Concept Drift Analysis and Malware Attack Detection System Using Secure Adaptive Windowing

Concept drift is a main security issue that has to be resolved since it presents a significant barrier to the deployment of machine learning(ML)models.Due to attackers’(and/or benign equivalents’)dynamic behavior changes,testing data distribution frequently diverges from original training data over time,resulting in substantial model failures.Due to their dispersed and dynamic nature,distributed denial-of-service attacks pose a danger to cybersecurity,resulting in attacks with serious consequences for users and businesses.This paper proposes a novel design for concept drift analysis and detection of malware attacks like Distributed Denial of Service(DDOS)in the network.The goal of this architecture combination is to accurately represent data and create an effective cyber security prediction agent.The intrusion detection system and concept drift of the network has been analyzed using secure adaptive windowing with website data authentication protocol(SAW_WDA).The network has been analyzed by authentication protocol to avoid malware attacks.The data of network users will be collected and classified using multilayer perceptron gradient decision tree(MLPGDT)classifiers.Based on the classification output,the decision for the detection of attackers and authorized users will be identified.The experimental results show output based on intrusion detection and concept drift analysis systems in terms of throughput,end-end delay,network security,network concept drift,and results based on classification with regard to accuracy,memory,and precision and F-1 score.

Combined Effect of Concept Drift and Class Imbalance on Model Performance During Stream Classification

Every application in a smart city environment like the smart grid,health monitoring, security, and surveillance generates non-stationary datastreams. Due to such nature, the statistical properties of data changes overtime, leading to class imbalance and concept drift issues. Both these issuescause model performance degradation. Most of the current work has beenfocused on developing an ensemble strategy by training a new classifier on thelatest data to resolve the issue. These techniques suffer while training the newclassifier if the data is imbalanced. Also, the class imbalance ratio may changegreatly from one input stream to another, making the problem more complex.The existing solutions proposed for addressing the combined issue of classimbalance and concept drift are lacking in understating of correlation of oneproblem with the other. This work studies the association between conceptdrift and class imbalance ratio and then demonstrates how changes in classimbalance ratio along with concept drift affect the classifier’s performance.We analyzed the effect of both the issues on minority and majority classesindividually. To do this, we conducted experiments on benchmark datasetsusing state-of-the-art classifiers especially designed for data stream classification.Precision, recall, F1 score, and geometric mean were used to measure theperformance. Our findings show that when both class imbalance and conceptdrift problems occur together the performance can decrease up to 15%. Ourresults also show that the increase in the imbalance ratio can cause a 10% to15% decrease in the precision scores of both minority and majority classes.The study findings may help in designing intelligent and adaptive solutionsthat can cope with the challenges of non-stationary data streams like conceptdrift and class imbalance.

An Optimal Big Data Analytics with Concept Drift Detection on High-Dimensional Streaming Data

Big data streams started becoming ubiquitous in recent years,thanks to rapid generation of massive volumes of data by different applications.It is challenging to apply existing data mining tools and techniques directly in these big data streams.At the same time,streaming data from several applications results in two major problems such as class imbalance and concept drift.The current research paper presents a new Multi-Objective Metaheuristic Optimization-based Big Data Analytics with Concept Drift Detection(MOMBD-CDD)method on High-Dimensional Streaming Data.The presented MOMBD-CDD model has different operational stages such as pre-processing,CDD,and classification.MOMBD-CDD model overcomes class imbalance problem by Synthetic Minority Over-sampling Technique(SMOTE).In order to determine the oversampling rates and neighboring point values of SMOTE,Glowworm Swarm Optimization(GSO)algorithm is employed.Besides,Statistical Test of Equal Proportions(STEPD),a CDD technique is also utilized.Finally,Bidirectional Long Short-Term Memory(Bi-LSTM)model is applied for classification.In order to improve classification performance and to compute the optimum parameters for Bi-LSTM model,GSO-based hyperparameter tuning process is carried out.The performance of the presented model was evaluated using high dimensional benchmark streaming datasets namely intrusion detection(NSL KDDCup)dataset and ECUE spam dataset.An extensive experimental validation process confirmed the effective outcome of MOMBD-CDD model.The proposed model attained high accuracy of 97.45%and 94.23%on the applied KDDCup99 Dataset and ECUE Spam datasets respectively.

An ensemble method for data stream classification in the presence of concept drift

One recent area of interest in computer science is data stream management and processing. By ‘data stream', we refer to continuous and rapidly generated packages of data. Specific features of data streams are immense volume, high production rate, limited data processing time, and data concept drift; these features differentiate the data stream from standard types of data. An issue for the data stream is classification of input data. A novel ensemble classifier is proposed in this paper. The classifier uses base classifiers of two weighting functions under different data input conditions. In addition, a new method is used to determine drift, which emphasizes the precision of the algorithm. Another characteristic of the proposed method is removal of different numbers of the base classifiers based on their quality. Implementation of a weighting mechanism to the base classifiers at the decision-making stage is another advantage of the algorithm. This facilitates adaptability when drifts take place, which leads to classifiers with higher efficiency. Furthermore, the proposed method is tested on a set of standard data and the results confirm higher accuracy compared to available ensemble classifiers and single classifiers. In addition, in some cases the proposed classifier is faster and needs less storage space.

Drift DetectionMethod Using DistanceMeasures and Windowing Schemes for Sentiment Classification

Textual data streams have been extensively used in practical applications where consumers of online products have expressed their views regarding online products.Due to changes in data distribution,commonly referred to as concept drift,mining this data stream is a challenging problem for researchers.The majority of the existing drift detection techniques are based on classification errors,which have higher probabilities of false-positive or missed detections.To improve classification accuracy,there is a need to develop more intuitive detection techniques that can identify a great number of drifts in the data streams.This paper presents an adaptive unsupervised learning technique,an ensemble classifier based on drift detection for opinion mining and sentiment classification.To improve classification performance,this approach uses four different dissimilarity measures to determine the degree of concept drifts in the data stream.Whenever a drift is detected,the proposed method builds and adds a new classifier to the ensemble.To add a new classifier,the total number of classifiers in the ensemble is first checked if the limit is exceeded before the classifier with the least weight is removed from the ensemble.To this end,a weighting mechanism is used to calculate the weight of each classifier,which decides the contribution of each classifier in the final classification results.Several experiments were conducted on real-world datasets and the resultswere evaluated on the false positive rate,miss detection rate,and accuracy measures.The proposed method is also compared with the state-of-the-art methods,which include DDM,EDDM,and PageHinkley with support vector machine(SVM)and Naive Bayes classifiers that are frequently used in concept drift detection studies.In all cases,the results show the efficiency of our proposed method.

非平衡概念漂移数据流主动学习方法

数据流分类研究在开放、动态环境中如何提供更可靠的数据驱动预测模型,关键在于从实时到达且不断变化的数据流中检测并适应概念漂移.目前,为检测概念漂移和更新分类模型,数据流分类方法通常假设所有样本的标签都是已知的,这一假设在真实场景下是不现实的.此外,真实数据流可能表现出较高且不断变化的类不平衡比率,会进一步增加数据流分类任务的复杂性.为此,提出一种非平衡概念漂移数据流主动学习方法 (Active learning method for imbalanced concept drift data stream, ALM-ICDDS).定义基于多预测概率的样本预测确定性度量,提出边缘阈值矩阵的自适应调整方法,使得标签查询策略适用于类别数较多的非平衡数据流;提出基于记忆强度的样本替换策略,将难区分、少数类样本和代表当前数据分布的样本保存在记忆窗口中,提升新基分类器的分类性能;定义基于分类精度的基分类器重要性评价及更新方法,实现漂移后的集成分类器更新.在7个合成数据流和3个真实数据流上的对比实验表明,提出的非平衡概念漂移数据流主动学习方法的分类性能优于6种概念漂移数据流学习方法.

基于自适应深度集成网络的概念漂移收敛方法

概念漂移是流数据挖掘领域中的一个重要且具有挑战性的难题.然而,目前的方法大多仅能够处理线性或简单的非线性映射,深度神经网络虽然有较强的非线性拟合能力,但在流数据挖掘任务中,每次只能在新得到的1个或一批样本上进行训练,学习模型难以实时调整以适应动态变化的数据流.为解决上述问题,将梯度提升算法的纠错思想引入含概念漂移的流数据挖掘任务之中,提出了一种基于自适应深度集成网络的概念漂移收敛方法(concept drift convergence method based on adaptive deep ensemble networks,CD_ADEN).该模型集成多个浅层神经网络作为基学习器,后序基学习器在前序基学习器输出的基础上不断纠错,具有较高的实时泛化性能.此外,由于浅层神经网络有较快的收敛速度,因此所提出的模型能够较快地从概念漂移造成的精度下降中恢复.多个数据集上的实验结果表明,所提出的CD_ADEN方法平均实时精度有明显提高,相较于对比方法,平均实时精度有1%~5%的提升,且平均序值在7种典型的对比算法中排名第一.说明所提出的方法能够对前序输出进行纠错,且学习模型能够快速地从概念漂移造成的精度下降中恢复,提升了在线学习模型的实时泛化性能.

基于混合特征提取的流数据概念漂移处理方法

大数据时代,越来越多的数据以数据流的形式产生,由于其具有快速、无限、不稳定及动态变化等特性,使得概念漂移成为流数据挖掘中一个重要但困难的问题.目前多数概念漂移处理方法存在信息提取能力有限且未充分考虑流数据的时序特性等问题.针对这些问题,提出一种基于混合特征提取的流数据概念漂移处理方法(concept drift processing method of streaming data based on mixed feature extraction,MFECD).该方法首先采用不同尺度的卷积核对数据进行建模以构建拼接特征,采用门控机制将浅层输入和拼接特征融合,作为不同网络层次输入进行自适应集成,以获得能够兼顾细节信息和语义信息的数据特性.在此基础上,采用注意力机制和相似度计算评估流数据不同时刻的重要性,以增强数据流关键位点的时序特性.实验结果表明,该方法能有效提取流数据中包含的复杂数据特征和时序特征,提高了数据流中概念漂移的处理能力.

网络异常检测领域概念漂移问题研究综述

【目的】随着网络技术的快速发展和广泛应用,网络异常检测作为保护网络安全和维护系统正常运行的手段变得越来越重要。然而,网络中异常行为和攻击手段不断变化,给异常检测带来了新的挑战。其中,概念漂移问题是网络异常检测领域中受到广泛关注的难点之一。【方法】本综述旨在对网络异常检测领域中概念漂移问题进行研究分析和总结。与前人的研究相比,本文将专注于网络异常检测领域的流数据。【文献范围】首先,对概念漂移进行详细介绍,包括定义、产生原因和特点。通过对概念漂移的全面理解,可以为后续的检测方法提供指导。其次,系统性地介绍了概念漂移检测方法,主要包括基于统计的方法、机器学习方法和深度学习方法等,并对比了各类方法的优缺点和适用场景。最后,探讨了概念漂移在未来可能的研究方向。【结论】本文聚焦于网络异常检测领域的概念漂移问题,通过详细介绍概念漂移的定义、产生原因和特点,以及深入分析和总结针对流数据概念漂移的检测方法,为未来研究方向提供了有价值的参考和指导。

结合软约束的演化数据流模糊聚类算法

多源局部放电检测中,不同类型的局放信号同时存在且不断变化使得信号的分离更具挑战,而这种情况同样存在于许多数据流的聚类分析场景中。为了能够适应类簇内的不均匀密度和类簇间的重叠边界问题,同时对数据流的漂移和演化进行及时跟踪,提出了一种结合软约束的实时数据流模糊聚类算法。算法引入2种模糊性软约束来描述微簇距离和密度上的不确定度,通过阈值划分出核心微簇、边界微簇和离群微簇;在类簇边缘使用模糊隶属度,给予微簇分属不同类簇的可能性,保证类簇的完整性并提高聚类效果;使用两阶段的流程结构和2种时间窗口模型,赋予算法具有对可变化数据流的适应能力和更低的时间空间占用率。在多种数据集上的实验表明,该算法相比同类型算法在聚类效果上提升了1%~3%,且平均运行时间缩短5%~20%,在实际硬件平台的测试中也验证了算法的聚类分离性能。

基于增量加权的不平衡漂移数据流分类算法

概念漂移是数据流学习领域中的一个难点问题,同时数据流中存在的类不平衡问题也会严重影响算法的分类性能。针对概念漂移和类不平衡的联合问题,在基于数据块集成的方法上引入在线更新机制,结合重采样和遗忘机制提出了一种增量加权集成的不平衡数据流分类方法(incremental weighted ensemble for imbalance learning,IWEIL)。该方法以集成框架为基础,利用基于可变大小窗口的遗忘机制确定基分类器对窗口内最近若干实例的分类性能,并计算基分类器的权重,随着新实例的逐个到达,在线更新IWEIL中每个基分器及其权重。同时,使用改进的自适应最近邻SMOTE方法生成符合新概念的新少数类实例以解决数据流中类不平衡问题。在人工数据集和真实数据集上进行实验,结果表明,相比于DWMIL算法,IWEIL在HyperPlane数据集上的G-mean和recall指标分别提升了5.77%和6.28%,在Electricity数据集上两个指标分别提升了3.25%和6.47%。最后,IWEIL在安卓应用检测问题上表现良好。

复杂数据流在线集成分类算法综述

复杂数据流中所存在的概念漂移及不平衡问题降低了分类器的性能。传统的批量学习算法需要考虑内存以及运行时间等因素,在快速到达的海量数据流中性能并不突出,并且其中还包含着大量的漂移及类失衡现象,利用在线集成算法处理复杂数据流问题已经成为数据挖掘领域重要的研究课题。从集成策略的角度对bagging、boosting、stacking集成方法的在线版本进行了介绍与总结,并对比了不同模型之间的性能。首次对复杂数据流的在线集成分类算法进行了详细的总结与分析,从主动检测和被动自适应两个方面对概念漂移数据流检测与分类算法进行了介绍,从数据预处理和代价敏感两个方面介绍不平衡数据流,并分析了代表性算法的时空效率,之后对使用相同数据集的算法性能进行了对比。最后,针对复杂数据流在线集成分类研究领域的挑战提出了下一步研究方向。

基于聚簇模型重用的概念漂移数据流半监督分类算法

带概念漂移的半监督数据流分类任务中,仅有少部分的数据被标记,这给分类器的训练、概念漂移的检测以及分类器对新概念的适应带来了巨大的挑战。现有的半监督聚簇分类算法仅对分类器池中的聚簇模型进行简单的增量更新,未能有效重用历史聚簇模型。因此,文中提出了一种新的聚簇模型重用的半监督分类算法,称为CDCMR。首先,数据流以数据块的形式到来,对数据块分完类后,训练一个簇数自适应确定的聚簇模型。其次,通过计算分类器池中的各组件分类器与聚簇模型之间的相似度,挑选多个组件分类器。再次,用当前数据块对挑选出来的组件分类器进行模型重用后,与聚簇模型集成。然后,将分类器池划分为新旧更替和多样性最大化分类器池进行更新。最后,对下一个数据块的样本进行集成分类。在多个人工和真实数据集上进行实验,结果表明,所提算法1)能有效适应概念漂移,与现有方法相比其性能有显著性提升。

一种基于局部分类精度的概念漂移数据流分类算法

概念漂移数据流分类是一个极具挑战性的问题。当新概念出现时,该概念下的学习样本过少,无法对分类器进行及时调整,进而导致分类精度不高。为了解决该问题,本文提出一种基于局部分类精度的概念漂移数据流分类算法——LA-MS-CDC。第一,LA-MS-CDC将k-means聚类和局部分类精度算法结合,从分类器池中挑选出最优源领域分类器;第二,将最优源领域分类器与目标领域分类器加权集成,进而对样本分类;第三,根据分类样本的真实标签分别计算各分类器的损失,并对目标领域和源领域的分类器权重进行更新;第四,再利用该分类样本对目标领域分类器、最优源领域分类器进行更新;最后,完成分类器池的更新。在公开数据集上的实验结果表明,LA-MS-CDC能够有效地将源领域知识迁移到目标领域,与现有方法相比,其分类效果具有显著性提升。算法代码可在https://gitee.com/ymw12345/LAMSCDC上获取。

基于自适应集成学习的异常流量检测

提出了一种基于自适应集成学习的异常流量检测方法,使用离散傅里叶变换提取流量的频域特征,使得对流量特征提取过程中信息损失较小.用一种基于稳定性和准确性波动的评估指标来动态评估当前流量特征的可靠性,通过评估的特征数据块用于生成新的子分类器.同时,设计了一种集成自适应分类器,其参数和子分类器会根据当前的情况进行实时调整.实验结果表明,该方法对于解决异常流量检测中的概念漂移问题和机器学习对抗攻击问题有良好的效果.

Learning Association Rules and Tracking the Changing Concepts on Webpages:An Effective Pornographic Websites Filtering Approach

We applied the decision tree algorithm to learn association rules between webpage’s category(pornographic or normal) and the critical features.Based on these rules, we proposed an efficient method of filtering pornographic webpages with the following major advantages: 1) a weighted window-based technique was proposed to estimate for the condition of concept drift for the keywords found recently in pornographic webpages; 2) checking only contexts of webpages without scanning pictures; 3) an incremental learning mechanism was designed to incrementally update the pornographic keyword database.

基于多元区域集划分的工业数据流概念漂移检测

为了快速适应非平稳环境中工业数据流的分布变化,需要在非结构化和噪声干扰的数据中准确、实时的完成概念漂移的检测.本文提出了一种基于多元区域集划分的工业数据流概念漂移检测算法(Concept Drift detection-Multivariate region set Partition,CDMP).首先基于实例模糊密度进行多元区域集划分,根据划分的若干模糊分区集合,识别概念漂移发生的区域.概念漂移的持续发生会显著降低基于多元区域集构建的模型的分类性能,CDMP通过构建多元历史模型池来保留具有多样性的历史模型,以降低模型调整或再训练造成的性能损耗,同时保证概念漂移检测中准确性.CDMP在不同数据集上进行了性能测试.实验结果表明,CDMP实现了对历史模型多样性的保留和重用,能够在不同噪声水平的工业物联网环境中实现对重现型、突发型等多类型概念漂移的准确检测.

基于在线集成的概念漂移自适应分类方法

针对流数据中概念漂移发生后,在线学习模型不能对分布变化后的数据做出及时响应且难以提取数据分布的最新信息,导致学习模型收敛较慢的问题,提出一种基于在线集成的概念漂移自适应分类方法(adaptive classification method for concept drift based on online ensemble,AC_OE).一方面,该方法利用在线集成策略构建在线集成学习器,对数据块中的训练样本进行局部预测以动态调整学习器权重,有助于深入提取漂移位点附近流数据的演化信息,对数据分布变化进行精准响应,提升在线学习模型对概念漂移发生后新数据分布的适应能力,提高学习模型的实时泛化性能;另一方面,利用增量学习策略构建增量学习器,并随新样本的进入进行增量式的训练更新,提取流数据的全局分布信息,使模型在平稳的流数据状态下保持较好的鲁棒性.实验结果表明,该方法能够对概念漂移做出及时响应并加速在线学习模型的收敛速度,同时有效提高学习器的整体泛化性能.

基于机器学习的信用卡交易欺诈检测研究综述

机器学习在信用卡交易检测中有其特殊性,面对的环境更为复杂。由于有人的智力介入,战胜信用卡交易欺诈,其挑战性比人脸识别、无人驾驶等工程问题的难度更高,照搬工程学科的机器学习方法往往会失败。综述了2000年以来基于机器学习的信用卡欺诈检测研究历程,辨析了该领域的研究范畴、应用场景、技术流派等相关概念及其联系;解构了机器学习欺诈识别的一般性研究架构,从特征工程、模型算法、评价指标三个环节归纳总结了领域内研究的最新进展;从数据集是否具备标签角度,着重列举了面向欺诈识别的有监督的、无监督和半监督三类主流机器学习模型,讨论了这些模型的出发点、核心思想、求解方法以及优缺点;还分析了强化学习模型模拟欺诈者与机构之间的动态博弈过程;探讨了机器学习面临的海量数据、样本偏斜和概念漂移三大难点问题,并汇集整理了缓解这些问题的最新进展;总结了面向欺诈检测的机器学习研究目前存在的局限、争议和挑战,并为未来的研究方向提供趋势分析与建议。

情境流驱动的大规模在线学习动态分组方法

在大规模在线学习社区中,学习者的行为特征可能会随时间发生变化,如何根据个体和群体的动态演化特征实现学习小组的自适应动态划分,是有效开展协作学习的关键。为此,文章提出一种情境流驱动的大规模在线学习动态分组方法:首先,构建基于活动理论的学习者情境模型,将反映情境指标的多模态数据转化为情境流;然后,扩展模糊C均值聚类算法,使用增量式流处理和动态滑动窗口技术检测概念漂移,实现基于某一情境维度的学习群体自适应动态聚类;最后,对不同情境维度的同质聚类结果进行差异化组合,得到异质学习小组。实验证明,动态分组在合作倾向、互惠性、群体互动一致性等方面比静态分组更具优势。文章的研究可为在线学习平台智能分组提供方法指引,并为实现有效的在线协作学习提供支撑。