A Two-Stage Class Incremental Learning Approach for Network Intrusion Detection

Network intrusion detection methods aim to distinguish network traffic from benign and malicious classes. With the continuous escalation in both the volume and diversity of malicious traffic, class incremental learning has been introduced to facilitate the recognition of new malicious traffic. However, the network traffic tends to be class-imbalanced in the big data environment. The detection performance of the existing approaches suffers as the data utilized for each update follows varying degrees of long-tailed class distribution. This work proposes a more realistic scenario for network intrusion in the big data environment. Based on network traffic following the long-tailed class distribution in each update, the intrusion detection models need to learn new classes without forgetting old ones. At the same time, the predictions of minority and majority classes should be unbiased. To address this scenario, we introduce a two-stage class incremental learning framework. The first stage focuses on learning without forgetting, while the second concentrates on predicting without biasing. This approach ensures the preservation of knowledge while alleviating biased predictions. Experiments on CIC-IDS2017 demonstrate that our proposed approach outperforms with significant improvement.