Dynamic and incremental machine learning approaches for cyber security systems

This thesis explores strategies to effectively manage the intertwined challenges of catastrophic forgetting and class imbalance in Class-Incremental Learning (CIL) scenarios. The primary goal is to create adaptable and sustainable learning systems capable of efficiently retaining previously acquired knowledge while seamlessly acquiring new classes from dynamic, real-time data streams commonly encountered in practical applications. To address these challenges, the study proposes and rigorously evaluates two innovative approaches: 1. Elastic Weight Consolidation (EWC) Enhanced Deep Learning Architecture: This approach employs a sophisticated deep learning model with a shared encoder structure. EWC helps to mitigate catastrophic forgetting by selectively preserving important weights representing previously learned tasks. This enables the model to maintain continuity in knowledge while allowing for the integration of new classes without significant loss of prior knowledge. 2. Hoeffding Tree-based Online Learning Model with Dynamic Output Expansion (CIL-DOE): This approach utilizes a Hoeffding Tree framework tailored for online learning, with a mechanism for dynamic output expansion specifically designed for real-time stream processing. This model adapts to the continuous influx of new classes, efficiently updating its classification capabilities in response to evolving data distributions while effectively managing class imbalance as new classes are introduced. These two approaches, when integrated, establish a comprehensive framework that significantly enhances the effectiveness of machine learning systems in class incremental learning (CIL) scenarios. This framework ultimately contributes to creating more sophisticated and responsive artificial intelligence systems. The first approach emphasizes the development of deep learning models and specifically targets the prevalent issues associated with CIL, particularly those arising from severe class imbalance. The framework utilizes a shared encoder neural network architecture to address these challenges. Within this architecture, EWC is deployed to protect previously learned parameters. EWC achieves this by implementing a mechanism that penalizes significant updates to critical weights for tasks learned earlier. This strategy enables the model to adapt to new distributions of classes while effectively minimizing the degradation of information retained from prior learning phases. The CICIoT2023 cybersecurity dataset was selected to simulate various challenging learning scenarios in the experimental evaluation. The ten most frequently occurring or least frequently encountered classes were systematically excluded from the training sequences in this setup. This deliberate exclusion allowed a thorough assessment of the model's performance across differing class distributions. Extensive evaluations were conducted using macro-averaged metrics, which provide an overall performance measure, and class-specific metrics, which delve into the performance of individual classes. The results from these experiments were telling. Without the application of EWC, the model exhibited significant declines in macro-level performance, particularly with regard to rare classes. In some instances, F1-scores for these classes plummeted to as low as 0%, indicating a failure to classify any samples from those classes accurately. Conversely, when EWC was implemented, the model demonstrated remarkable resilience, achieving macro F1-scores of up to 82%. This improvement underscores the model's enhanced capability to manage minority classes effectively while maintaining overall performance stability across the various learning phases. Such findings highlight the critical importance of incorporating advanced techniques like EWC in CIL frameworks to bolster the robustness and reliability of machine learning systems. Class-wise analysis reveals that EWC significantly enhances classification accuracy, particularly for low-frequency classes such as Backdoor Malware and SQL Injection. These classes often suffer from inadequate representation in training datasets, making accurate classification challenging. EWC addresses this issue by effectively preserving critical model parameters related to these rarer classes, thereby reducing the risk of catastrophic forgetting, where the model forgets previously learned information when exposed to new data. This preservation of knowledge is essential for ensuring resilient and reliable performance in sequential learning tasks, where data is incrementally introduced over time. The second approach incorporates a lightweight, real-time learning mechanism based on the Hoeffding Tree algorithm, augmented by a dynamic output expansion framework. This innovative design is specifically tailored for streaming data environments, where the influx of new classes can occur dynamically. Unlike traditional models that require extensive retraining or fixed output structures, this framework allows the system to adapt seamlessly as new classes emerge, thus facilitating continuous learning in real time. A custom preprocessing pipeline has been developed to support this adaptive learning process. This pipeline ensures compatibility with the stream-learning paradigm by efficiently filtering out incomplete or irrelevant data, converting features to floating-point numbers without normalization, and dynamically assigning unique class identifiers as new classes are first encountered. This methodology streamlines the data processing and enables the model's output layer to expand fluidly in response to new information, allowing for the effective and flexible integration of newly identified classes. Evaluations conducted across three distinct phases of incremental learning reveal remarkable insights into the model's performance. The micro-averaged metrics (acc, F1 score, and recall) demonstrate a rapid convergence, surpassing 80% in the initial stages and stabilizing at impressive levels above 95% in subsequent phases. This notable performance underscores the model's capability to assimilate new class information effectively while maintaining its previously acquired knowledge. In contrast, the macro averages—specifically the F1 score, precision, and recall—exhibit temporary downturns when new classes are integrated into the model. However, these metrics consistently show a trend of gradual improvement over time, reflecting the model's enhanced generalization abilities as it adapts to a more complex data landscape. Interestingly, macro precision reliably exceeds macro recall, suggesting a conservative classification strategy. This strategic approach prioritizes more prevalent classes, reducing the likelihood of false positives for rarer categories. This behavior illustrates the inherent challenges associated with learning from class-imbalanced data streams and underscores the pressing need for further refinement and optimization of the classification methodology. To evaluate the statistical reliability of the model, we employ Cohen's Kappa and the Matthews Correlation Coefficient, both of which emerge with scores exceeding 0.95 during the final training phases. These robust metrics indicate the model's predictions are accurate and exhibit high statistical consistency across dynamically evolving data distributions. Furthermore, a complementary experiment conducted with the complete dataset, preserved in its natural chronological order, further validates the method's adaptability and efficiency in real-world streaming conditions, showcasing its capability to navigate the complexities of temporal data effectively. This study presents two complementary strategies to tackle the unique challenges encountered in deep and online learning within class-incremental learning frameworks. The first approach, the EWC-enhanced shared encoder architecture, is designed to preserve and retain knowledge from previously learned tasks effectively. This architecture mitigates the risk of catastrophic forgetting and enhances the learning capabilities for minority classes in batch learning scenarios, ensuring that diverse data representations are maintained across various tasks. In contrast, the second approach, the CIL-DOE framework, leverages the principles of Hoeffding Trees to provide a robust and efficient solution for processing streaming data. This innovative framework is optimized for low-latency performance, allowing it to swiftly adapt to evolving class distributions without declining accuracy or efficiency. This adaptability is crucial in real-world applications where data streams can change rapidly. Together, these strategies foster the development of flexible, adaptable, and sustainable learning systems that excel in complex and dynamic data environments. By systematically addressing the dual challenges of catastrophic forgetting and class imbalance, this thesis significantly advances lifelong and incremental learning paradigms, paving the way for more effective machine learning applications that can continuously learn and adapt in real-time.