LAPAID: A Lightweight, Adaptive and Perspicacious Active Intrusion Detection Method on Network Traffic Streams

Active intrusion detection on network traffic streams becomes a crucial research problem, since it tries to maximize the effectiveness with limited labeled instances. The closely distributed anomalies of different categories and dynamic network traffic stream make it still quite a challenging issue. Therefore, we propose a Lightweight, Adaptive and Perspicacious Active Intrusion Detection method on network traffic streams, called LAPAID. We design novel lightweight anomaly detection clusters with density-aware hash cells, which successfully capture evolving data distribution. The anomaly detection clusters are incrementally updated in an approximate manner, and aggregated with a straightforward but effective metric divergences. At last, LAPAID detects anomalies and queries the instances for manual labels by measuring the density in hash cells of each cluster, effectively distinguishing closely distributed anomaly classes. Comprehensive experiments on several real-world data sets show that LAPAID outperforms previous methods, improving F1 scores by 16.17% on average.