Modern network intrusion detection systems are short of flexibility to the frequently altering network surroundings. Additionally, intrusion detection in the new distributed architectures is now a major requirement. In this paper, we propose online Adaboost-based intrusion detection algorithms. In an enhanced algorithm online Adaboost process and online Gaussian mixture models (GMMs) are used as weak classifiers. We further propose a distributed intrusion detection framework, in which a local parameterized detection model is created in each node using the online Adaboost algorithm. A global detection model is constructed in each node by merging the local parametric models using a small number of samples in the node. This combination is accomplished using an algorithm based on particle swarm optimization (PSO) and support vector machines. The global model in each node is used to detect intrusions. Investigational results show that the enhanced online Adaboost process with GMMs gets a superior detection rate and a lower false alarm rate than the traditional online Adaboost process that uses decision stumps. Both the algorithms outperform existing intrusion detection algorithms. It is also shown that our PSO, and SVM-based algorithm efficiently merge the local detection models into the global model in each node; the global model in a node can handle the intrusion categories that are found in other nodes, without distribution the samples of these intrusion types.

Local Model Global Model