{"corpus_id":145902042,"paper_sha":"076af1c19c4c25de8526b185da31c37b20e0a315","doi":"10.1016/J.KNOSYS.2019.04.008","arxiv_id":null,"pmid":null,"pmcid":null,"mag_id":2938820927,"dblp_id":"journals/kbs/LiuHZMTNG19","acl_id":null,"title":"ANID-SEoKELM: Adaptive network intrusion detection based on selective ensemble of kernel ELMs with random features","year":2019,"publication_date":"2019-08-01","venue":"Knowledge-Based Systems","journal":{"name":"Knowl. Based Syst.","pages":"104-116","volume":"177"},"journal_issn":null,"journal_title":null,"publication_types":["JournalArticle"],"pubmed_pub_types":null,"s2_fields_of_study":["Computer Science"],"reference_count":38,"citation_count":34,"influential_citation_count":0,"is_open_access":false,"arxiv_categories":null,"arxiv_license":null,"arxiv_journal_ref":null,"mesh_headings":null,"chemicals":null,"comments_corrections":null,"source_flags":1,"s2_open_access_pdf_url":null,"s2_open_access_landing_url":null,"s2_open_access_license":null,"s2_open_access_status":null,"pmc_open_access_pdf_url":null,"pmc_open_access_landing_url":null,"pmc_open_access_license":null,"pmc_open_access_status":null,"unpaywall_open_access_pdf_url":null,"unpaywall_open_access_landing_url":null,"unpaywall_open_access_license":null,"unpaywall_open_access_status":null,"abstract":"Abstract This paper presents an adaptive network intrusion detection (ANID) method based on the selective ensemble of kernel extreme learning machines (KELMs) with random features (termed ANID-SEoKELM), aiming at identifying various unauthorized uses, misuses and abuses of computer systems in real time. To generate a lightweight intrusion detector, multiple KELMs are learned independently based on the Bagging strategy with sparse random feature representation (SRFR), to reduce noise and redundant or irrelevant information in network connection instances and ensure the diversity of base learners for the effective ensemble of base learners. A marginal distance minimization (MDM)-based selective ensemble (MDMbSE) method is introduced to generate the ultimate intrusion detector. To ensure the adaptability of the intrusion detector, an incremental learning-based detection-model updating procedure is also derived. Extensive validation and comparative experiments on the benchmark KDD99 dataset and a hybrid heterogeneous network simulation platform mixed with wireless networks and Ethernet networks demonstrate that the ANID-SEoKELM is able to adapt to the dynamically changing network environments hence it can achieve higher detection accuracies stably and efficiently than classic single learner-based intrusion detection methods and representative ensemble-based intrusion detection methods.","claims":[{"public_id":"cl_e339e611f7d1c385344302fd7b462246","status":"active","text":"A marginal distance minimization-based selective ensemble method is introduced to generate the final intrusion detector.","confidence":0.9,"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/claims/cl_e339e611f7d1c385344302fd7b462246"},{"public_id":"cl_38df70dd5818f9e496d953649df0dfdc","status":"active","text":"ANID-SEoKELM is an adaptive network intrusion detection method based on a selective ensemble of kernel extreme learning machines with random features.","confidence":0.95,"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/claims/cl_38df70dd5818f9e496d953649df0dfdc"},{"public_id":"cl_3ea4707ebbb91898fa1064cd46989cf8","status":"active","text":"An incremental learning-based detection-model updating procedure is derived to support adaptation to changing network environments.","confidence":0.88,"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/claims/cl_3ea4707ebbb91898fa1064cd46989cf8"},{"public_id":"cl_751958ffce39a87f7a42576560139ccf","status":"active","text":"Multiple kernel extreme learning machines are learned independently using Bagging with sparse random feature representation to build a lightweight and diverse intrusion detector.","confidence":0.9,"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/claims/cl_751958ffce39a87f7a42576560139ccf"},{"public_id":"cl_5672dbbef6b61d3b450a9b7fc2c3e06d","status":"active","text":"Validation on the KDD99 dataset and a hybrid heterogeneous network simulation platform shows that ANID-SEoKELM achieves higher detection accuracies stably and efficiently than classic single learner-based and representative ensemble-based intrusion detection methods.","confidence":0.93,"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/claims/cl_5672dbbef6b61d3b450a9b7fc2c3e06d"}],"concepts":[{"public_id":"co_00f96ec936da35c227092bd4b4e0dc78","status":"active","name":"hybrid heterogeneous network simulation platform","description":"An evaluation platform mixing wireless networks and Ethernet networks for intrusion detection experiments.","types":["evaluation platform"],"aliases":[],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_00f96ec936da35c227092bd4b4e0dc78"},{"public_id":"co_133f07aea3dc6666b93c94b7914794b2","status":"active","name":"marginal distance minimization-based selective ensemble","description":"A selective ensemble method based on marginal distance minimization for selecting base learners for the final detector.","types":["method"],"aliases":["MDMbSE"],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_133f07aea3dc6666b93c94b7914794b2"},{"public_id":"co_28afd143a33b5baa3d8b4133b92d6e22","status":"active","name":"incremental learning-based detection-model updating procedure","description":"A model updating procedure that incrementally adapts the detection model over time.","types":["procedure"],"aliases":[],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_28afd143a33b5baa3d8b4133b92d6e22"},{"public_id":"co_2fe756def8308299b9c6809a8ef2d150","status":"active","name":"Bagging strategy","description":"An ensemble training strategy used to learn multiple base kernel extreme learning machines independently.","types":["method"],"aliases":[],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_2fe756def8308299b9c6809a8ef2d150"},{"public_id":"co_3096bedb0e6ec9c1a82bcf8b99c27d5d","status":"active","name":"sparse random feature representation","description":"A random feature representation used to reduce noise and redundant or irrelevant information in network connection instances.","types":["representation"],"aliases":["SRFR"],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_3096bedb0e6ec9c1a82bcf8b99c27d5d"},{"public_id":"co_39617fb5c25551744a625f79369d9140","status":"active","name":"KDD99 dataset","description":"A benchmark dataset used to evaluate the proposed intrusion detection method.","types":["dataset"],"aliases":[],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_39617fb5c25551744a625f79369d9140"},{"public_id":"co_8984b94f5becf97db3c31d1bcedd6ae7","status":"active","name":"adaptive network intrusion detection","description":"A network security task focused on identifying unauthorized uses, misuses, and abuses of computer systems in real time while adapting to network changes.","types":["task"],"aliases":["ANID"],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_8984b94f5becf97db3c31d1bcedd6ae7"},{"public_id":"co_948a1289b0baf0e37cc1d101bb356713","status":"active","name":"kernel extreme learning machines","description":"Learning machines used as independently trained base learners in the intrusion detection ensemble.","types":["model"],"aliases":["KELMs"],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_948a1289b0baf0e37cc1d101bb356713"},{"public_id":"co_9bc64679cf7f40acc222ac55063e6c73","status":"active","name":"dynamically changing network environments","description":"Network conditions that vary over time and require the intrusion detector to adapt.","types":["environment"],"aliases":[],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_9bc64679cf7f40acc222ac55063e6c73"},{"public_id":"co_a1e57c43810c94ec6f95676b0faac388","status":"active","name":"kernel extreme learning machines with random features","description":"Kernel extreme learning machine models that use random feature representations as base components in the proposed detector.","types":["model"],"aliases":["KELMs with random features"],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_a1e57c43810c94ec6f95676b0faac388"},{"public_id":"co_c9a36ba6cdd3ff8e976eeca9c058d2b8","status":"active","name":"intrusion detector","description":"The detection model produced to identify unauthorized or abusive computer system activity.","types":["system"],"aliases":[],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_c9a36ba6cdd3ff8e976eeca9c058d2b8"},{"public_id":"co_ef9d1f9e6b2c669df8507db9f19506ee","status":"active","name":"ANID-SEoKELM","description":"An adaptive network intrusion detection method combining selective ensembles of kernel extreme learning machines with random features.","types":["method"],"aliases":["adaptive network intrusion detection based on selective ensemble of kernel ELMs with random features"],"contributors":[{"id":136,"public_id":"3c2apqe3ut","public_label":"Anonymous (3c2apqe3ut)","roles":["extraction"],"url":"https://sah.borca.ai/u/3c2apqe3ut"},{"id":2,"public_id":"4715169a40","public_label":"AK (4715169a40)","roles":["review"],"url":"https://sah.borca.ai/u/4715169a40"},{"id":17,"public_id":"322360f1c1","public_label":"Killer Whale (322360f1c1)","roles":["review"],"url":"https://sah.borca.ai/u/322360f1c1"}],"url":"https://sah.borca.ai/concepts/co_ef9d1f9e6b2c669df8507db9f19506ee"}],"external_ids":{"DOI":"10.1016/J.KNOSYS.2019.04.008","ArXiv":null,"PubMed":null,"PubMedCentral":null,"MAG":2938820927,"DBLP":"journals/kbs/LiuHZMTNG19","ACL":null},"open_access":{"is_open_access":false,"pdf_url":null,"landing_url":"https://sah.borca.ai/papers/145902042","source":null,"pdf_url_source":null,"license":null,"reason":"pdf_url_not_indexed"},"reference_availability":{"status":"available","references_indexed":true,"full_text_available":false,"full_text_source":null,"count_basis":"semantic_scholar_metadata","extraction_status":"not_applicable","reason":null},"source":{"provider":"episteme2","base_corpus":"semantic_scholar_dump","freshness_mode":"unknown","basis":["semantic_scholar_metadata","postgres_metadata"],"limits":["paper metadata is based on indexed upstream scholarly datasets","claims and concepts are available only for extracted papers","absence of claims or concepts means no extracted graph data is available in this response"],"status":"available","degraded":false,"degraded_reasons":[],"diagnostics":{"status":"available","degraded":false,"degraded_reasons":[],"metadata_status":"available","graph_status":"available","abstract_status":"available"},"source_flags":1},"paper_id":631377,"paper_uid":"d719ba04-4839-4dc4-b744-7b3fbc60b33e","canonical_identity":{"paper_id":631377,"paper_uid":"d719ba04-4839-4dc4-b744-7b3fbc60b33e","identity_status":"available","lookup_basis":"semantic_scholar_external_id","compatibility_path":"corpus_id"},"url":"https://sah.borca.ai/papers/145902042"}