An optimized incremental learning strategy for efficient intrusion detection

Intrusion Detection Systems (IDS) consistently monitor system logs and network traffic to detect any suspicious or malicious activity. Nowadays IDS are developed using machine learning models are found robust and reliable. However, most of the models are trained with a predefined data and become slow because they need to be completely retrained for new types of attacks, making it hard for modern IDS to keep up with changing cyber threats. We propose a class-based incremental learning approach using an optimized tree-based deep feedforward neural network (OT-DFNN) that uses a performance-fit mechanism for detecting intrusions. The model’s progressive dataset integration allows for continuous adaptation to emerging threats while preserving previously acquired knowledge, thus avoiding the need for complete retraining. Evaluated using multiple datasets, the OT-DFNN model has demonstrated effectiveness in detection accuracy, reduced training time, and lower model complexity, highlighting its capability in identifying intrusions.