Author ORCID Identifier

https://orcid.org/0000-0002-7587-4189 : Mehrdad Saif

https://orcid.org/0000-0002-9956-4003 : Ehsan Hallaji

Document Type

Article

Publication Date

4-2024

Publication Title

Computers & Security

Volume

139

Keywords

Multi-label learning, deep learning, ensemble learning, intrusion detection

Abstract

Intrusion detection systems are primarily designed to flag security breaches upon their occurrence. These systems operate under the assumption of single-label data, where each instance is assigned to a single category. However, when dealing with complex data, such as malware triage, the information provided by the IDS is limited. Consequently, additional analysis becomes necessary, leading to delays and incurring additional computational costs. Existing solutions to this problem typically merge these steps by considering a unified, but large, label set encompassing both intrusion and analytical labels, which adversely affects efficiency and performance. To address these challenges, this paper presents a novel framework for multi-label classification by employing an ensemble of sequential models that preserve the original label sets during training. Each model focuses on learning the distribution specifically related to its assigned set of labels, independent of the other label sets. To capture the relationship between different sets of labels, the parameters of each trained model initialize the subsequent model, ensuring that information from unrelated label sets does not interfere with the learning objective. Consequently, the proposed method enhances prediction performance without increasing computational complexity. To evaluate the effectiveness of our approach, we conduct experiments on a real-world dataset related to intrusion detection. The results clearly demonstrate the effectiveness of our proposed method in handling multi-label classification tasks.

DOI

https://doi.org/10.1016/j.cose.2024.103730

ISSN

0167-4048

Download

Share

COinS