Network intrusion detection via tri-broad learning system based on spatial-temporal granularity.

Network intrusion detection system plays a crucial role in protecting the integrity and availability of sensitive assets, where the detected traffic data contain a large amount of time, space, and statistical information. However, existing research lacks the utilization of spatial-temporal multi-granularity data features and the mutual support among different data features, thus making it difficult to specifically and accurately identify anomalies. Considering the distinctions among different granularities, we propose a framework called tri-broad learning system (TBLS), which can learn and integrate the three granular features. To explore the spatial-temporal connotation of the traffic information accurately, a feature dataset containing three granularities is constructed according to the characteristics of time, space, and data content. In this way, we use broad learning basic units to extract abstract features of different granularities and then express these features in different feature spaces to enhance them separately. We use a normal distribution initialization method in BLS to optimize the weights of feature nodes and enhancement nodes for better detection accuracy. The merits of our proposed model are exhibited on the UNSW-NB15, CIC-IDS-2017, CIC-DDoS-2019, and mixed traffic datasets. Experimental results show that TBLS outperforms the typical BLS in terms of various evaluation metrics and time consumption. Compared with other machine learning methods, TBLS achieves better performance metrics. [ABSTRACT FROM AUTHOR]