Online Boosting Based Intrusion Detection in Changing Environments

use of the information supplied by part of the training data
set. Thus, the key issue of online learning research is how to
control the above difference while training a classifier online.
Table 1. Adaboost Algorithm
Input: {( x 1 , y1),...,
( xn
, yn
)}, M , Lb
( 1)
Initilization: 1 N n 1,
2,...,
N
w n
For m 1,
2,...,
M
m)
(
h L ({( x , y ),..., ( x , y )}, w
( m)
b 1 1 n n
( m)
(m)
h
( m)
( m)
w
n:
h ( xn
) y n
n
( m)
1
, then
Calculate the weighted error of
If 2
Set M m1
and stop loop
endif
Update the weights
( m)
( m1)
( m)
2(
1
)
w
if
n wn
{
1
( m)
2
if
Output the final strong classifier:
(
M ( m) 1
H ( x)
sign(
h ( x)
lg
m1
( m)
In order to adapt Adaboost to the data streams
environment, Oza proposed an online version of Adaboost in
[16], and the convergence proof for the online version was
also given. Recently, Grabner and Bischof [17] successfully
introduced the online boosting algorithm into computer
vision field.
The detailed online boosting algorithm is presented in
Table 2. Here h is the set of weak classifiers to be updated
online, L is the online base model learning algorithm. Note
o
that in the batch Adaboost algorithm, the sum of sample
weights remains 1:
N
n1
w
( m)
n
)
where the definition of w is already given in Section 2.2.
(m
n
1
However, in online boosting, the weight evolves
)
individually for each training sample. The weight w is
actually a sampling weight while generating the m-th weak
classifier. The same function is taken through the parameter
k in online boosting, which is randomly generated from
Poission distribution with parameter . As to the weighted
(m)
classification error of h , an approximation is used:
sw
( m)
m
( 4)
sc sw
m
m
which involves only samples already seen. Moreover, the
number of weak classifiers is not fixed in Adaboost; while in
online boosting, the number of weak classifiers is fixed
beforehand, and the weak classifiers are all learned online.
Although it may differ greatly from that learned in batch
mode when only a few training samples have been processed,
the online ensemble classifier converges statistically to the
m)
)
)
1,
m 1,...,
M
( m)
h ( xn
)
(
m)
h ( xn
)
y
y
n
n
(m
n
( 3)
ensemble generated in batch mode, as the number of training
samples increases [16].
Table 2. Online Boosting Algorithm
Input: {( x 1 , y1),...,
( xn
, yn
)}, M , Lo
sc sw
Initilization: 0 0 m 1,
2,...,
M
m
m
For each new training sample ( x , y)
Initialize weight of the current sample 1
For m 1,
2,...,
M
Set k according to Poission ()
Do k times
h L (( x,
y),
h
( m)
( m)
o
h x
m ( )
( ) ,then
If y
sc sc
m
m
( m)
sc m
1
2(
1
else
sw sw
m
( m)
m
2
sc
m
1
( m)
sw
m
sw m
(m)
)
sw
m
sw m
endif
Output the final strong classifier
(
M ( m) 1
H ( x)
sign(
h ( x)
lg
m1
( m)
2.4 Online boosting based intrusion detection
An intrusion detection algorithm is expected to fill
mainly three requirements in order to be suitable for
practical uses:
)
m)
the detection should be perform in real-time;
the detection accuracy should be as high as possible,
which means a high detection rate to guarantee the
system security, and a low false alarm rate to decrease
unnecessary human burden;
the detector should adapt quickly to the changing
network environments, which implies the ability to
accurately detect any new type of attack soon after its
emergence.
In order to make the updating of intrusion detector
efficient, the training of the detector should not be timeconsuming,
which prevents the use of some complex
classifiers; on the other hand, the strict requirement of
detection performance makes the direct use of simple
classifiers impractical. Consider the variety of attribute of
network connection data, the situation is even worse. We
will try to solve these difficulties in the proposed online
boosting based detection method.
)