Affiliations: [a] College of Computer Science and Technology, Harbin Engineering University, Harbin, Heilongjiang, China | [b] Beijing Institute of Remote Sensing Equipment, The Second Academy of China Aerospace Science & Industry Corp, Beijing, China
Correspondence:
[*]
Corresponding author: Kunpeng Wang, College of Computer Science and Technology, Harbin Engineering University, Harbin, Heilongjiang, China. E-mail: 13351007612@hrbeu.edu.cn.
Abstract: Intrusion detection can effectively detect malicious attacks in computer networks, which has always been a research hotspot in field of network security. At present, most of the existing intrusion detection methods are based on traditional machine learning algorithms. These methods need enough available intrusion detection training samples, training and test data meet the assumption of independent and identically distributed, at the same time have the disadvantages of low detection accuracy for small samples and new emerging attacks, slow speed of establishment model and high cost. To solve the above problems, this paper proposes an intrusion detection algorithm-TrELM based on transfer learning and extreme machine. TrELM is no longer limited by the assumptions of traditional machine learning. TrELM utilizes the idea of transfer learning to transfer a large number of historical intrusion detection samples related to target domain to target domain with a small number of intrusion detection samples. With the existing historical knowledge, quickly build a high-quality target learning model to effectively improve the detection effect and efficiency of small samples and new emerging intrusion detection behaviors. Experiments are carried out on NSL-KDD, KDD99 and ISCX2012 data sets. The experimental results show that the algorithm can improve the detection accuracy, especially for unknown and small samples.
Keywords: Transfer learning, intrusion detection, extreme learning machine
