An Online Network Intrusion Detection Model Based on Improved Regularized Extreme Learning Machine

Yanqiang Tang,Chenghai Li

doi:10.1109/access.2021.3093313

Abstract

Extreme learning machine (ELM) is a novel single-hidden layer feedforward neural network to obtain fast learning speed by randomly initializing weights and deviations. Due to its extremely fast learning speed, it has been widely used in training of massive data in recent years. In order to adapt to the real network environment, based on the ELM, we propose an improved particle swarm optimized online regularized extreme learning machine (IPSO-IRELM) intrusion detection algorithm model. First, the model replaces the traditional batch learning with sequential learning by dynamically adapting the new data obtained in the training network instead of training all collected samples in an offline manner; second, we improve the particle swarm optimization algorithm and compare it with typical improved algorithms to prove its effectiveness; finally, to solve the random initialization problem of IRELM, we use IPSO to optimize the initial weights and deviations of IRELM to improve the classification ability of IRELM. The experimental results show that IPSO-IRELM algorithm has better generalization ability, which not only improves the accuracy of intrusion detection, but also has certain recognition ability for minority class samples.

Highlights

The widespread use of information technology and the emergence and development of cyberspace have greatly contributed to economic and social prosperity and progress, but at the same time brought new security risks and challenges
All the above studies do not adopt a dynamic way to train the data. This paper combines both RELM and optimization of ELM network structure, and proposes an online regularized extreme learning machine model, which solves the initialization problem of ELM and improves the generalization ability of the model, and transforms offline learning into online learning without reducing the learning efficiency of the algorithm, and has the ability to be more adaptable to modern intrusion detection
XVII-XXI, we found that classification and multivariate classification data sets, it is when the classification error occurs, only looking at the verified that the IPSO-IRELM algorithm has better precision rate and true positive rate (TPR) can potentially see which category classification performance

Summary

INTRODUCTION

The widespread use of information technology and the emergence and development of cyberspace have greatly contributed to economic and social prosperity and progress, but at the same time brought new security risks and challenges. The improved RELM, if used directly for intrusion detection, still uses batch learning and trains all samples obtained once, and subsequently does not learn new knowledge and still fails to detect new attacks in the network To address this problem, this paper continues to propose an online regularized ELM (IRELM) based on RELM, which has the ability of dynamic sequential learning and adaptively learns the constant flow of traffic in the network for intrusion detection; we improve the PSO algorithm to reduce the probability of falling into local extremum points, which in turn better optimizes IRELM.

Related work

Regularization methods

Parameter setting

NSL-KDD data set 2-element classification experiment results

NSL-KDD data set multivariate classification experiment results

CONCLUSION