Incremental semi-supervised kernel construction with self-organizing incremental neural network and application in intrusion detection

Abstract

The semi-supervised learning (SSL) problems are often solved by graph based algorithms, semi-definite programmings etc. These methods always require high space complexities, and thus are not efficient for network intrusion detection systems. Apart from the space complexity challenge, a network intr usion detection system should be able to handle the distribution drifting of data flow as well. A common solution for this concept drift problem is by SSL. In this paper, an incremental SSL training framework is proposed to combine the low space complexity advantage of topology learning and SSL for network intrusion detection. First, the unsupervised self-organizing incremental neural network is extended to process labeled and unlabeled information incrementally. Second, a kernel function is constructed from the training results of the previous step. Finally, a kernel machine is trained with the constructed kernel function. The proposed method reduces the space complexity of SSL to the magnitude similar to supervised learning. The experiments are carried out on the NSL-KDD datasets, and the results show that the proposed method outperforms the mainstream methods such as Transductive Support Vector Machine and Label Propagation.