Semi-supervised Balanced Distribution Adaptation Model for Intrusion Detection

Intrusion Detection Systems (IDS) are essential for safeguarding modern network infrastructures against a wide range of cyber threats. However, the development of highly effective IDS models is often constrained by the limited availability of labeled data for training, as well as the issue of distribution shift when applying models across different network environments. To overcome these challenges, we present a semi-supervised balanced distribution adaptation (SSBDA) transfer learning method for detecting and preventing network intrusion, which learns from limited labeled data and predicts unlabeled data with different distributions. The proposed method first employs the maximum mean discrepancy measure the differences between the marginal and conditional distributions of both the source and target domains. The Hilbert-Schmidt independence criterion is then utilized to estimate the dependence between labels and features within the source domain. To further enhance the model’s generalization ability, manifold regularization is applied to preserve the data’s locality structure. Finally, the processed data is used to train a tri-training classifier. The SSBDA is compared with several well-known transfer learning-based models using the KDDCup99 and NSL-KDD data sets. The experimental results demonstrate that SSBDA outperforms the comparison models in terms of accuracy and F-score, highlighting its superior performance in intrusion detection tasks.