Network Intrusion Detection System with Stream Machine Learning in Fog Layer and Online Labeling in Cloud Layer

Abstract

We proposed a network intrusion detection system that combines a stream machine learning model in the fog layer and an online labeling model in the cloud layer. The stream learning model is based on the Adaptive XGBoost machine learning algorithm, aiming to detect anomaly network traffic. The online labeling model is a batch machine learning model based on the Random Forest algorithm and is responsible to label unknown traffic and provide updates to the stream learning model in the fog layer. The proposed solution effectively detects abnormal traffic in the fog layer that is connected with IoT devices. The stream learning model updates the model at a lower cost as compared to the batch learning approach. To evaluate the proposed system, contemporary datasets are used to test the accuracy of the models. The experiment results show that the proposed scheme effectively achieves good classification accuracy with the cloud layer providing updates to the fog layer. The result is about 17.6% and 9.0% better than the baseline method for the UNSW-NB15 dataset and CIC-IDS2017 dataset, respectively. In addition, the stream learning approach can provide higher throughput than the batch learning approach.