Abstract
Training and deploying genetic programming (GP) classifiers for intrusion detection tasks on the one hand remains a challenge (high cardinality and high class imbalance). On the other hand, GP solutions can also be particularly ‘lightweight’ from a deployment perspective, enabling detectors to be deployed ‘at the edge’ without specialized hardware support. We compare state-of-the-art ensemble learning solutions from GP and XGBoost on three examples of intrusion detection tasks with 250,000 to 700,000 training records, 8 to 115 features and 2 to 23 classes. XGBoost provides the most accurate solutions, but at two orders of magnitude higher complexity. Training time for the preferred GP ensemble is in the order of minutes, but the combination of simplicity and specificity is such that the resulting solutions are more informative and discriminatory. Thus, as the number of features increases and/or classes increase, the resulting ensembles are composed from particularly simple trees that associate specific features with specific behaviours.
Research enabled by NSERC Discovery Grant RGPIN-2020-04438.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Notes
- 1.
This is distinct but complementary to assuming that intrusion detection can be performed at some centralized cloud based resource using more computationally expensive paradigms, such as deep learning.
- 2.
Up to \(\beta \) instances from other classes accepted before pure considered ambiguous.
- 3.
Motivated by information theoretic formulations employed in decision tree methods, e.g. Chapter 8 in [6].
- 4.
Otherwise a trivial redundancy appears.
- 5.
A single learner would only be able to suggest a single class.
- 6.
All data labeled as the same class.
- 7.
Put another way, without a specific training record, the significance of a Team would be lost.
- 8.
- 9.
- 10.
- 11.
BStacGP average rank of 1.33 for total number of nodes, versus an average rank of 2.67 and 3.67 for decision tree and XGBoost.
References
Badran, K.M.S., Rockett, P.I.: Multi-class pattern classification using single, multi-dimensional feature-space feature extraction evolved by multi-objective genetic programming and its application to network intrusion detection. Genet. Program Evolvable Mach. 13(1), 33–63 (2012)
Chen, T., Guestrin, C.: XGBoost: a scalable tree boosting system. In: Proceedings of the ACM SIGKDD International Conference on Knowledge Discovery and Data Mining, pp. 785–794. ACM (2016)
Curry, R., Lichodzijewski, P., Heywood, M.I.: Scaling genetic programming to large datasets using hierarchical dynamic subset selection. IEEE Trans. Syst., Man, Cybernet.s - Part B 37(4), 1065–1073 (2007)
Dietterich, T.G.: An experimental comparison of three methods for constructing ensembles of decision trees: bagging, boosting, and randomization. Mach. Learn. 40(2), 139–157 (2000)
Doucette, J.A., McIntyre, A.R., Lichodzijewski, P., Heywood, M.I.: Symbiotic coevolutionary genetic programming: a benchmarking study under large attribute spaces. Genet. Program Evolvable Mach. 13(1), 71–101 (2012)
Duda, R.O., Hart, P.E., Stork, D.G.: Pattern Classification. Wiley and Sons, 2nd edn. (2001)
Ficici, S.G., Pollack, J.B.: Pareto optimality in coevolutionary learning. In: Kelemen, J., Sosík, P. (eds.) Advances in Artificial Life, pp. 316–325. Springer Berlin Heidelberg, Berlin, Heidelberg (2001). https://doi.org/10.1007/3-540-44811-X_34
García, S., Grill, M., Stiborek, J., Zunino, A.: An empirical comparison of botnet detection methods. Comput. Secur. 45, 100–123 (2014)
Grandini, M., Bagli, E., Visani, G.: Metrics for multi-class classification: an overview. CoRR abs/2008.05756 (2020). https://arxiv.org/abs/2008.05756
Heywood, M.I.: Evolutionary ensemble learning. In: Banzhaf, W., Machado, P., Zhang, M. (eds.) Handbook of Evolutionary Machine Learning, pp. 205–243. Springer Nature Singapore, Singapore (2024). https://doi.org/10.1007/978-981-99-3814-8_8
Heywood, M.I., Lichodzijewski, P.: Symbiogenesis as a mechanism for building complex adaptive systems: a review. In: Di Chio, C., et al. (eds.) Applications of Evolutionary Computation, pp. 51–60. Springer Berlin Heidelberg, Berlin, Heidelberg (2010). https://doi.org/10.1007/978-3-642-12239-2_6
Kelly, S., Lichodzijewski, P., Heywood, M.I.: On run time libraries and hierarchical symbiosis. In: Proceedings of the IEEE Congress on Evolutionary Computation, pp. 1–8. IEEE (2012)
Khanchi, S., Vahdat, A., Heywood, M.I., Zincir-Heywood, A.N.: On botnet detection with genetic programming under streaming data label budgets and class imbalance. Swarm Evol. Comput. 39, 123–140 (2018)
Lichodzijewski, P., Heywood, M.I.: Managing team-based problem solving with symbiotic bid-based genetic programming. In: Proceedings of the Genetic and Evolutionary Computation Conference, pp. 363–370. ACM (2008)
Ma, S., Ji, C.: Performance and efficiency: recent advances in supervised learning. Proc. IEEE 87(9), 1519–1535 (1999)
McIntyre, A.R., Heywood, M.I.: Classification as clustering: a pareto cooperative-competitive GP approach. Evol. Comput. 19(1), 137–166 (2011)
Mirsky, Y., Doitshman, T., Elovici, Y., Shabtai, A.: Kitsune: an ensemble of autoencoders for online network intrusion detection. In: Annual Network and Distributed System Security Symposium. The Internet Society (2018)
Quinlan, J.R.: C4.5: Programs for Machine Learning. Morgan Kaufmann (1993)
Smith, R.J., Heywood, M.I.: Coevolving deep hierarchies of programs to solve complex tasks. In: Proceedings of the Genetic and Evolutionary Computation Conference, pp. 1009–1016. ACM (2017)
Song, D., Heywood, M.I., Zincir-Heywood, A.N.: Training genetic programming on half a million patterns: an example from anomaly detection. IEEE Trans. Evol. Comput. 9(3), 225–239 (2005)
Zhou, Z., et al.: A boosting approach to constructing an ensemble stack. In: Pappa, G., Giacobini, M., Vasicek, Z. (eds.) Genetic Programming: 26th European Conference, EuroGP 2023, Held as Part of EvoStar 2023, Brno, Czech Republic, April 12–14, 2023, Proceedings, pp. 133–148. Springer Nature Switzerland, Cham (2023). https://doi.org/10.1007/978-3-031-29573-7_9
Acknowledgements
Circos plot constructed using http://circos.ca.
Author information
Authors and Affiliations
Corresponding author
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2024 The Author(s), under exclusive license to Springer Nature Switzerland AG
About this paper
Cite this paper
Zhou, Z., Zincir-Heywood, N., Heywood, M.I. (2024). Simple Efficient Evolutionary Ensemble Learning on Network Intrusion Detection Benchmarks. In: Smith, S., Correia, J., Cintrano, C. (eds) Applications of Evolutionary Computation. EvoApplications 2024. Lecture Notes in Computer Science, vol 14634. Springer, Cham. https://doi.org/10.1007/978-3-031-56852-7_23
Download citation
DOI: https://doi.org/10.1007/978-3-031-56852-7_23
Published:
Publisher Name: Springer, Cham
Print ISBN: 978-3-031-56851-0
Online ISBN: 978-3-031-56852-7
eBook Packages: Computer ScienceComputer Science (R0)