Abstract:Anomaly detection plays an essential role in network security and traffic classification. Many studies have focused on anomaly detection to improve network security, including machine learning and deep learning methods. These methods often require numerous samples and must obtain the results by classifying the entire data set, thereby limiting their inflexibility. Although transfer and multitask learning have achieved some results in the model’s transferability, these methods must manually label or reprocess the test set. These problems limit the application of previous methods in network security management. To solve these problems, we propose a transferable and adaptable network intrusion detection system (TA-NIDS) based on deep reinforcement learning. The interaction process between the agent and the environment varies every time. A small-scale data set can be used to produce many interactive processes. Therefore, robustness is guaranteed when there are few samples. Then, a reasonable reward function allows the agent to learn how to first choose outliers without classifying the entire data set. This makes the TA-NIDS more adaptable to the scene when we prioritize apparent outliers. More importantly, the original features are transformed into the state of the environment, so no requirement exists for the feature dimension. Furthermore, the general rather than the specific state of one data set makes the model transferable to other data sets. The experimental results for IDS2017, IDS2018, NSL-KDD, UNSW-NB15 and CIC-IoT2023 show that the proposed framework maintains good accuracy when prioritizing outliers and transferability are prioritized simultaneously.

Using Incremental Learning Method for Adaptive Network Intrusion Detection

Study of Adaptive Intrusion Detection with Data Mining

Research on a Dynamic Self-Learning Efficient Intrusion Detection Model

Adaptive and Lightweight Intrusive Traffic Detection Method Based on Deep Learning under Evolving Network Threats

DRnet: Dynamic Retraining for Malicious Traffic Small-Sample Incremental Learning

Enhancing network intrusion detection by lifelong active online learning

A new network intrusion detection identification model research

Reinforcement-Learning Based Network Intrusion Detection with Human Interaction in the Loop.

Federated Incremental Learning Based Evolvable Intrusion Detection System for Zero-Day Attacks

Incremental Update Intrusion Detection for Industry 5.0 Security: A Graph Attention Network-Enabled Approach

A Novel Online Incremental Learning Intrusion Prevention System

Reinforcement Learning Meets Network Intrusion Detection: A Transferable and Adaptable Framework for Anomaly Behavior Identification

An incremental hybrid adaptive network-based IDS in Software Defined Networks to detect stealth attacks

An Intrusion Detection Approach Based on Incremental Long Short-Term Memory

A near-autonomous and incremental intrusion detection system through active learning of known and unknown attacks

An Adaptive Statistical Neural Network Model

The Research of Immune Based Adaptive Agent Applied in Network Intrusion Detection

An Incremental Learning Network Model Based on Random Sample Distribution Fitting

Continual Learning with Strategic Selection and Forgetting for Network Intrusion Detection

An Adaptive Incremental Learning Algorithm Based on Shared Nearest Neighbors in Fault Detection

Adaptive Resonance Theory Neural Network Based Intrusion Detection Approach