Ensemble adaptive online machine learning in data stream: a case study in cyber intrusion detection system

Adaptive online machine learning using data streams is an emerging research area in which algorithms learn dynamically from live data and update regularly for future predictions. On the contrary, traditional machine learning and deep learning approaches follow the batch learning paradigm, which requires the entire dataset to be available in memory for model training and testing purposes. The model is deployed only once with few updates. This approach is not feasible where data arrive in real-time and streaming manner (e.g., modern network traffic data stream, IoT and sensor data stream, etc.). This necessitates the need for the deployment of real-time and adaptive online machine learning systems. In this research study, we have proposed a case study of ensemble adaptive online machine learning in the cyber intrusion detection system (EnsAdp_CIDS) to detect and classify cyber intrusion in network traffic data. The proposed EnsAdp_CIDS algorithm learns instance by instance and fine-tunes its parameters on the fly. We have conducted extensive experimentation on the three benchmark cybersecurity datasets, namely, CICIDS-2017, CIC-IoT-2023 and CIC-MalMem-2022, to evaluate their performance in terms of accuracy, precision, recall and f1-score. The obtained results are compared with recent state-of-the-art machine learning and deep learning algorithms to show the novelty and efficiency of the proposed research work. The obtained accuracy over three cyber security datasets is 99.77%, 98.93% and 99.85%, respectively. The potential applicability of the proposed work is not limited to the cybersecurity domain; in fact, it can be further extended to other domains, such as video analytics and surveillance systems.