Abstract:

The diversity of attack categories and uneven distribution of numbers in network attack data result in the weak generalization ability of existing machine-learning algorithm-based network intrusion detection models for some types of attacks, and the vulnerability of deep learning models to adversarial examples leads to many constraints on the application of deep learning models in network intrusion detection. In this paper, we first proposed a random subspace-based intrusion detection model named BAVE-ELM (Bat Algorithm Voting Ensemble Extreme Learning Machines), which better balanced the generalization ability and false alarm rate of the model. Then, by using BAVE-ELM as a kind of base classifier, an adaptive ensemble-based network intrusion detection model named EA-NIDS (Ensemble Adaptive Network Intrusion Detection System) was proposed, which could significantly enhance the generalization ability of the detection model against various attacks. Finally, we proposed an adversarial machine learning-based network intrusion detection method, which significantly improved the robustness of the model by introducing adversarial training in EA-NIDS. The experimental results indicate that the proposed method can enhance the detection performance and generalization of network intrusion detection effectively, and the robustness of machine learning-based network intrusion detection models against adversarial attacks can be significantly improved without affecting its detection accuracy.

Key words: network intrusion detection, adversarial examples, adaptive ensemble