PaperlayerView exact revision on arXiv

Source-linked AI summary

AI-based Two-Stage Intrusion Detection for Software Defined IoT Networks

Jiaqi Li, Zhifeng Zhao, Rongpeng Li, Honggang Zhang

arXiv:1806.02566v1cs.CRcs.AI

TL;DR

SD-IoT networks need intrusion detection that can handle evolving attacks more intelligently than conventional approaches, while existing AI-based methods remain insufficiently precise and robust. The paper proposes a two-stage system combining enhanced Bat-based feature selection with weighted Random forest flow classification, and reports higher accuracy with lower overhead than existing solutions.

  • Problem

    Existing intrusion-detection methods and AI-based schemes remain insufficient for precise, robust detection of evolving attacks in SD-IoT networks.

  • Method

    The paper combines swarm-divided, mutation-enhanced Bat Algorithm feature selection with sample-weighted and weighted-voting Random forest flow classification.

  • Results

    The proposed combined methods generate better performance across the evaluated metrics, with higher accuracy and lower overhead than existing solutions.

  • Takeaways & Limitations

    AI-based two-stage detection can select more discriminative features and improve flow-based intrusion detection in SD-IoT networks without much time consumption.

Abstract

from arXiv · show

Software Defined Internet of Things (SD-IoT) Networks profits from centralized management and interactive resource sharing which enhances the efficiency and scalability of IoT applications. But with the rapid growth in services and applications, it is vulnerable to possible attacks and faces severe security challenges. Intrusion detection has been widely used to ensure network security, but classical detection means are usually signature-based or explicit-behavior-based and fail to detect unknown attacks intelligently, which are hard to satisfy the requirements of SD-IoT Networks. In this paper, we propose an AI-based two-stage intrusion detection empowered by software defined technology. It flexibly captures network flows with a globle view and detects attacks intelligently through applying AI algorithms. We firstly leverage Bat algorithm with swarm division and Differential Mutation to select typical features. Then, we exploit Random forest through adaptively altering the weights of samples using weighted voting mechanism to classify flows. Evaluation results prove that the modified intelligent algorithms select more important features and achieve superior performance in flow classification. It is also verified that intelligent intrusion detection shows better accuracy with lower overhead comparied with existing solutions.

I. INTRODUCTION

SD-IoT improves centralized network supervision and flexible resource management but remains exposed to evolving attacks. Existing intrusion-detection approaches and AI-based schemes do not yet provide sufficiently precise, robust detection for these networks.

  • Motivation: SDN-based IoT centralizes network supervision, flow-information collection, management, and resource allocation, but does not eliminate security challenges.The architecture addresses flexibility and scalability concerns while leaving SD-IoT networks vulnerable to attacks.
  • Existing intrusion detection: Signature-based misuse detection recognizes known attacks, whereas anomaly detection can identify novel attacks but may generate false alarms.These limitations motivate more intelligent detection methods.
  • Research gap: AI-based schemes learn patterns from historical data, yet existing AI-IDS research remains insufficiently precise and robust for evolving SD-IoT networks.The paper frames this as the central gap its method addresses.
  • Contribution: The paper proposes enhanced AI algorithms for feature selection and flow classification in a two-stage SD-IoT intrusion-detection system.The improved Bat algorithm selects features, while weighted Random forest classifies flows.

III. AI-BASED TWO STAGE INTRUSION DETECTION

The proposed SD-IoT detector captures flows under centralized SDN control and processes them through feature selection followed by flow classification. Its two algorithms enhance Bat-based optimization through swarm coordination and adaptive search, then use Random forest as the classification stage.

  • III. AI-BASED TWO STAGE INTRUSION DETECTION: SDN controllers collect network status and packets, partition packets into flows, and support two-stage detection through feature selection and flow classification.The controller then manages resource arrangement after detection.
  • III. AI-BASED TWO STAGE INTRUSION DETECTION: The first stage enhances Bat Algorithm feature selection, while the second applies Random forest to classify network flows.The paper combines swarm intelligence with ensemble classification.
  • A. Swarm division: The improved Bat algorithm divides the swarm into K-means subgroups so individuals learn locally and share information through global and subgroup best positions.Each bat retains a previous best position while updating location, velocity, and frequency.
  • A. Swarm division: Linearly varying inertia and self-learning factors shift Bat Algorithm behavior from broader early exploration toward more accurate later exploitation.The changing parameters adjust the influence of movement and historical or global best positions across iterations.

B. Binary Differential Mutation

The Binary Differential Mutation stage extends the improved Bat algorithm for binary feature-selection representations. It uses subgroup-based individual differences and adaptive mutation controls to increase population diversity and reduce local-minimum trapping.

  • B. Binary Differential Mutation: Binary Differential Evolution is added after each bat update to increase population diversity and improve convergence.The mutation mechanism is adapted because the original method addresses continuous optimization, whereas feature selection uses binary representations.
  • B. Binary Differential Mutation: The algorithm represents each bat’s location and velocity as binary strings and applies logical operations to implement mutation.The paper defines ‘+’ as XOR and ⊕ as OR, with random conditions controlling whether operations execute.
  • B. Binary Differential Mutation: The shrinkage factor F_t controls differential-vector influence: larger values preserve population diversity, while smaller values support local search.F_t is randomly generated between 0 and 1 and varies the individuals’ perturbations.
  • B. Binary Differential Mutation: Mutation occurs when rand<P_t, where P_t adapts with iteration count to balance early search and later escape from local minima.The paper states that mutation becomes more likely as iterations increase.
  • B. Binary Differential Mutation: The complete procedure initializes the population, repeatedly updates controls and subgroup states, applies bat updates and optional mutation, and returns the best solution.The pseudocode includes fitness evaluation and global-best updates across iterations.

V. IMPROVED OF RANDOM FOREST FOR FLOW

The paper improves Random forest classification for imbalanced intrusion data, where minority attacks are sampled less often and can incur higher misclassification costs. The stated objective is to optimize detection of these minority classes.

  • V. IMPROVED OF RANDOM FOREST FOR FLOW: Random forest can underperform on minority classes because bootstrap sampling makes their examples less likely to be selected and learned.This weakness arises when the intrusion dataset is imbalanced.
  • V. IMPROVED OF RANDOM FOREST FOR FLOW: Misclassifying minority-class intrusions can have higher cost than misclassifying majority classes, motivating an optimized Random forest algorithm.The paper presents this cost asymmetry as the reason for modifying the classifier.

A. Weight initialization

The method initializes training samples with class-dependent weights so minority classes receive more attention during tree training.

  • A. Weight initialization: Each training sample is initialized with a weight based on its class rather than uniformly.The original uniform initialization is replaced by class-dependent weighting.
  • A. Weight initialization: The five class weights are 0.3, 0.15, 0.35, 0.05, and 0.15, reflecting the dataset’s class distribution.
  • A. Weight initialization: The scheme reduces majority-class weights while increasing minority-class weights.
  • A. Weight initialization: Samples are selected with replacement using roulette-wheel sampling to train each tree.Higher-weight minority samples therefore have greater selection probability.

B. Weight update

The method updates sample weights after each tree, emphasizing misclassified examples while using class-sensitive scaling to preserve attention to minority classes.

  • B. Weight update: After each tree, misclassified samples receive higher weights and correctly classified samples receive lower weights.The update focuses later trees on samples that previous trees classified incorrectly.
  • B. Weight update: The procedure uses cost-sensitive weighting to train misclassified samples from distinctive classes to different extents.
  • B. Weight update: The β factor controls how strongly sample weights change across four class-dependent situations.
  • B. Weight update: For minority classes, misclassified samples are increased substantially while correctly classified samples are decreased slightly.
  • B. Weight update: For majority classes, the weight adjustment is reversed relative to minority classes.

C. Weighted voting

Weighted voting combines trees according to their class-specific accuracy, allowing trees with stronger performance on a class to exert more influence on its prediction.

  • C. Weighted voting: Because tree performance varies across classes, the method replaces ordinary majority voting with weighted voting.
  • C. Weighted voting: The accuracy matrix records the accuracy of each tree for each class.
  • C. Weighted voting: The ensemble result combines each tree’s classification judgment using its class-specific weight.In Eq. (13), f(x) denotes the ensemble result and Gm(x) the judgment of tree m.
  • C. Weighted voting: Figure 3 uses differently sized colorful histograms to represent each tree’s accuracy for each class and illustrates classification of a class-2 sample.
  • C. Weighted voting: The modified random forest balances majority-class over-learning with greater emphasis on minority classes in imbalanced data.

VI. EVALUATION RESULT

The evaluation uses a downsampled KDD Cup 1999 subset to assess feature selection, flow classification, and the combined two-stage intrusion detector with standard detection metrics.

  • VI. EVALUATION RESULT: The experiments evaluate the proposed intrusion detection mechanisms through numerical testing.
  • VI. EVALUATION RESULT: A five-class flow-classification task uses a downsampled subset of the KDD Cup 1999 dataset.Training and testing distributions are summarized by attack type in Table III.
  • VI. EVALUATION RESULT: Algorithm 2 trains multiple trees, updates sample weights iteratively, and determines the ensemble result.
  • VI. EVALUATION RESULT: The evaluation considers precision, recall, F-score, accuracy, false alarm rate, and misclassification cost.The desired direction is higher detection with a lower false rate.

B. Performance Analysis

The evaluation examines the proposed feature-selection mechanism through convergence, parameter, clustering, and classification-performance analyses. Results indicate faster convergence, higher fitness, and improved classification outcomes from the enhanced Bat algorithm.

  • The evaluation measures feature-selection optimality and convergence, flow-classification detection ability, and comparisons with existing solutions.
  • The proposed algorithm selects more discriminative features, achieving higher accuracy and lower false alarm rates than compared algorithms.
  • At about iteration 40, the proposed algorithm converges faster, reaches higher fitness, and remains above the other curves.Swarm division, mutation, and linear time-varying parameters are reported to improve search behavior.
  • Accuracy increases with more iterations and generally improves with larger swarms, while the algorithm converges within a restricted number of iterations.Larger populations are associated with greater search diversity and broader search ability.
  • K-means swarm division achieves higher fitness and faster convergence than the other examined clustering methods.The method combines within-subgroup learning with knowledge sharing across populations.

2) Evaluations on the proposed Random forest algorithm:

The enhanced Random Forest is evaluated against ordinary Random Forest and other machine-learning algorithms using weighted samples and class-specific tree voting. It reports better overall metrics, stronger minority-class detection, and lower overhead.

  • The enhanced Random Forest generates better performance in every reported metric than ordinary Random Forest and other machine-learning algorithms.Sample reweighting emphasizes frequently misclassified samples, while weighted voting makes each tree's class-specific performance affect the final result.
  • The proposed Random Forest dramatically improves minority-intrusion detection accuracy while slightly increasing detection rates for majority intrusions.Adaptive sample weighting emphasizes minority classes while avoiding over-fitting for majority classes.
  • The proposed algorithm produces less overhead than Random Forest and the other compared machine-learning algorithms as the number of flows varies.The overhead metric increases with more misclassified flows.

3) Evaluations on the performance of combined algorithms in the two stages:

The combined improved algorithms outperform the evaluated combination alternatives across every reported metric. Compared with existing systems, the two-stage detector improves classification accuracy with tolerable time consumption, while future work remains to evaluate it in a real network.

  • Combined algorithms: The proposed feature-selection and traffic-classification combination achieves better performance than all evaluated alternatives in every metric.The evaluation compares the improved algorithms with several groups of traditional feature-selection and machine-learning algorithms.
  • Comparison with existing systems: The proposed two-stage intrusion detection improves classification accuracy with tolerable time consumption compared with previous approaches.Processing time is evaluated using a portion of dataset flows, alongside classification accuracy and error rate.
  • Overall performance: The system achieves higher accuracy and lower overhead, and improves detection ability without much time consumption compared with existing solutions.These conclusions are reported as outcomes of the experiments evaluating the proposed algorithms and system.
  • Future work: The approach still requires implementation and performance evaluation in a real network.The authors identify real-network traffic evaluation as future work.
Loading 1806.02566v1…