Enhancing collaborative intrusion detection via disagreement-based semi-supervised learning in IoT environments. (1st July 2020)

• Record Type: Journal Article
• Authors: Li, Wenjuan; Meng, Weizhi; Au, Man Ho
• Is Part Of: Journal of network and computer applications. Volume 161(2020)
• Publication Date: 2020-07-01
• Subjects: Collaborative intrusion detection -- Semi-supervised learning -- False alarm reduction -- Detection performance -- Internet of things; Microcomputers -- Periodicals; Computer networks -- Periodicals; Application software -- Periodicals; Micro-ordinateurs -- Périodiques; Réseaux d'ordinateurs -- Périodiques; Logiciels d'application -- Périodiques; Application software; Computer networks; Microcomputers; Periodicals; 004.05; 004
• DOI: 10.1016/j.jnca.2020.102631
• Languages: English
• ISSNs: 1084-8045

Abstract

Abstract: Collaborative intrusion detection systems (CIDSs) are developing to improve the detection performance of a single detector in Internet of Things (IoT) networks, through exchanging and sharing data. For anomaly detection, machine learning is an important and essential tool to help identify the deviation between current events and pre-built profile. For a traditional supervised learning classifier, there is a need to provide training examples with ground-truth labels in advance. However, labeled instances are quite limited in real-world IoT scenarios, while unlabeled data/instances are widely available. This is because data labeling is a very expensive process that requires huge human efforts and knowledge inputs. To mitigate this issue, the use of semi-supervised learning algorithms is a promising solution, which can leverage unlabeled data to label data automatically without human intervention. In this work, we focus on semi-supervised learning and design DAS-CIDS, by applying disagreement-based semi-supervised learning algorithm for CIDSs. In the evaluation, we investigate the performance of DAS-CIDS using both datasets and in real IoT network environments, in the aspects of both detection performance and false alarm reduction. The experimental results show that as compared with traditional supervised classifiers, our approach is more effective in detecting intrusions and reducing false alarms by automatically leveraging unlabeled data. Graphical abstract: We apply a disagreement-based semi-supervised learning algorithm to the field of intrusion detection. We develop a framework of DAS-CIDS by applying the disagreement-based semi-supervised learning to improve the performance of CIDSs. We perform two major experiments to exploit the performance of our approach with real datasets and in a real IoT environment, respectively. Image 1