Adaptive intrusion detection system based on variable length multi-objective particle swarm optimization

Intrusion Detection Systems (IDS) based on data stream encounter a unique phenomenon known as feature drift, where the significance of features evolves over time, potentially reducing the efficacy of IDSs or rendering them obsolete. Feature drift, along with other critical challenges such as high dimensionality, concept drift, and imbalanced datasets, necessitates the development of a framework that can adaptively and jointly handle these challenges to remain dynamically functional over time. Therefore, this thesis introduces an advanced IDS framework named Dynamic Feature Aware Genetic Programming Ensemble (DFA-GPE). DFA-GPE employs an incremental learning procedure to eliminate the need for storing incoming data or retraining the IDS, utilizes the Synthetic Minority Oversampling Technique (SMOTE) to address imbalanced datasets, and employs a Drift Detection Method (DDM) to detect and manage concept drift. A crucial component of the framework is the advanced Dynamic Feature Selection (DFS) method based on Multi-Objective Particle Swarm Optimization (MOPSO), utilized to handle feature drift and reduce the dimension simultaneously. The development of MOPSO started with the introduction of an advanced algorithm, named Multi-Exemplar Particle Swarm Optimization with Local Awareness (MEPSOLA), designed to tackle conflicting optimization challenges. MEPSOLA integrates advanced strategies, including smart initialization, multi-exemplar, and conditional local search techniques, into the process of exemplar selection enhancement. MEPSOLA was evaluated using several standard mathematical benchmarks and the results compared against well-established benchmark Multi-Objective Optimization (MOO) algorithms in the literature. Building on the foundational MEPSOLA, the algorithm was further refined and adapted for online DFS to operate in the DFA-GPE framework. Adjusted under the name Variable Length Multi-Objective Particle Swarm Optimization (VLMO-PSO), it dynamically manages feature drift. VLMO-PSO utilized a smart population initialization strategy and introduced a division-based search criterion that partitions the solution space into discrete segments or divisions. Additionally, it leverages a unique set of transfer functions that map mobility equation outcomes into the binary decision space and an innovative multi-objective exemplar selection method that balances exploration and exploitation. The final feature selection decisions within VLMO-PSO are performed by statistical analyses of feature weights, simultaneously enhancing accuracy and conserving memory. An evaluation of DFA-GPE on two benchmark datasets, namely HIKARI 2021 and TON_IoT 2020, compared its performance to different feature selection methods including Random Forest (RF), Logistic Regression (LR), Recursive Feature Elimination (RFE), and Non-dominated Sorting Genetic Algorithm (NSGA-II). Within the HIKARI dataset, DFA-GPE achieved the highest accuracy of 99.09%, surpassing NSGA-II of 98.79%, RF of 98.73%, LR of 98.62%, and RFE of 98.39%. Memory utilization showed a saving of 93.49%, reducing the number of features from 67 to just 5. Similarly, for the TON_IoT dataset, DFA-GPE led with an accuracy of 92.64%, outperforming NSGA-II of 92.18%, RF of 92.01%, RFE of 91.51%, and LR of 90.74%, reducing the feature count from 42 to 16 and achieving a memory saving of 62.93%.

Text FK 2024 11 - Declaration Form.pdf Restricted to Repository staff only Available under License Creative Commons Attribution Non-commercial No Derivatives. Download (431kB) Text FK 2024 11 - Full Text.pdf Available under License Creative Commons Attribution Non-commercial No Derivatives. Download (16MB) Text FK 2024 11.pdf Restricted to Repository staff only Available under License Creative Commons Attribution Non-commercial No Derivatives. Download (16MB) Official URL or Download Paper: http://ethesis.upm.edu.my/id/eprint/18975

Actions (login required)

View Item