Affiliations: College of Computer Science and Technology, Harbin Engineering University, Harbin, Heilongjiang, China
Correspondence:
[*]
Corresponding author: Weifei Wu, College of Computer Science and Technology, Harbin Engineering University, Harbin, Heilongjiang, China. E-mail: wuweifei@hrbeu.edu.cn.
Abstract: Intrusion detection plays a very important role in the field of network security. In order to improve the intrusion detection rate, intrusion detection algorithms based traditional machine learning are widely used in this field. These methods generally satisfy the following two assumptions: the training and the testing data must be under the condition of the independent and identical distribution; the training samples are sufficient. However, in practice, the above assumptions are difficult to satisfy, which will result in poor intrusion detection. This paper proposes an intrusion detection algorithm based on active transfer learning ACTrAdaBoost. ACTrAdaBoost takes advantage of transfer learning and need not to satisfy the two assumptions of the traditional machine learning. In addition, ACTrAdaBoost utilizes active learning and maximum mean discrepancy knowledge to obtain maximum knowledge with minimum training sample cost and solve the problem of negative transfer. The ACTrAdaBoost compared with the traditional machine learning method on the KDDCUP99, DARPA1998 and ISCX2012 datasets. The experimental results show that the intrusion detection rate of the ACTrAdaBoost algorithm is greater than benchmark algorithms, and the training time efficiency improves at the same time. The performance of ACTrAdaBoost is better than the traditional machine learning classification algorithm. The ACTrAdaBoost algorithm improves the accuracy of intrusion detection and provides a new research method for intrusion detection.
Keywords: Transfer learning, active learning, machine learning, intrusion detection, network security
