Network intrusion detection via tri-broad learning system based on spatial-temporal granularity

• DOI: 10.1007/s11227-022-05025-x
• Publication Date: 2023-01-09T17:03:54Z
• Authors: Jieling Li; Hao Zhang; Zhihuang Liu; Yanhua Liu
• Keywords: Granularity; Initialization; Feature (linguistics)

Abstract Network intrusion detection system plays a crucial role in protecting the integrity and availability of sensitive assets. Network traffic data contains a large amount of time, space, and statistical information. Existing research lacks the utilization of spatial-temporal multi-granularity data features and the mutual support among different data features, thus making it difficult to specifically and accurately identify anomalies. Taking into account the distinctions among different granularities, we propose a framework called Tri-Broad Learning System (TBLS), which can learn and integrate the three granular features. In order to accurately explore the spatial-temporal connotation of the traffic information, a feature dataset containing three granularities is constructed according to the characteristics of time, space, and data content. In this way, we use broad learning basic units to extract abstract features of different granularities, and then express these features in different feature spaces to enhance them separately. We use the “He” instead of the original initialization method in BLS to initialize the weights of feature nodes and enhancement nodes to achieve better detection accuracy. We exhibit the merits of our proposed model on the UNSW-NB15, CIC-IDS-2017, and mixed traffic datasets. Experimental JOURNAL OF SUPERCOMPUTING results show that TBLS outperforms the typical BLS in terms of various evaluation metrics and time consumption. Compared with other machine learning methods, TBLS achieves better performance metrics.