Continuous Learning In Self-Adaptive IDS Using Boxelder Bug Search Optimization

Abstract

The problem of network intrusion detection continues to be a major challenge in modern cyber security due to the ever-changing threat landscape, large-dimensional feature spaces, and the nature of the data that is being analyzed. Classical Intrusion Detection Systems (IDS) are plagued by suboptimal generalization, static configurations of parameters and they cannot catch new attack patterns without full retraining cycles. This paper presents a Self-Adaptive Intrusion Detection System (SA-IDS) which combines a novel nature-inspired metaheuristic named Adaptive Boxelder Bug Search (ABBS) algorithm with continuous learning approach that learns, selects features and optimizes the hyperparameter and adapts to model drift simultaneously. The ABBS algorithm is motivated by the aggregation, swarming and thermal-seeking migration of the boxelder bugs Boisea trivittata, where population-level exploration is realized as individual exploitation by the adaptive inertia weight, and cross-population information sharing. The proposed architecture consists of an online drift-detection module, an incremental model updater, and a multi-objective fitness function which considers the accuracy of the detection and the false alarm rates. The evaluations conducted by the extensive amount of test data have shown that SA-IDS outperforms the rest of the competitors with classification accuracy of 99.34%, 98.87%, and 98.61% and false alarm rates of 0.41%, 0.53%, and 0.68% respectively, on the NSL-KDD, CICIDS2017 and UNSW-NB15 benchmarks. Comparisons with the Particle Swarm Optimization (PSO), Grey Wolf Optimizer (GWO), Harris Hawks Optimization (HHO) and Whale Optimization Algorithm (WOA) are statistically significant to show the superior performance of the proposed algorithm in all the performance metrics. The proposed system is a bio-inspired global search coupled with incremental learning that extends the state-of-the-art of adaptive intrusion detection and offers a practically deployable architecture for real-time network security monitoring.