 - 316, doi:
14) 1109/SP.2010.25.