In this work, we present a framework called Drift Dataset Generator for Evaluating Flow-Based IDS (Drift-IDS-Generator). Our framework introduces drifts into public IDS datasets, trains intrusion detection models using data stream classification algorithms, and evaluates their performance to better understand how these algorithms respond to different types of concept drift, making the evaluation process more realistic. We also conducted a case study using two types of attacks from the CIC-IDS2017 dataset and found that even when applying the same data stream classification algorithm, performance varied depending on the type of drift.

Multi-label stream classification is the task of classifying instances in two or more classes simultaneously, with instances flowing continuously in high speed. This task imposes difficult challenges, such as the detection of concept drifts, where the distributions of the instances in the stream change with time, and infinitely delayed labels, when the ground truth labels of the instances are never available to help updating the classifiers. To solve such task, the methods from the literature use the problem transformation approach, which divides the multi-label problem into different sub-problems, associating one classification model for each class. In this paper, we propose a method based on self-organizing maps that, different from the literature, uses only one model to deal with all classes simultaneously. By using the algorithm adaptation approach, our proposal better considers label dependencies, improving the results over its counterparts. Experiments using different synthetic and real-world datasets showed that our proposal obtained the overall best performance when compared to different methods from the literature.

Intrusion Detection Systems (IDS) are a popular solution against cyber-attacks. IDS collect network traffic in-formation and identify attack attempts by inspecting packets individually or in the context of flows. In this work, we consider the intrusion detection process a classification task over a stream of continuously generated packets with a non-stationary data distribution. To cope with this task, we advocate using state-of-the-art Stream Mining algorithms that constantly learn what normal traffic is and what could be an attack. We determined that inspecting packets individually renders similar performance to examining flows in several situations and that only a subset of the packets’ headers is sufficient for the classification. These results are shown through experimentation using the CICIDS2017 dataset and through multiple measures.

Visual analysis of temporal networks comprises an effective way to understand the network dynamics, facilitating the identification of patterns, anomalies, and other network properties, thus resulting in fast decision making. The amount of data in real-world networks, however, may result in a layout with high visual clutter due to edge overlapping. This is particularly relevant in the so-called streaming networks, in which edges are continuously arriving (online) and in non-stationary distribution. All three network dimensions, namely node, edge, and time, can be manipulated to reduce such clutter and improve readability. This paper presents an online and nonuniform timeslicing method, thus considering the underlying network structure and addressing streaming network analyses. We conducted experiments using two real-world networks to compare our method against uniform and nonuniform timeslicing strategies. The results show that our method automatically selects timeslices that effectively reduce visual clutter in periods with bursts of events. As a consequence, decision making based on the identification of global temporal patterns becomes faster and more reliable.

Recent botnet activities targeting IoT infrastructure and turning computing devices into cryptocurrency miners indicate an increase in the botnet attack surface and capabilities. These facts emphasize the importance of investigating alternative methods for detecting botnets. One of them is using stream mining algorithms to classify malicious network traffic. Although some initiatives seek to adopt stream mining strategies to detect botnets, several research topics still need to be discussed. Our goal is to compare the use of single and ensemble-based stream mining algorithms to identify botnet network flows. Since obtaining examples of malicious network flows could be a hassle to security managers, we also investigate whether the use of ensembles could reduce the number of labeled instances required to update the classification model. Our results indicate that the ensemble-based Ozaboost algorithm with the prequential evaluation strategy outperforms the other selected algorithms. We also found that ensemble-based algorithms and some botnet characteristics (C&C communication protocol) requires less labeled instances while maintains high performance.

Methods for image data stream classification need to update their model constantly and many of these perform this in a supervised way. However, these studies evaluate the performance of their methods assuming that all labels will be available immediately after classification, which is not consistent with various real-world application scenarios. This article proposes a new evaluation method for image data stream classifiers that allows for the exploration of different issues present in real-world applications, such as the emergence of new classes, the evolution of existing classes, and delayed image labels after classification. Through an analysis of the experimental results, we verified that the proposed evaluation method allowed the identification of the issues that most impact the accuracy of the image classifier, indicating a need to direct efforts in carrying out future works to develop strategies to mitigate these issues.

In multi-label classification problems an example can be simultaneously classified into more than one class. This is also a challenging task in Data Streams (DS) classification, where unbounded and non-stationary distributed multi-label data contain multiple concepts that drift at different rates and patterns. In addition, the true labels of the examples may never become available and updating classification models in a supervised fashion is unfeasible. In this paper, we propose a Multi-Label Stream Classification (MLSC) method applying a Novelty Detection (ND) procedure task to update the classification model detecting any new patterns in the examples, which differ in some aspects from observed patterns, in an unsupervised fashion without any external feedback. Although ND is suitable for multi-class stream classification, it is still a not well-investigated task for multi-label problems. We improve a initial work proposed in [1] and extended it with a new Pruned Sets (PS) transformation strategy. The experiments showed that our method presents competitive performances over data sets with different concept drifts, and outperform, in some aspects, the baseline methods.

The Internet of Things (IoT) allows large amounts and variety of devices to connect, interact and exchange data. The IoT network creates numerous opportunities for novel attacks that can compromise information and systems integrity. Intrusion detection systems have been studied over two decades, mostly employing traditional data mining and machine learning techniques that require an offline phase for model training on large amounts of data. This paper presents three data stream novelty detection techniques applied to the intrusion detection problem and proposes IDSA-IoT, a novel implementation architecture, which combines the use of resources at the edge of the network and a public cloud. After an extensive empirical evaluation, results show that it is possible to identify new attack patterns soon after their emergence and to adapt the models in an efficient way.

Approaches that combine streaming algorithms and distributed computing have potential to deal with voluminous and high-speed data streams. Considering the data stream clustering task, also an important issue needs to be addressed, estimate the number of clusters dynamically, since it may vary due to concept drift. This work proposes three evolutionary-based algorithms to overcome these requirements. They are based in the discretized stream model, where the sequential batches of objects are distributed and processed in a parallel way using the MapReduce model. The proposed algorithms achieve superior experimental results, either in quality and processing time, overcoming the state-of-the-art.

Data stream mining is an emergent research area that investigates knowledge extraction from large amounts of continuously generated data, produced by non-stationary distribution. Novelty detection, the ability to identify new or previously unknown situations, is a useful ability for learning systems, especially when dealing with data streams, where concepts may appear, disappear, or evolve overtime. There are several studies currently investigating the application of novelty detection techniques in data streams. However, there is no consensus regarding how to evaluate the performance of these techniques. In this study, we propose a new evaluation methodology for multiclass novelty detection in data streams able to deal with: i) unsupervised learning, which generates novelty patterns without an association with the true classes, where one class may be composed of a novelty set, ii) confusion matrix that increases overtime, iii) confusion matrix with a column representing unknown examples, i.e., those not explained by the model, and iv) representation of the evaluation measures overtime. We propose a new methodology to associate the novelty patterns detected by the algorithm, in an unsupervised fashion, with the true classes. Finally, we evaluate the performance of the proposed methodology through the use of known novelty detection algorithms with artificial and real data sets.