PaperlayerView exact revision on arXiv

Source-linked AI summary

A Lightweight Concept Drift Detection and Adaptation Framework for IoT Data Streams

Li Yang, Abdallah Shami

arXiv:2104.10529v1cs.LGcs.AI

TL;DR

IoT streaming analytics must handle concept drift in dynamic, resource-constrained environments. The paper combines PSO-optimized LightGBM with OASW for online drift adaptation, achieving high accuracy and low resource usage on two public datasets.

  • Problem

    Concept drift in changing IoT data streams challenges analytics models, while IoT devices impose time and memory constraints.

  • Method

    The framework combines LightGBM, PSO hyperparameter optimization, and OASW to detect drift and retrain on current-concept samples.

  • Results

    The adaptive model achieved the highest accuracy on IoTID20 at 99.92% and on NSL-KDD at 98.31%, with average prediction times of 7.8 ms and 9.1 ms.

  • Takeaways & Limitations

    The adaptive LightGBM model supports continuous IoT stream learning and drift adaptation with low time and memory usage.

Abstract

from arXiv · show

In recent years, with the increasing popularity of "Smart Technology", the number of Internet of Things (IoT) devices and systems have surged significantly. Various IoT services and functionalities are based on the analytics of IoT streaming data. However, IoT data analytics faces concept drift challenges due to the dynamic nature of IoT systems and the ever-changing patterns of IoT data streams. In this article, we propose an adaptive IoT streaming data analytics framework for anomaly detection use cases based on optimized LightGBM and concept drift adaptation. A novel drift adaptation method named Optimized Adaptive and Sliding Windowing (OASW) is proposed to adapt to the pattern changes of online IoT data streams. Experiments on two public datasets show the high accuracy and efficiency of our proposed adaptive LightGBM model compared against other state-of-the-art approaches. The proposed adaptive LightGBM model can perform continuous learning and drift adaptation on IoT data streams without human intervention.

I. INTRODUCTION

IoT systems generate rapidly growing streaming data, but dynamic environments create concept drift that can degrade analytics. The paper proposes an adaptive LightGBM framework combining PSO optimization and OASW drift adaptation for intrusion detection.

  • IoT devices and services generate rapidly increasing streaming data that must be collected from diverse sources for analytics.
  • Dynamic IoT environments cause statistical distribution changes, or concept drift, which can lead to system failure or performance degradation.
  • Traditional offline machine-learning models cannot handle concept drift, motivating online adaptive analytics for changing IoT data.
  • The proposed framework combines LightGBM learning, PSO model optimization, and OASW drift adaptation for IoT streaming analytics.
  • The framework is evaluated for intrusion detection on the public IoTID20 and NSL-KDD cybersecurity datasets.

A. Time and Memory Constraints

IoT analytics must operate under device time and memory constraints while handling non-stationary data. Online learning and drift detection methods address these constraints, but drift can take multiple forms and arise from varied causes.

  • A. Time and Memory Constraints: Low-power, low-cost IoT devices limit the speed and memory available for processing high-velocity, high-volume streams.
  • A. Time and Memory Constraints: Sliding-window methods retain recent samples and discard older data, reducing storage requirements through forgetting mechanisms.
  • B. Concept Drift Detection: Concept drift reflects distribution changes caused by evolving physical events, device aging, updates, seasonality, and trends.
  • B. Concept Drift Detection: Drift can be gradual, sudden, or recurring, requiring detection and adaptation to preserve analytics performance.
  • B. Concept Drift Detection: Window-based detectors are fast but may lose historical information, whereas performance-based detectors require ground-truth labels.

C. Concept Drift Adaptation

Concept-drift adaptation can use adaptive algorithms, incremental learning, or ensembles. These approaches trade historical-pattern retention and adaptation capability against retraining or execution costs.

  • C. Concept Drift Adaptation: Adaptive algorithms retrain or alter a model after drift detection using data representing the altered concept.
  • C. Concept Drift Adaptation: SAM-KNN uses dual memory to retain both new and older useful data for fitting current and previous concepts.
  • C. Concept Drift Adaptation: HATT incrementally selects and splits tree nodes when confidence thresholds are reached, supporting efficient drift adaptation.
  • C. Concept Drift Adaptation: Ensemble methods combine multiple base learners to improve generalization and retain historical and new patterns separately.
  • C. Concept Drift Adaptation: ARF and SRP combine Hoeffding trees with ADWIN, but ensemble models often require high execution time.

A. System Overview

The proposed system separates offline initialization from online stream processing. It uses PSO-optimized LightGBM initially, then retrains on OASW-selected current-concept samples when drift is detected.

  • A. System Overview: The framework has offline learning for an initial model and online training for detecting attacks in IoT data streams.
  • A. System Overview: Offline training uses historical traffic to train LightGBM, while PSO tunes its hyperparameters.
  • A. System Overview: During online processing, the initial LightGBM model analyzes continuously generated data streams.
  • A. System Overview: When OASW detects concept drift, LightGBM is retrained on new-concept samples collected by its adaptive window.

B. Optimized LightGBM

The framework uses LightGBM as an efficient IoT analytics model and tunes its hyperparameters with PSO. LightGBM combines ensemble learning with sampling, feature bundling, categorical-data support, feature selection, and multithreading.

  • LightGBM uses gradient-based one-side sampling and exclusive feature bundling to reduce computational complexity from O(NF) to O(N′B).GOSS reduces instances, while EFB bundles mutually exclusive features.
  • LightGBM is selected for non-linear, high-dimensional IoT data because it offers generalizability, robustness, and efficient processing.
  • The model supports categorical-data processing, feature selection, and multithreaded parallel execution, simplifying preparation and improving efficiency.
  • PSO tunes LightGBM hyperparameters by updating particles toward individual and global best positions.The tuned hyperparameters include leaves, tree depth, minimum data per leaf, learning rate, and base learners.

C. OASW: Proposed Drift Adaptation Algorithm

OASW detects and adapts to concept drift by combining sliding and adaptive windows with performance-based thresholds. It collects new-concept samples, updates the learner when warranted, and uses PSO to optimize adaptation parameters.

  • OASW combines sliding-window drift detection with adaptive-window drift adaptation and performance-based updating.Its two functions, DriftAdaptation and HPO, detect drift, update LightGBM, and optimize adaptation hyperparameters.
  • A sliding window compares current and previous-window accuracies; a drop of α percent triggers warning-level collection of new-concept samples.
  • The learner is updated when new-concept accuracy reaches the warning threshold or the adaptive window reaches t′max.The maximum adaptive-window size bounds memory and real-time requirements.
  • OASW releases the adaptive window after a false alarm when accuracy stops declining or returns to the normal level.
  • PSO tunes OASW’s four hyperparameters and targets the highest overall accuracy, with training complexity O(NM) and runtime and space complexity O(N).M is the maximum PSO hyperparameter-search count.
  • OASW trades accuracy against computational complexity by collecting sufficient new-concept samples while removing previous-concept samples.

A. Experimental Setup

The experiments evaluate the adaptive framework on two IoT anomaly-detection datasets using offline training and online learning. Comparisons include four drift-adaptation baselines and multiple predictive metrics.

  • IoTID20 contains 94% normal and 6% abnormal samples, whereas NSL-KDD is balanced and includes a known training-to-test drift.The reduced datasets contain 62,578 IoTID20 records and 35,140 NSL-KDD records.
  • Hold-out validation uses the first 10% of each dataset for offline training and the final 90% for online learning.
  • Online prequential validation tests each incoming instance before using it for model updating.
  • The evaluation reports accuracy, precision, recall, and f1-score while comparing SAM-KNN, HATT, ARF, and SRP.These four methods are evaluated as state-of-the-art drift-adaptation approaches.

B. Experimental Results and Discussion

The proposed adaptive LightGBM model achieved the highest reported accuracy on both IoTID20 and NSL-KDD while maintaining low prediction time and memory usage. Its performance was evaluated against other drift-adaptive methods and without drift adaptation.

  • Model optimization: PSO automatically tuned the hyperparameters of the LightGBM and OASW models for IoT attack detection.The optimized values were assigned to construct the proposed models.
  • Accuracy comparison: 99.92% accuracy on IoTID20 exceeded offline LightGBM at 99.78% and other methods at 99.01% - 99.27%.The proposed model adapted a slight concept drift detected at point 13408.
  • Accuracy comparison: 98.31% accuracy on NSL-KDD exceeded offline LightGBM at 84.25% and other methods at 94.11% - 96.58%.The proposed model adapted a severe drift detected at point 9183.
  • Efficiency: The proposed method used the least memory on both datasets by updating on an OASW-selected subset rather than the entire stream.This reduced update data while supporting online learning under IoT device time and memory constraints.
  • Efficiency: 7.8 ms and 9.1 ms were the proposed model’s average per-instance prediction times on Raspberry Pi 3 across the two datasets.These times were shorter than SAM-KNN and SRP, while ARF and HATT were faster but less accurate.
  • Efficiency: 1.3 ms and 0.9 ms were the framework’s average execution times per sample on desktop and Google Colaboratory Cloud machines.The reported processing speed was presented as feasible for real-time environments.

V. CONCLUSION

The paper concludes that integrating OASW, LightGBM, and PSO yields an adaptive IoT analytics model for changing data streams. Experiments on IoTID20 and NSL-KDD reported high accuracy with low time and memory usage for IoT anomaly detection.

  • Conclusion: The adaptive LightGBM model combines OASW, LightGBM, and PSO to automatically adapt to changing IoT data streams.The model was evaluated on two public IoT anomaly detection datasets.
  • Conclusion: The proposed system detects IoT attacks with high accuracy and low time and memory usage compared with several state-of-the-art drift adaptation methods.The conclusion presents these properties as the main reported outcome of the experiments.
Loading 2104.10529v1…