ExBCIL: an exemplar-based class incremental learning for intrusion detection system

Classical Network intrusion detection systems (N-IDSs) produce fairly accurate attack detection rates. However, these models operate in a static environment, which restricts the model’s update once they are deployed. The use of Continual Learning (CL) approaches provides a mechanism to accumulate old knowledge while continually adapting to the latest intrusions and better handling the dynamic environment. Replay-based continual learning proves to be a practical approach when working in a dynamic environment, and thus, our work extends the existing replay-based approach. However, the major challenge is to keep informative candidate vectors in episodic memory for replay purposes to mitigate catastrophic forgetting. It is essential to capture diverse samples for better class representation. In this work, we present a novel exemplar-based class incremental learning (ExBCIL) for intrusion detection, which updates the model in increments by keeping a small subset of past attack samples. However, it is challenging to select the most appropriate attack samples for the replay. While marking the importance of a sample, we consider both the discrimination and representation power of it. To improve the overall performance of learning and to detect emerging intrusions, we aim to keep a more diverse set of attack samples. We use the CICIDS2017, CICIDS2018, and UNSWNB-15 datasets to evaluate the model performance and compare the performance with other existing algorithms. The ExBCIL witnesses significant improvement in intrusion classification, with an average incremental accuracy of \(95.6875 \pm 3.27\%\) $95.6875\pm 3.27\%$ , an average score of \(95.5 \pm 3.04\%\) $95.5\pm 3.04\%$ , and a performance (accuracy) drop of \(7.91\%\) $7.91\%$ .