SlowGuess/NeurIPS_2023_OCR huggingface dataset:
Suresh Kumar Amalapuram*, Sumohana S Channappayya#, and Bheemarjuna Reddy Tamma*  
Dept. of Computer Science and Engineering*, Dept. of Electrical Engineering#  
Indian Institute of Technology Hyderabad, India  
{cs19resch11001, sumohana, tbr}@iith.ac.in
Intrusion detection is a form of anomalous activity detection in communication network traffic. Continual learning (CL) approaches to the intrusion detection task accumulate old knowledge while adapting to the latest threat knowledge. Previous works have shown the effectiveness of memory replay-based CL approaches for this task. In this work, we present two novel contributions to improve the performance of CL-based network intrusion detection in the context of class imbalance and scalability. First, we extend class balancing reservoir sampling (CBRS), a memory-based CL method, to address the problems of severe class imbalance for large datasets. Second, we propose a novel approach titled perturbation assistance for parameter approximation (PAPA) based on the Gaussian mixture model to reduce the number of virtual stochastic gradient descent (SGD) parameter computations needed to discover maximally interfering samples for CL. We demonstrate that the proposed approaches perform remarkably better than the baselines on standard intrusion detection benchmarks created over shorter periods (KDDCUP'99, NSL-KDD, CICIDS-2017/2018, UNSW-NB15, and CTU-13) and a longer period with distribution shift (AnoShift). We also validated proposed approaches on standard continual learning benchmarks (SVHN, CIFAR-10/100, and CLEAR-10/100) and anomaly detection benchmarks (SMAP, SMD, and MSL). Further, the proposed PAPA approach significantly lowers the number of virtual SGD update operations, thus resulting in training time savings in the range of 12 to  $40\%$  compared to the maximally interfered samples retrieval algorithm.
Learning from a continuum of data with distribution shift over time is known as continual/lifelong learning (CL) [1, 2]. CL algorithms aim to preserve learned knowledge (stability) while embracing the knowledge of new tasks (plasticity). The conflict in balancing stability and plasticity often leads to the problem of catastrophic forgetting (CF) [3, 4]. In other words, past tasks' knowledge degrades over time due to interference from the newer task. Unlike computer vision [5, 6, 7, 8], natural language processing [9, 10], and speech processing [11, 12], CL applications to many real-world problems are under-explored, and one such exemplar is network intrusion detection (NID) in communication networks. Intrusion detection is a form of distribution shift detection that aims to detect anomalous activity patterns in the network traffic [13, 14]. To ensure protection against novel cyber-attacks, network intrusion detection systems (NIDS) must evolve continuously and effortlessly learn from the newer attack data.
The concept drift/distribution shift is prevalent in cybersecurity, as malicious behavior can shift either suddenly or gradually over time [15, 13]. While NID formulated as anomaly detection (AD) is typically trained on normal data (zero positive learning [16]) and is immune to the drift of malicious
behavior, however, its performance can be severely affected when the distribution of normality shifts [14] (open-world setting). In the cybersecurity domain, a shift in normality can occur when new patches, software updates, devices, or protocols are introduced [14, 13]. This work considers normality shifts and distribution shifts in attack data. So, we formulate our problem as a continual learning-based supervised binary classification problem (SBCP).
Class imbalance and Task-free nature: SBCP formulation differs from the traditional classification problem as the former one possesses two challenging characteristics [17], i.e., class imbalance (CI) and class overlap. In this work, our focus is primarily on mitigating the adverse effects of class imbalance on performance. Here, CI means a different number of training examples  $(n_t)$  for each class in the dataset. The majority class contains the highest number of training examples, whereas minority classes are the last few classes when sorted in non-increasing order based on  $n_t$ . CI is said to be severe when the difference between the minority class training examples  $(n_t)$  is relatively high (e.g., the difference between the number of samples of DDoS attack-HOIC and SQL Injection attack (minority) classes of the CICIDS-2018 [18] dataset is 2.1 million). Intrusion detection generally operates in a streaming environment. As a result, task-free continual learning [19] becomes a natural fit for such applications. Working in a task-free CL setup assumes no information about task boundaries and the number of samples per class.
Continual learning with shallow methods: We study the feasibility of shallow methods (non-neural networks) in the CL setting by conducting preliminary experimenting using the random forest (RF) algorithm (a popular algorithm in NIDS literature) on CICIDS-2017 and CICIDS-2018 datasets. We made the following observations: First, RF exhibits higher CF (especially on minority classes) on previous tasks while learning new tasks. Second, augmenting RF with buffer memory partially reduces the CF on previous tasks. More details on this experiment are available in the supplementary material (SM:A.2). To conclude, compared to deep learning (neural network) methods, shallow methods exhibit higher CF, thus diminishing their performance in the CL setting.
Prior art [20] has demonstrated the suitability of CL for addressing the NID problem. This work shown the adverse impact of severe class imbalance on the performance of NID algorithms. This work also demonstrated the usefulness of memory replay (MR)-based approaches for this task. Generally, class imbalance-aware MR methods (e.g., class balancing reservoir sampling (CBRS) [21]) perform a periodic memory population operation to handle class imbalance. In particular, CBRS distinguishes majority and minority classes based on the respective class sample count (local information) from the buffer memory. However, this strategy has a pitfall when the count of minority class samples in the finite buffer memory appears to come from a majority class. This situation could occur when there is a severe imbalance among the minority classes, especially in larger datasets. Larger datasets mean the number of training samples in the order of millions (CICIDS-2018, AnoShift). In this work, we extend the CBRS method (and call it ECBRS) to address this issue. The proposed ECBRS always prioritizes the majority class for sample replacement using additional global information about class imbalance.
Table 1: Timing comparison between the virtual SGD operations and the total training of the MIR algorithm. Each experiment is repeated five times, and mean values are reported for virtual SGD ops time and total train time.
Dataset	MIR (time in seconds)
VSP ops time	Total train time	VSP ops proportion
CICIDS-2017 [22]	102.9	254.3	40.4%
UNSW-NB15 [23]	132.4	428.2	30.9%
CTU-13 [24]	142.4	398.1	35.7%
KDDCUP'99 [25]	191.0	420.8	45.3%
AnoShift [26]	499.4	1210.4	41.2%
CICIDS-2018 [22]	3315.0	7620	43.5%
SVHN [27]	112.0	217.0	51.6%
CIFAR-10 [28]	58.6	118.6	49.4%
CIFAR-100 [28]	45.71	88.56	51.61%
CLEAR-10 [29]	128.2	265.9	48.2%
CLEAR-100 [29]	703.6	1490	47.2%
To summarise, our key contributions in this work are:
Other families of MR techniques like maximally interfered retrieval (MIR) [30] and gradient-based memory editing (GMED) [31] quantify the significance of samples in the buffer memory using temporary (virtual) stochastic gradient descent (SGD) parameter updates. However, this computation overhead consumes nearly 40 to  $50\%$  of the total training time, as shown in Table 1. Motivated by this drawback, we propose a novel approach known as perturbation assistance for parameter approximation (PAPA) for estimating the virtual SGD parameter (VSP) updates using the Gaussian mixture model (GMM) with low overhead.
1. An extension to the CBRS, dubbed ECBRS, to deal with severe class imbalance by always undermining the majority class by maintaining the global information about class imbalance. Further, ECBRS can be used as a memory population policy in conjunction with the existing memory replay-based approaches.
2. A perturbation assistance for parameter approximation (PAPA) method for estimating VSP updates that significantly reduces the training time for methods like MIR and GMED, leading to improved scalability.
3. A demonstration of the improved performance of the proposed methods relative to the considered baselines using standard network intrusion detection, computer vision, and anomaly detection benchmarks (including AnoShift and CLEAR-100, whose training data spans over ten years). Further, we show that using the PAPA method results in training time savings of 12 to  $40\%$  (relative to the baselines), thus it is highly suitable for large-scale training.
Intrusion detection: An intrusion detection system (IDS) [32, 33] is one of the fundamental tools in security infrastructure to safeguard against cyber-attacks at the host or network (NIDS) perimeter level [34]. A signature-based NIDS uses a rule-based engine to identify known patterns, whereas anomaly-based NIDS identifies patterns that deviate from normal behavior [35]. NIDS are built using techniques ranging from traditional machine learning to deep learning and reinforcement learning [36]. Typically, network intrusions represent a tiny subset of network traffic [37]. As a result, a heavy class imbalance is observed in NID datasets, making the intrusion detection performance vulnerable. Sampling (algorithm) based approaches have been proposed in the literature to mitigate this problem [38, 39, 40]. But, this work focuses on building an NIDS that adapts to both benign and attack data distribution shifts without any aid of sampling strategies to handle the CI effect.
Continual learning: Recently, there has been a significant effort to expand the horizon of continual learning by mitigating the impact of CF [4]. These efforts can be broadly grouped into the following families [3]: regularization-based [41, 42], expansion-based [43], meta-learning-based [44], and rehearsal or memory replay-based approaches.
A subset of rehearsal methods that focus on class imbalance are CBRS [21] and partition reservoir sampling [45], in which samples are preserved in memory in proportion to their class strength. However, these methods do not handle severe CI between the minority samples. The proposed ECBRS addresses this CI issue. Further works like maximum interfered retrieval (MIR) [30] and gradient-based sample editing (GMED) [31] use virtual SGD parameter updates to identify the most interfered samples. These are samples in the replay memory that suffer an increase in loss due to previous parameter updates. However, for large-scale training, these virtual update computations add significant overhead. Unlike these, our proposed PAPA method significantly reduces this overhead, making it suitable for training over large datasets.
(a) Running statistics
Figure 1: Comparison between CBRS and ECBRS over an imbalanced stream from a CICIDS-2018 dataset setting with a memory size  $(\mathcal{M}) = 1500$ . (a) Running statistics indicate the number of classwise samples seen so far. (b) Memory distribution represents the strength of each class in buffer memory at a particular instance. Upon the arrival of ten new samples from the class attack5, using CBRS, the memory distribution changes to (c). However, using ECBRS, the memory distribution changes to (d). For (c) and (d), the class with the red-colored bar is chosen for replacement, the green-colored bar class receives new samples, and the class with the blue-colored bar remains intact. Detailed illustrations of these configuration changes for CBRS and ECBRS are presented in the supplementary material (SM:A.3).
(b) Memory distribution
(c) CBRS
(d) ECBRS
In this section, we present the proposed ECBRS and PAPA methods. In the ECBRS method, we adopt two definitions introduced in the base paper of CBRS [21]. They are full and largest classes. When a particular class contains the most instances among all the different classes in the memory,
we call it the largest. Two or more classes can be the largest if they have the same size. We call a class full if it currently is, or has been in one of the previous time steps, the largest class. Once a class becomes full, it remains so in the future. More details of the CBRS algorithm are given in the supplementary material (SM:A.14).
3.1 ECBRS: An Extended Class Balancing Reservoir Sampling Algorithm
The legacy CBRS algorithm assigns higher probability weights to minority class samples using a weighted replay approach. However, these weights are computed based on the number of data samples in the buffer memory (local information). This approach has a limitation when the class imbalance present between the minority classes themselves is severe. This limitation is illustrated in Figure 1, where running statistics of each class is the corresponding class running frequency(refer Figure 1a), and benign is the maximal (majority) class. Typically, the benign class samples must be chosen for replacement whenever new minority class samples arrive. However, CBRS treats all classes equally for a replacement to accommodate newly arrived attack5 (minority) class samples (instead of the benign class). This is because CBRS relies on local information for sample replacement. From Figure 1b, all class samples appear to be the majority classes in the buffer memory distribution. As a result, different class samples in memory are uniformly selected for sample replacement (refer Figure 1c, in which red-colored classes are chosen for sample replacement for accommodating newly arrived attack5 class samples). This choice will have an adverse impact on large-scale training, where the class imbalance between the minority classes is significant. Motivated by this, we extended the CBRS to rely on each class's running statistics (global information) for replacement decision-making. Our method (ECBRS) will always prefer the class with higher global information until a threshold  $\gamma$  (refer Equation 1), later it will choose the class with the next highest running statistic value, thereby ensuring that a majority class sample is replaced in the memory buffer. In summary, we use original class labels to organize the buffer memory to learn SBCP and choose class samples in memory with higher running statistic values for the replacement to accommodate newly arriving samples.
Further, the class imbalance among minority classes poses another challenge known as the conflict of equal weights. It will occur whenever the majority (maximal) class samples are completely replaced
Algorithm 1 Memory population for ECBRS
Input: data stream:  $(x_{i},y_{i})_{i = 1}^{n}$  , number of currently stored instances of class  $(\mathsf{c}\equiv y_i)$  ..  $m_c$  , number of stream instances of class  $\mathsf{c}\equiv y_{i}$  encountered so far:  $n_c$
for  $i = 1$  to  $n$  do
if memory is not filled then store  $(x_{i},y_{i})$
if  $y_{i}$  is not a full class then select a class that is the largest, having higher running statistics value and non-zero samples with  $m_c\geq \gamma (c)$  in the buffer. Otherwise, select a class with the next higher running statistic value with  $m_c\geq \gamma (c)$  . overwrite the selected class sample with  $(x_{i},y_{i})$
sample  $\mathbf{u}\sim$  Uniform(0,1); if  $\mathrm{u}\leq m_c / n_c$  then pick a stored instance of class  $\mathbf{c}\equiv y_{i}$  at random and replace it with  $(x_{i},y_{i})$
Ignore  $(x_{i},y_{i})$
or underrepresented in the buffer memory. So, undermining the chosen minority class based on global information will lead to the loss of the essential samples in combating the class imbalance problem. This drawback can be mitigated by disallowing the undermining of the minority class beyond a certain threshold  $\gamma$ . In ECBRS method, we choose this parameter based on global information. Thus, we guarantee that attack class samples can never be replaced beyond this threshold. From Figure 1d, it can be observed that the proposed ECBRS initially chose benign class samples for replacements to accommodate newly arriving attack5 class samples, as it has the highest running statistics value. In the process of sample replacement, once it reaches the threshold of the benign class  $(\gamma(.)=262)$ , ECBRS selects the class with the next highest running static value (attack4). Thus remaining, different class samples (colored blue) will remain intact. We compute  $\gamma(\cdot)$  (for class  $i$ ) as the expected number of samples to be present based on the global information, as shown in Equation 1.
$$
\gamma (i) = m \times w (i), \tag {1}
$$
where  $i$  is the class index,  $w(i) = \frac{\exp(-n_i)}{\sum_j\exp(-n_j)}$
$m$  is the buffer memory capacity,  $\gamma (i),n_{i}$  are the threshold and running class frequency for class  $i$ , respectively, and  $w(i)$  is the weight associated with class  $i$ .  $w(i)$  is the softmax of the negative running
frequencies favoring the minority classes. In our experiments, we also observe that computing a single loss over the replayed and stream samples achieves better performance compared to CBRS (which involves computing two-component loss). One pragmatic reason for this behavior could be that concatenating replay samples with stream samples achieves better batch-wise class balance. We present the pseudo-code of the proposed ECBRS in Algorithm 1.
(a) CICIDS-2017
(b) CICIDS-2018
Figure 2: t-SNE visualization of regular SGD updates and virtual SGD updates. An MLP is trained on the CICIDS-2017 and CICIDS-2018 datasets. A ResNet-18 (pretrain [46]) model is trained on the CIFAR-10 and CLEAR-10 datasets.
(c) CIFAR-10
(d) CLEAR-10
3.2 Perturbation Assistance for Parameter Approximation (PAPA)
Memory replay-based CL techniques such as MIR and GMED select a subset of samples from the buffer memory based on the loss incurred during virtual stochastic gradient descent (SGD) parameter (VSP) updates. Samples that incur a higher loss are preferred. These updates are computed using the current batch of the incoming stream samples. Further, these updates are ignored after the subset selection. For lengthy data streams (used to train very deep models), these frequent VSP updates result in significant computational overhead (due to SGD operations). Each SGD involves computing the gradients for larger weight matrices, leading to increased computational overhead.
(a) CICIDS2017
(b) CICIDS2018
Figure 3: For randomly chosen model parameters, the plots show the distribution of the error between the regular SGD parameter updates and virtual SGD parameter updates on various datasets. In (a) and (b), an MLP is trained on CICIDS-2017 and CICIDS-2018. In (c) and (d), a ResNet-18 is trained on CIFAR-10 and CLEAR-10.
Motivated by this problem, we try to understand the relationship between the regular and virtual SGD update operations. Towards this, we plot various t-SNE visualizations on CICIDS2017, CICIDS-2018, CIFAR-10, and CLEAR10 datasets. The CIDIDS-2017 and CICIDS2018 datasets are used to train an MLP, and the CIFAR-10 and CLEAR-10 datasets are used to train a ResNet-18 model (refer Figure 2). We make the following observations from these plots: virtual SGD parameter update is a slowly varying process. In other words, the VSP overlaps with or is scattered closely around the regular SGD updates. One way to capture this notion is to sufficiently perturb the regular SGD parameter (RSP) updates to estimate the VSP updates. Then, the next question is: how to quantify the perturbation required for a given task?
To quantify the perturbation, we model the error (difference between the VSP and RSP) distribution of randomly chosen model parameters on a diverse set of benchmarks. These are shown in Figure 3. We observe that the error values of the chosen parameters exhibit a skewed Gaussian (heavy-tailed) distribution. We model this error distribution using a two-component Gaussian mixture model (GMM). However, modelling individual error components with a GMM is a time-consuming process. So, we model the joint distribution  $\mathcal{P}(\Theta_e)$  of error values of all the parameters using a GMM, whose marginals remain Gaussian. As a result, each parameter-level error distribution is preserved.
Thus, our approach for approximating the VSP is mathematically formulated as a simple additive model which is given in Equation 2.
$$
\Theta_ {v p u} = \Theta_ {r p u} + \mathcal {Z} \tag {2}
$$
The perturbation  $\mathcal{Z}$  is drawn from  $\mathcal{P}(\Theta_e)$  where  $\mathcal{P}(\Theta_e) = \pi_1\mathcal{N}(\Theta_1|\mu_1,\Sigma_1) + \pi_2\mathcal{N}(\Theta_2|\mu_2,\Sigma_2)$ , where  $\mu_1,\mu_2$ , are the mean vectors and  $\Sigma_1,\Sigma_2$  are the covariance matrices of the two Gaussian components, respectively.  $\pi_1,\pi_2$  are the mixing coefficients and  $\Theta_{rpu}$  is the most recent regular parameter update.
GMM Training: We use the MIR algorithm for the first CL task in our proposed approach to estimate the error distribution (ED). This ED is used to train the GMM once, and this GMM is used in all remaining tasks. Our empirical study also confirms that different first task (used to construct ED) has no adverse effect on the performance results (refer to SM:A.10.2). The pseudo-code of the proposed PAPA method is outlined in Algorithm 2.
4 Experiments and Analysis
Algorithm 2 Perturbation assistance for parameter approximation
1: Input: data stream  $(x_{i},y_{i})_{i = 1}^{n}$ , initial task  $T_{1}$ , maximally interfered retrieval algorithm  $\mathcal{MIR}(\cdot)$ , gaussian mixture model with two components  $\mathcal{GMM}$ , buffer memory  $\mathcal{M}$ , perturbation array  $\mathcal{P}$ , policy to update buffer memory  $\rho$ , function approximator  $f(x,y:\Theta)$ , parameters after updating on previous batch of samples  $\Theta_{rpu}$ .
2: for the task  $T_{1}$  do
3: sample batch  $\mathcal{B}_j\sim T_1$
4: render  $\Theta_{j-1}$ ; parameters after updating on  $\mathcal{B}_{j-1}$
5: Run  $\mathcal{MIR}(\mathcal{B}_j)$
6: store  $\Theta_{j}$ ; parameters after updating on  $\mathcal{B}_j$
7: store  $(\Theta_{j} - \Theta_{j - 1})$  to  $\mathcal{P}$
8: end for
9: train a  $\mathcal{GMM}$  using  $\mathcal{P}$
10: for remaining tasks do
11: sample batch  $\mathcal{B}$  from current task
12: sample  $\mathcal{Z}\sim \mathcal{GMM}$
13:  $\Theta_{vpu} = \Theta_{rpu} + \mathcal{Z}$
14:  $S\gets$  compute interfere samples using  $\Theta_{vpu}$  on  $\mathcal{M}$
15:  $\mathcal{B}_{int} \gets$  subsample from  $S$  based on certain criteria
16:  $\mathcal{B}_{new} = \mathcal{B}\cup \mathcal{B}_{int}$
17: train  $f(\cdot : \Theta)$  with  $\mathcal{B}_{\text{new}}$
18: update  $\mathcal{M}$  with  $\rho$  using  $\mathcal{B}$
19: end for
Datasets and Tasks Formulation: We conduct the experiments in the domain-incremental (class labels space is fixed to benign and attack, whereas data space horizon may change) learning approach, similar to the prior study [20]. We created tasks by dividing the benign data and combining them with attack class samples. This approach ensures that each task contains a mix of benign and attack data, maintaining the class imbalance resembling real-world network traffic. We created five tasks for KDDCUP'99 [25] and NSL-KDD [47], ten for CICIDS-2017/2018 [22, 48], nine for UNSW-NB [23, 49, 50, 51, 52], and ten for AnoShift [26] benchmark.
Existing network intrusion detection benchmarks are artificially created over short time periods and may not exhibit natural distribution shifts [13] (except AnoShift). Distribution shifts are quantified by the optimal transport dataset distance (OTDD) (refer to Table 2). Large OTDD values indicate a higher distribution shift. More details on how OTDD values are computed