Network Intrusion Detection for Modern Smart Grids Based on Adaptive Online Incremental Learning

New and evolving cyber attacks against smart grids are emerging. This necessitates that the network intrusion detection systems (IDSs) have online learning ability. However, most existing methods struggle to handle new and evolving attacks while retaining old attack knowledge, and many of them employ deep models requiring long update periods. Therefore, we propose an IDS based on adaptive online incremental learning (AdaOIL-IDS). 1) A class-correlated broad learning system (CC-BLS) is proposed for intrusion detection. A weighted CC-factor derived from intra- and inter-class correlations is introduced in CC-BLS to improve classification accuracy. CC-incremental learnings are designed to quickly add new inputs and additional nodes without retraining. The CC-factor for new inputs is adjusted based on correlations of new and old classes, which enables simultaneous adaptation to new attacks and new observations of old attacks while retaining more old knowledge. 2) An adaptive learning framework is proposed for online-offline combined learning of models. Online learning and offline retraining are adaptive switched based on the real-time loss to achieve efficient lifelong learning. Experiment results show that CC-BLS has better performance than selected state-of-the-art incremental broad and deep models, and the proposed adaptive learning framework behaviors better effectiveness and efficiency than selected existing frameworks.