Incremental intrusion detection model incorporating sparse self-attention mechanism

Abstract:

Traditional self-attention-based intrusion detection models have high time complexity in the calculation of attention values, and most intrusion detection models are oriented to static network environments. To address the above problems, we proposed an incremental intrusion detection model incorporating a sparse self-attention mechanism. First, we introduced a sparsity metric formula to reduce the time complexity, so as to alleviate the computational pressure of the model without affecting the detection performance of the model; Second, we constructed a dynamic example memory to alleviate the concept drift phenomenon of the model in incremental learning at the cost of a very small amount of memory space; Finally, we designed a category-balanced loss function, which is capable of enhancing the learning ability of the model for old-category samples without dynamically adjusting the model. Derivation and experiments prove that the sparse self-attention mechanism has lower time complexity and better classification effect. Compared with other schemes, the incremental learning mechanism shows a stronger ability to memorize old knowledge. The intrusion detection model has a better application prospect in the modern network environment.