Title: Augmented Memory Replay-based Continual Learning Approaches for Network Intrusion Detection
Venue: NeurIPS 2023
Accepted: yes
Keywords: Continual learning

Class imbalance

scalability

Network intrusion detection

and Cybersecurity
Abstract: Intrusion detection is a form of anomalous activity detection in communication network traffic. Continual learning (CL) approaches to the intrusion detection task accumulate old knowledge while adapting to the latest threat knowledge. Previous works have shown the effectiveness of memory replay-based CL approaches for this task. In this work, we present two novel contributions to improve the performance of CL-based network intrusion detection in the context of class imbalance and scalability. First, we extend class balancing reservoir sampling (CBRS), a memory-based CL method, to address the problems of severe class imbalance for large datasets. Second, we propose a novel approach titled perturbation assistance for parameter approximation (PAPA) based on the Gaussian mixture model to reduce the number of \textit{virtual stochastic gradient descent (SGD) parameter} computations needed to discover maximally interfering samples for CL. We demonstrate that the proposed approaches perform remarkably better than the baselines on standard intrusion detection benchmarks created over shorter periods (KDDCUP'99, NSL-KDD, CICIDS-2017/2018, UNSW-NB15, and CTU-13) and a longer period with distribution shift (AnoShift). We also validated proposed approaches on standard continual learning benchmarks (SVHN, CIFAR-10/100, and CLEAR-10/100) and anomaly detection benchmarks (SMAP, SMD, and MSL). Further, the proposed PAPA approach significantly lowers the number of virtual SGD update operations, thus resulting in training time savings in the range of 12 to 40\% compared to the maximally interfered samples retrieval algorithm.

Augmented Memory Replay-based Continual Learning Approaches for Network Intrusion Detection

Abstract

Intrusion detection is a form of anomalous activity detection in communication network traffic. Continual learning (CL) approaches to the intrusion detection task accumulate old knowledge while adapting to the latest threat knowledge. Previous works have shown the effectiveness of memory replay-based CL approaches for this task. In this work, we present two novel contributions to improve the performance of CL-based network intrusion detection in the context of class imbalance and scalability. First, we extend class balancing reservoir sampling (CBRS), a memorybased CL method, to address the problems of severe class imbalance for large datasets. Second, we propose a novel approach titled perturbation assistance for parameter approximation (PAPA) based on the Gaussian mixture model to reduce the number of virtual stochastic gradient descent (SGD) parameter computations needed to discover maximally interfering samples for CL. We demonstrate that the proposed approaches perform remarkably better than the baselines on standard intrusion detection benchmarks created over shorter periods (KDDCUP'99, NSLKDD, CICIDS-2017/2018, UNSW-NB15, and CTU-13) and a longer period with distribution shift (AnoShift). We also validated proposed approaches on standard continual learning benchmarks (SVHN, CIFAR-10/100, and CLEAR-10/100) and anomaly detection benchmarks (SMAP, SMD, and MSL). Further, the proposed PAPA approach significantly lowers the number of virtual SGD update operations, thus resulting in training time savings in the range of 12 to 40% compared to the maximally interfered samples retrieval algorithm.

1 Introduction

Learning from a continuum of data with distribution shift over time is known as continual/lifelong learning (CL) [1, 2]. CL algorithms aim to preserve learned knowledge (stability) while embracing the knowledge of new tasks (plasticity). The conflict in balancing stability and plasticity often leads to the problem of catastrophic forgetting (CF) [3, 4]. In other words, past tasks' knowledge degrades over time due to interference from the newer task. Unlike computer vision [5, 6, 7, 8], natural language processing [9, 10], and speech processing [11, 12], CL applications to many real-world problems are under-explored, and one such exemplar is network intrusion detection (NID) in communication networks. Intrusion detection is a form of distribution shift detection that aims to detect anomalous activity patterns in the network traffic [13, 14]. To ensure protection against novel cyber-attacks, network intrusion detection systems (NIDS) must evolve continuously and effortlessly learn from the newer attack data.

The concept drift/distribution shift is prevalent in cybersecurity, as malicious behavior can shift either suddenly or gradually over time [15, 13]. While NID formulated as anomaly detection (AD) is typically trained on normal data ( zero positive learning [16]) and is immune to the drift of malicious

behavior, however, its performance can be severely affected when the distribution of normality shifts [14] ( open-world setting). In the cybersecurity domain, a shift in normality can occur when new patches, software updates, devices, or protocols are introduced [14, 13]. This work considers normality shifts and distribution shifts in attack data. So, we formulate our problem as a continual learning-based supervised binary classification problem (SBCP).

Class imbalance and Task-free nature : SBCP formulation differs from the traditional classification problem as the former one possesses two challenging characteristics [17],i.e., class imbalance (CI) and class overlap . In this work, our focus is primarily on mitigating the adverse effects of class imbalance on performance. Here, CI means a different number of training examples ( n t ) for each class in the dataset. The majority class contains the highest number of training examples, whereas minority classes are the last few classes when sorted in non-increasing order based on n t . CI is said to be severe when the difference between the minority class training examples ( n t ) is relatively high (e.g., the difference between the number of samples of DDoS attack-HOIC and SQL Injection attack (minority) classes of the CICIDS-2018 [18] dataset is 2.1 million). Intrusion detection generally operates in a streaming environment. As a result, task-free continual learning [19] becomes a natural fit for such applications. Working in a task-free CL setup assumes no information about task boundaries and the number of samples per class.

Continual learning with shallow methods: We study the feasibility of shallow methods (non-neural networks) in the CL setting by conducting preliminary experimenting using the random forest (RF) algorithm (a popular algorithm in NIDS literature) on CICIDS-2017 and CICIDS-2018 datasets. We made the following observations: First, RF exhibits higher CF (especially on minority classes) on previous tasks while learning new tasks. Second, augmenting RF with buffer memory partially reduces the CF on previous tasks. More details on this experiment are available in the supplementary material ( SM:A.2 ). To conclude, compared to deep learning (neural network) methods, shallow methods exhibit higher CF, thus diminishing their performance in the CL setting.

Prior art [20] has demonstrated the suitability of CL for addressing the NID problem. This work shown the adverse impact of severe class imbalance on the performance of NID algorithms. This work also demonstrated the usefulness of memory replay (MR)-based approaches for this task. Generally, class imbalance-aware MR methods (e.g., class balancing reservoir sampling (CBRS) [21]) perform a periodic memory population operation to handle class imbalance. In particular, CBRS distinguishes majority and minority classes based on the respective class sample count (local information) from the buffer memory. However, this strategy has a pitfall when the count of minority class samples in the finite buffer memory appears to come from a majority class. This situation could occur when there is a severe imbalance among the minority classes, especially in larger datasets. Larger datasets mean the number of training samples in the order of millions (CICIDS-2018, AnoShift). In this work, we extend the CBRS method (and call it ECBRS) to address this issue. The proposed ECBRS always prioritizes the majority class for sample replacement using additional global information about class imbalance.

Table 1: Timing comparison between the virtual SGD operations and the total training of the MIR algorithm. Each experiment is repeated five times, and mean values are reported for virtual SGD ops time and total train time.

Other families of MR techniques like maximally interfered retrieval (MIR) [30] and gradientbased memory editing (GMED) [31] quantify the significance of samples in the buffer memory using temporary (virtual) stochastic gradient descent (SGD) parameter updates. However, this computation overhead consumes nearly 40 to 50% of the total training time, as shown in Table 1. Motivated by this drawback, we propose a novel approach known as perturbation assistance for parameter approximation (PAPA) for estimating the virtual SGD parameter (VSP) updates using the Gaussian mixture model (GMM) with low overhead.

To summarise, our key contributions in this work are:

An extension to the CBRS, dubbed ECBRS, to deal with severe class imbalance by always undermining the majority class by maintaining the global information about class imbalance. Further, ECBRS can be used as a memory population policy in conjunction with the existing memory replay-based approaches.

A perturbation assistance for parameter approximation (PAPA) method for estimating VSP updates that significantly reduces the training time for methods like MIR and GMED, leading to improved scalability.

A demonstration of the improved performance of the proposed methods relative to the considered baselines using standard network intrusion detection, computer vision, and anomaly detection benchmarks (including AnoShift and CLEAR-100, whose training data spans over ten years). Further, we show that using the PAPA method results in training time savings of 12 to 40% (relative to the baselines), thus it is highly suitable for large-scale training.

2 Related Work

Intrusion detection: An intrusion detection system (IDS) [32, 33] is one of the fundamental tools in security infrastructure to safeguard against cyber-attacks at the host or network (NIDS) perimeter level [34]. A signature-based NIDS uses a rule-based engine to identify known patterns, whereas anomaly-based NIDS identifies patterns that deviate from normal behavior [35]. NIDS are built using techniques ranging from traditional machine learning to deep learning and reinforcement learning [36]. Typically, network intrusions represent a tiny subset of network traffic [37]. As a result, a heavy class imbalance is observed in NID datasets, making the intrusion detection performance vulnerable. Sampling (algorithm) based approaches have been proposed in the literature to mitigate this problem [38, 39, 40]. But, this work focuses on building an NIDS that adapts to both benign and attack data distribution shifts without any aid of sampling strategies to handle the CI effect.

Continual learning: Recently, there has been a significant effort to expand the horizon of continual learning by mitigating the impact of CF [4]. These efforts can be broadly grouped into the following families [3]: regularization-based [41, 42], expansion-based [43], meta-learning-based [44], and rehearsal or memory replay-based approaches.

A subset of rehearsal methods that focus on class imbalance are CBRS [21] and partition reservoir sampling [45], in which samples are preserved in memory in proportion to their class strength. However, these methods do not handle severe CI between the minority samples. The proposed ECBRS addresses this CI issue. Further works like maximum interfered retrieval (MIR) [30] and gradient-based sample editing (GMED) [31] use virtual SGD parameter updates to identify the most interfered samples. These are samples in the replay memory that suffer an increase in loss due to previous parameter updates. However, for large-scale training, these virtual update computations add significant overhead. Unlike these, our proposed PAPA method significantly reduces this overhead, making it suitable for training over large datasets.

Benign

Attack1

Attack2

Attack3

Attack4

Attack5

Number of samples seen so far

12271

1202

5000

1500

7200

150

Majority

Minority

(a) Running statistics

Benign

Attack1

Attack2

Attack3

Attack4

Attack5

Memory distribution

270

270

270

270

270

150

(b) Memory distribution

Benign

Attack1

Attack2

Attack3

Attack4

Attack5

Memory distribution using CBRS

268

268

268

268

268

160

Replace

Annex

(c) CBRS

Benign

Attack1

Attack2

Attack3

Attack4

Attack5

Memory distribution using ECBRS

262

270

270

270

268

160

Replace

Intact

Annex

(d) ECBRS

3 Methodology

In this section, we present the proposed ECBRS and PAPA methods. In the ECBRS method, we adopt two definitions introduced in the base paper of CBRS [21]. They are full and largest classes. When a particular class contains the most instances among all the different classes in the memory,

we call it the largest . Two or more classes can be the largest if they have the same size. We call a class full if it currently is, or has been in one of the previous time steps, the largest class. Once a class becomes full, it remains so in the future. More details of the CBRS algorithm are given in the supplementary material (SM:A.14).

3.1 ECBRS: An Extended Class Balancing Reservoir Sampling Algorithm

The legacy CBRS algorithm assigns higher probability weights to minority class samples using a weighted replay approach. However, these weights are computed based on the number of data samples in the buffer memory (local information). This approach has a limitation when the class imbalance present between the minority classes themselves is severe. This limitation is illustrated in Figure 1, where running statistics of each class is the corresponding class running frequency(refer Figure 1a), and benign is the maximal (majority) class. Typically, the benign class samples must be chosen for replacement whenever new minority class samples arrive. However, CBRS treats all classes equally for a replacement to accommodate newly arrived attack5 (minority) class samples (instead of the benign class). This is because CBRS relies on local information for sample replacement. From Figure 1b, all class samples appear to be the majority classes in the buffer memory distribution. As a result, different class samples in memory are uniformly selected for sample replacement (refer Figure 1c, in which red-colored classes are chosen for sample replacement for accommodating newly arrived attack 5 class samples). This choice will have an adverse impact on large-scale training, where the class imbalance between the minority classes is significant. Motivated by this, we extended the CBRS to rely on each class's running statistics (global information) for replacement decisionmaking. Our method (ECBRS) will always prefer the class with higher global information until a threshold γ (refer Equation 1), later it will choose the class with the next highest running statistic value, thereby ensuring that a majority class sample is replaced in the memory buffer. In summary, we use original class labels to organize the buffer memory to learn SBCP and choose class samples in memory with higher running statistic values for the replacement to accommodate newly arriving samples.

Further, the class imbalance among minority classes poses another challenge known as the conflict of equal weights. It will occur whenever the majority (maximal) class samples are completely replaced

Algorithm 1 Memory population for ECBRS

Input: data stream: ( x i , y i ) n i =1 , number of currently stored instances of class (c ≡ y i ): m c , number of stream instances of class c ≡ y i encountered so far: n c for i = 1 to n do if memory is not filled then store ( x i , y i ); else if y i is not a full class then select a class that is the largest, having higher running statistics value and non-zero samples with m c ≥ γ ( c ) in the buffer. Otherwise, select a class with the next higher running statistic value with m c ≥ γ ( c ) ; overwrite the selected class sample with ( x i , y i ) ; else sample u ∼ Uniform(0,1); if u ≤ m c /n c then pick a stored instance of class c ≡ y i at random and replace it with ( x i , y i ) ; else Ignore ( x i , y i ); end if end if end if end for or underrepresented in the buffer memory. So, undermining the chosen minority class based on global information will lead to the loss of the essential samples in combating the class imbalance problem. This drawback can be mitigated by disallowing the undermining of the minority class beyond a certain threshold γ . In ECBRS method, we choose this parameter based on global information. Thus, we guarantee that attack class samples can never be replaced beyond this threshold. From Figure 1d, it can be observed that the proposed ECBRS initially chose benign class samples for replacements to accommodate newly arriving attack 5 class samples, as it has the highest running statistics value. In the process of sample replacement, once it reaches the threshold of the benign class ( γ ( . ) = 262), ECBRS selects the class with the next highest running static value ( attack 4). Thus remaining, different class samples (colored blue) will remain intact. We compute γ ( · ) (for class i ) as the expected number of samples to be present based on the global information, as shown in Equation 1.

m is the buffer memory capacity, γ ( i ) , n i are the threshold and running class frequency for class i , respectively, and w ( i ) is the weight associated with class i. w ( i ) is the softmax of the negative running

frequencies favoring the minority classes. In our experiments, we also observe that computing a single loss over the replayed and stream samples achieves better performance compared to CBRS (which involves computing two-component loss). One pragmatic reason for this behavior could be that concatenating replay samples with stream samples achieves better batch-wise class balance. We present the pseudo-code of the proposed ECBRS in Algorithm 1.

-30

-20

-10

0

10

20

-15

-10

-5

0

5

10

15

20

Regular SGD updates

Virtual SGD updates

(a) CICIDS-2017

-40

-30

-20

-10

0

10

20

30

40

-40

-20

0

20

40

Regular SGD updates

Virtual SGD updates

(b) CICIDS-2018

-30

-20

-10

0

10

20

-20

-10

0

10

20

Regular SGD updates

Virtual SGD updates

(c) CIFAR-10

-20

-10

0

10

20

30

-30

-20

-10

0

10

20

30

40

Regular SGD updates

Virtual SGD updates

(d) CLEAR-10

3.2 Perturbation Assistance for Parameter Approximation (PAPA)

Memory replay-based CL techniques such as MIR and GMED select a subset of samples from the buffer memory based on the loss incurred during virtual stochastic gradient descent (SGD) parameter (VSP) updates. Samples that incur a higher loss are preferred. These updates are computed using the current batch of the incoming stream samples. Further, these updates are ignored after the subset selection. For lengthy data streams (used to train very deep models), these frequent VSP updates result in significant computational overhead (due to SGD operations). Each SGD involves computing the gradients for larger weight matrices, leading to increased computational overhead.

0.05

0.04

0.03

0.02

0.01

0.00

0.01

0.02

0.03

0

20

40

60

80

0.10

0.05

0.00

0.05

0.10

0.15

0

5

10

15

20

25

0.10

0.08

0.06

0.04

0.02

0.00

0.02

0.04

0

10

20

30

40

50

60

(a) CICIDS2017

0.08

0.06

0.04

0.02

0.00

0.02

0.04

0

10

20

30

40

0.15

0.10

0.05

0.00

0.05

0

10

20

30

40

50

60

0.03

0.02

0.01

0.00

0.01

0.02

0

500

1000

1500

2000

2500

3000

3500

4000

(b) CICIDS2018

0.08

0.06

0.04

0.02

0.00

0.02

0.04

0

5

10

15

20

25

30

35

40

0.01

0.00

0.01

0.02

0.03

0.04

0.05

0.06

0

10

20

30

40

50

60

70

0.00

0.02

0.04

0.06

0.08

0.10

0

10

20

30

40

50

60

(c) CIFAR-10

0.03

0.02

0.01

0.00

0.01

0.02

0

10

20

30

40

50

60

70

0.03

0.02

0.01

0.00

0.01

0.02

0

20

40

60

80

100

120

140

0.02

0.01

0.00

0.01

0.02

0.03

0

10

20

30

40

(d) CLEAR-10

Motivated by this problem, we try to understand the relationship between the regular and virtual SGD update operations. Towards this, we plot various t-SNE visualizations on CICIDS2017, CICIDS-2018, CIFAR-10, and CLEAR10 datasets. The CIDIDS-2017 and CICIDS2018 datasets are used to train an MLP, and the CIFAR-10 and CLEAR-10 datasets are used to train a ResNet-18 model (refer Figure 2). We make the following observations from these plots: virtual SGD parameter update is a slowly varying process. In other words, the VSP overlaps with or is scattered closely around the regular SGD updates. One way to capture this notion is to sufficiently perturb the regular SGD parameter (RSP) updates to estimate the VSP updates. Then, the next question is: how to quantify the perturbation required for a given task?

To quantify the perturbation, we model the error (difference between the VSP and RSP) distribution of randomly chosen model parameters on a diverse set of benchmarks. These are shown in Figure 3. We observe that the error values of the chosen parameters exhibit a skewed Gaussian (heavy-tailed) distribution. We model this error distribution using a two-component Gaussian mixture model (GMM). However, modelling individual error components with a GMM is a time-consuming process. So, we model the joint distribution P (Θ e ) of error values of all the parameters using a GMM, whose marginals remain Gaussian. As a result, each parameterlevel error distribution is preserved.

Thus, our approach for approximating the VSP is mathematically formulated as a simple additive model which is given in Equation 2.

The perturbation Z is drawn from P (Θ e ) where P (Θ e ) = π 1 N (Θ 1 | µ 1 , Σ 1 ) + π 2 N (Θ 2 | µ 2 , Σ 2 ) , where µ 1 , µ 2 , are the mean vectors and Σ 1 , Σ 2 are the covariance matrices of the two Gaussian components, respectively. π 1 , π 2 are the mixing coefficients and Θ rpu is the most recent regular parameter update.

GMMTraining: We use the MIR algorithm for the first CL task in our proposed approach to estimate the error distribution (ED). This ED is used to train the GMM once, and this GMM is used in all remaining tasks. Our empirical study also confirms that different first task (used to construct ED) has no adverse effect on the performance results (refer to SM:A.10.2 ). The pseudo-code of the proposed PAPA method is outlined in Algorithm 2.

4 Experiments and Analysis

Algorithm 2 Perturbation assistance for parameter approximation

1: Input: data stream ( x i , y i ) n i =1 , initial task T 1 , maximally interfered retrieval algorithm MIR ( · ) , gaussian mixture model with two components GMM , buffer memory M , perturbation array P , policy to update buffer memory ρ , function approximator f ( x, y : Θ) , parameters after updating on previous batch of samples Θ rpu . 2: for the task T 1 do 3: sample batch B j ∼ T 1 4: render Θ j -1 ; parameters after updating on B j -1 5: Run MIR ( B j ) 6: store Θ j ; parameters after updating on B j 7: store (Θ j -Θ j -1 ) to P 8: end for 9: train a GMM using P 10: for remaining tasks do 11: sample batch B from current task 12: sample Z ∼ GMM 13: Θ vpu = Θ rpu + Z 14: S ← compute interfere samples using Θ vpu on M 15: B int ← subsample from S based on certain criteria 16: B new = B ∪ B int 17: train f ( · : Θ) with B new 18: update M with ρ using B 19: end for

Datasets and Tasks Formulation: We conduct the experiments in the domainincremental (class labels space is fixed to benign and attack, whereas data space horizon may change) learning approach, similar to the prior study [20]. We created tasks by dividing the benign data and combining them with attack class samples. This approach ensures that each task contains a mix of benign and attack data, maintaining the class imbalance resembling real-world network traffic. We created five tasks for KDDCUP'99 [25] and NSL-KDD [47], ten for CICIDS-2017/2018 [22, 48], nine for UNSW-NB [23, 49, 50, 51, 52], and ten for AnoShift [26] benchmark.

Existing network intrusion detection benchmarks are artificially created over short time periods and may not exhibit natural distribution shifts [13] (except AnoShift). Distribution shifts are quantified by the optimal transport dataset distance (OTDD) (refer to Table 2). Large OTDD values indicate a higher distribution shift. More details on how OTDD values are computed for each dataset are available in SM:A.7 . Due to the absence of distribution shifts in NIDS datasets, the proposed approaches were validated using computer vision (CV) CL benchmarks. Furthermore, the ease of visualizing distribution shifts makes CV benchmarks suitable for validating the proposed approaches. For CV benchmarks, we randomly selected one or more classes as the attack classes. We split and distributed the attack class data among the remaining benign classes. This way of class splitting ensures experiments formulated using vision benchmarks are identical to the intrusion detection experiments. Specifically, we created nine tasks for SVHN [27] and CIFAR-10 [28]. Similarly, we created ten tasks for the CIFAR-100 [28] benchmark using the coarse/super class labels. The data spanned over ten years for the CLEAR-10/100 [29] benchmark and contained all the classes' natural temporal evolution for each year. We created ten tasks as the data spans a decade. We also maintained 1:100 class imbalance ratio per task in CIFAR-100, CLEAR-10, and CLEAR-100 experiments. More details about datasets, preprocessing (and feature selection), and task formulations are presented in SM:A.4, SM:A.5 , and SM:A.6 .

Baselines: We compare the proposed ECBRS method with elastic weight consolidation (EWC) [41], synaptic intelligence (SI) [42] (regularization methods), memory(+gradient)-based algorithms like gradient episodic memory(GEM) [53], A-GEM [54], gradient-based sample selection (GSS-greedy) [55], and rehearsal-based methods like MIR [30], and CBRS [21]. We compare the proposed PAPA with the MIR algorithm in all facets. We deliberately omit partition reservoir sampling [45] and GMED [31]

as the former approach is designed for the multi-label classification setting, and example editing of the latter one is trivial for intrusion data. Additionally, we do not consider INSOMNIA [56], as this work does not operate in the explicit continual learning setup and relies on existing works to identify distribution shifts and pseudo-label generation.

Architecture details: The ResNet-18 [46] architecture (pre-trained on Imagenet) is used as the backbone for SVHN, CIFAR-10/100 and CLEAR-10/100, followed by a fully connected network. We use a multi-layer, fully connected network for the NID datasets. We use RMSProp optimizer for intrusion detection and SGD with Nesterov momentum 0.9 and weight decay 10 -4 for computer vision benchmarks, respectively. A batch size of 128 is used for MNIST, SVHN, CIFAR-10/100, 10 for CLEAR-10/100, and 1024 for the rest of the datasets except for NSL-KDD, for which it is 500. More details on batch size, architecture, hyperparameters, and implementation are presented in SM:A.11 .

Memory size ( M ): We use M =13333 for the CICIDS2017, 2018 and AnoShift datasets. For the KDDCUP'99 dataset, M =5333, and M =1333 for the NSL-KDD dataset. M =500 for the SVHN and CIFAR-10/100 datasets. For the CLEAR-10 dataset, M =666, and M =2666 for CLEAR-100 datasets. 75% of the buffer memory samples are used for replay. Additional details and an ablation study on M are presented in SM:A.10.2 .

Evaluation metrics: We chose metrics similar to [26, 15]. Specifically, we use the receiver operating characteristic area under the curve (ROC-AUC) metric and the precisionrecall area under the curve (PR-AUC) metric for both benign and attack data denoted as PR-AUC (B) and PR-AUC (A), respectively.

4.1 Quantitative analysis

ECBRS: We present the performance results of the proposed ECBRS algorithm and its comparison with the baselines on network intrusion detection and computer vision benchmarks in Table 3. We make the following observations. First, we observe that ECBRS either outperforms or is on par with all the baselines on all twelve benchmarks. Second, the performance results of the ECBRS are enhanced over CBRS when both benign and attack data exhibit frequent distribution shifts,

especially on AnoShift, SVHN, CIFAR-10, CIFAR-100, CLEAR-10, and CLEAR-100 benchmarks. Specifically, ECBRS achieves 7% (avg) and 3% (avg) performance gains in attack and benign sample detection in terms of PR-AUC (A) and PR-AUC (B) values relative to the CBRS on aforementioned benchmarks. Third, GEM, AGEM, and GSS-greedy methods strongly compete with our approach. Specifically, for GEM and A-GEM, the reason for this would be due to the usage of the ring buffer memory organization policy [57, 58] that stores task-wise representative samples, which are used to reduce CF of previous tasks [53, 54], thus allowing positive backward transfer by constraining directions of the gradient projections. However, such a buffer organization policy requires knowing task boundaries apriori. Despite their effectiveness, such a policy is inappropriate in an online task-free continual learning setting like streaming intrusion detection in which task boundaries and the number of tasks are unknown. On the contrary, our approach organizes the memory as a pool in which any memory slot can be chosen for replacement. Eventually, we observe that training time for larger datasets is high for gradient-based methods like GEM and GSS-greedy. As a result, we omit the most recent gradient-based memory replay methods like online corset selection (OCS) [59] in our baselines (refer to SM:A.10.1 for more details). Besides, ECBRS is an efficient algorithm with respect to total training time, and it outperforms CBRS in total training time on five benchmark datasets. More discussions on training times are available in SM:A.8 .

ECBRS as a memory population method: We can also integrate ECBRS as a memory population technique with other memory replay-based continual learning algorithms. Specifically, we demonstrate this for the MIR algorithm and observe an average performance gain of 12% and 14% in terms of PR-AUC (A) and PR-AUC (B) values relative to MIR. We observe that the performance gains of using ECBRS will increase with large-scale benchmarks, especially on AnoShift, CICIDS-2018, UNSW-NB15, and CICIDS-2017 benchmarks. We achieved an average gain of 30% (PR-AUC (A)) and 31% (PR-AUC (B)) on the aforementioned benchmarks. The results of the MIR+ECBRS algorithm (rows) are highlighted in light grey in Table 3. In the ECBRS experiments, we use the random memory population method for the MIR algorithm.

Threshold parameter ( γ ): As described earlier, we are also interested in learning the distribution shifts of the benign data. Since there are two distribution shifts to adapt to, one may wonder which one is more important. The answer depends on the problem context; intrusion detection requires paying more attention to the distribution shifts in attack traffic, which can be controlled using the hyperparameter w ( · ) . We conduct extensive experiments on intrusion detection and computer vision benchmarks to understand the behavior of setting the default value for the w ( · ) Equation 1. We found that all the datasets' performance is consistent for the lower w ( · ) value, so we used a fixed value of 0.1. Eventually, w ( · ) will be multiplied by the buffer memory size to obtain the expected number of samples per class ( γ ) to be present in the buffer memory. Ablation studies on γ (.) are presented in SM:A.10.1 .

PAPA: We present the results of the proposed PAPA algorithm and its comparison with the MIR algorithm in Table 4. In this set of experiments, we use ECBRS as a memory population algorithm for both MIR and PAPA algorithms. Results are presented in the non-decreasing order of their respective training times. Based on performance metrics, our evaluation of the benchmarks demonstrates PAPA as a replacement for a method like MIR, which uses numerous virtual SGD updates. From Table 4, it is also interesting to see that our approach's training time efficiency progresses with the dataset's size. Specifically, we note that PAPA achieves nearly 29%, 30%, 33%, 34%, and 40% scalable efficiency

on the CLEAR-100, AnoShift, CIFAR-100, CICIDS-2018 and CICIDS-2017 datasets, respectively. By scalable efficiency, we mean the total training time saved using the PAPA algorithm compared to the MIR method.

Virtual SGD parameter updates: Here, we present the core of the proposed PAPA algorithm in terms of the number of virtual stochastic gradient descent parameter updates. In Table 5, we present the results in the non-decreasing order of the size of the datasets and make the following observations. First, the number of virtual SGD operations in MIR increases with the size of the dataset. On the contrary, the number of these operations is reduced with the benchmark size in our proposed method. Second, the number of virtual SGD operations of the PAPA algorithm per benchmark is always fixed. The fixed number of virtual SGD operations in the PAPA is due to using the MIR algorithm only for the first task.

Ablation studies: We conduct various experiments as a part of ablation studies to validate the robustness of the proposed approaches. These include the effect of gradient-based sample selection instead of a random selection (refer to line 177) of the ECBRS performance, the effect of batch size and γ on ECBRS performance, robustness to different task orders on the PAPA algorithm, the effect of batch size and buffer memory size ( M ) on the PAPA algorithm. We present and discuss the results in SM:A.10 . Further, limitations of the proposed methods are discussed in SM:A.13 .

Additional experiments: We also validate the proposed approaches on the standard unsupervised anomaly detection (SMAP [60], SMD [61], and MSL [60]) benchmarks. Our findings on the supervised dataset are equally valid in this new set of experiments (refer to SM:A.9 ).

4.2 Impact of task similarity on virtual SGD updates

All the preceding discussions of the PAPA algorithm focus on leveraging the slowly varying parameter update process to approximate virtual SGD updates. Here, we explain the reason for the slowness in the virtual parameter updates using task similarity.

Specifically, we use optimal transport dataset distance (OTDD) [62] between two consecutive tasks to quantify the task similarity . Also, an error vector (with a dimension equal to the number of parameters in the model) whose entry 'i' is equal to the difference

10

(T1

, T 0

)

(T2

, T 1

)

(T3

, T 2

)

(T4

, T 3

)

(T5

, T 4

)

(T6

, T 5

)

(T7

, T 6

)

(T8

, T 7

)

Task pairs

0

2

4

6

8

OTDD (x2e 2 )

CIFAR10

MNIST+CIFAR10

T1-T0

T3-T2

T4-T3

T5-T4

T6-T5

T7-T6

T8-T7

Error vector of the tasks

0

2

4

6

8

l1 norm (x3e 7 )

CIFAR10

MNIST+CIFAR10

10

Figure 4: Illustration of the relationship between task similarity and slowness in the parameter update process of the MIR algorithm, using (a) optimal transport dataset distance and (b) visualization of parameter value shift using the l 1 -norm over the error vector.

in the parameter ( θ i ) value prior and after learning a particular task. We perform experiments to compute OTDD and l 1 -norm of the error vector over the MNIST and CIFAR-10 datasets. We create nine tasks in each of these experiments. We recall that a higher OTDD value signifies lower task similarity. The OTDD value is zero for all the consecutive tasks in the MNIST dataset and therefore ignored in this discussion.

In the second experiment, the tasks are formulated using the CIFAR-10 dataset. The third experiment creates a sequence of two tasks from the MNIST and CIFAR-10 datasets. From Figure 4a, we observe that the OTDD value is higher for the third experiment than the CIFAR-10 experiment. The reason for this behavior is evident since the consecutive tasks in the third experiment learn from two dissimilar datasets. We discover similar behavior in the error vector in which l 1 -norm over the error vector of the third experiment exhibits a zig-zag pattern in Figure 4b. In other words, parameter values go back and forth between two dissimilar tasks. Further, we provided detailed empirical analysis to showcase that the modelling error distribution of the first task using the Gaussian mixture model is sufficient and useful to approximate error distributions of the subsequent tasks. In other words, the occurrence of two dissimilar tasks resulting in different error distributions that can't be modelled by PAPA is rare in the context of NID, as demonstrated in SM:A.12 . To conclude, assuming overparameterized models, parameter value shifts between the regular SGD and virtual SGD update are low, given the sequence of similar tasks.

5 Conclusions and Future Work

In this work, we improved the performance of online memory replay-based CL approaches for network intrusion detection while addressing class imbalance and scalability issues. Specifically, we focused on two popular algorithms viz., CBRS and MIR. The CBRS algorithm is extended (that we call ECBRS) using global information that helps it to maintain accurate class imbalance information. We showed that ECBRS outperforms all the baselines, including CBRS, by maintaining higher minority class samples in the buffer memory. Furthermore, ECBRS is also efficient in terms of the training time incurred as compared to the baselines. We proposed a simple perturbation-assisted parameter approximation (PAPA) method for virtual parameter updation in the MIR algorithm that helps significantly reduce the number of SGD update operations. The efficacy and scalability of these augmentation strategies have been demonstrated on standard network intrusion detection, computer vision, and anomaly detection datasets. In summary, the proposed augmentations to online memory replay-based CL approaches achieved improved performance using fewer computations and thereby at a lower training cost.

As a part of future work, we plan to extend the supervised binary classification setting of the network intrusion detection problem to a supervised multi-class classification problem. Furthermore, we are interested in exploring the semi-supervised techniques for intrusion detection to understand the challenges in the context of class imbalance and distribution shifts in conjunction with open-world learning, explainability, and adversarial robustness settings.

Acknowledgments and Disclosure of Funding

Weextend our appreciation to Aman Panwar and Shreya Kumar, both are undergrads at IIT Hyderabad, for their meaningful contributions during the rebuttal period. Additionally, our gratitude goes out to our former undergrads Akash Tadawai, Reetu Vinta, and Thushara Tippireddy, who played instrumental roles in shaping this work during its initial phases. Finally, we express our sincere thanks to all the anonymous reviewers for their constructive feedback and invaluable suggestions which helped a lot in improving this work. SKA thanks Google for the generous travel grant and the Ministry of Education, Government of India, for the financial support.

References

Sebastian Thrun. A lifelong learning perspective for mobile robot control. In Proceedings of IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS'94) , pages 23-30, 1994.

Bing Liu. Lifelong machine learning: a paradigm for continuous learning. Frontiers of Computer Science , 11(3):359-361, 2017.

German I Parisi, Ronald Kemker, Jose L Part, Christopher Kanan, and Stefan Wermter. Continual lifelong learning with neural networks: A review. Neural Networks , 113:54-71, 2019.

Michael McCloskey and Neal J Cohen. Catastrophic interference in connectionist networks: The sequential learning problem. In Psychology of learning and motivation , volume 24, pages 109-165. Elsevier, 1989.

Matthias De Lange, Rahaf Aljundi, Marc Masana, Sarah Parisot, Xu Jia, Aleš Leonardis, Gregory Slabaugh, and Tinne Tuytelaars. A continual learning survey: Defying forgetting in classification tasks. IEEE Transactions on Pattern Analysis and Machine Intelligence , 44(7):3366-3385, 2022.

Haoxuan Qu, Hossein Rahmani, Li Xu, Bryan Williams, and Jun Liu. Recent advances of continual learning in computer vision: An overview. arXiv preprint arXiv:2109.11369 , 2021.

Zheda Mai, Ruiwen Li, Jihwan Jeong, David Quispe, Hyunwoo Kim, and Scott Sanner. Online continual learning in image classification: An empirical survey. Neurocomputing , 469:28-51, 2022.

Angelo G Menezes, Gustavo de Moura, Cézanne Alves, and André CPLF de Carvalho. Continual object detection: A review of definitions, strategies, and challenges. arXiv preprint arXiv:2205.15445 , 2022.

Magdalena Biesialska, Katarzyna Biesialska, and Marta R Costa-Jussa. Continual lifelong learning in natural language processing: A survey. arXiv preprint arXiv:2012.09823 , 2020.

Zixuan Ke and Bing Liu. Continual learning of natural language processing tasks: A survey. arXiv preprint arXiv:2211.12701 , 2022.

Samik Sadhu and Hynek Hermansky. Continual learning in automatic speech recognition. In Procedding of Interspeech , pages 1246-1250, 2020.

Muqiao Yang, Ian Lane, and Shinji Watanabe. Online continual learning of end-to-end speech recognition models. arXiv preprint arXiv:2207.05071 , 2022.

Marius Dragoi, Elena Burceanu, Emanuela Haller, Andrei Manolache, and Florin Brad. Anoshift: A distribution shift benchmark for unsupervised anomaly detection. In Proceeding of 36th Conference on Neural Information Processing Systems (NeurIPS 2022) , pages 32854-32867, 2022.

Dongqi Han, Zhiliang Wang, Wenqi Chen, Kai Wang, Rui Yu, Su Wang, Han Zhang, Zhihua Wang, Minghui Jin, and Jiahai et al. Yang. Anomaly detection in the open world: Normality shift detection, explanation, and adaptation. In Proceeding of Network and Distributed System Security Symposium (NDSS 2023) .

Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, and Konrad Rieck. Dos and don'ts of machine learning in computer security. In Proceeding of 31st USENIX Security Symposium (USENIX Security) , 2022.

Min Du, Zhi Chen, Chang Liu, Rajvardhan Oak, and Dawn Song. Lifelong anomaly detection through unlearning. In Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security , pages 1283-1297, 2019.

Charu C Aggarwal. An introduction to outlier analysis . Springer, 2017.

Lisa Liu, Gints Engelen, Timothy Lynar, Daryl Essam, and Wouter Joosen. Error prevalence in nids datasets: A case study on cic-ids-2017 and cse-cic-ids-2018. In Proceedings of IEEE Conference on Communications and Network Security (CNS 2022) , pages 254-262, 2022.

Rahaf Aljundi, Klaas Kelchtermans, and Tinne Tuytelaars. Task-free continual learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 11254-11263, 2019.

Suresh Kumar Amalapuram, Akash Tadwai, Reethu Vinta, Sumohana S. Channappayya, and Bheemarjuna Reddy Tamma. Continual learning for anomaly based network intrusion detection. In Proceedings of International Conference on COMmunication Systems NETworkS (COMSNETS 2022) , pages 497-505, 2022.

Aristotelis Chrysakis and Marie-Francine Moens. Online continual learning from imbalanced data. In Proceeding of International Conference on Machine Learning , pages 1952-1961. PMLR, 2020.

Iman Sharafaldin, Arash Habibi Lashkari, and Ali A Ghorbani. Toward generating a new intrusion detection dataset and intrusion traffic characterization. In Proceedings of the 4th International Conference on Information Systems Security and Privacy (ICISSP 2018) , pages 108-116, 2018.

Nour Moustafa and Jill Slay. Unsw-nb15: a comprehensive data set for network intrusion detection systems (unsw-nb15 network data set). In Proceeding of Military Communications and Information Systems Conference (MilCIS) , pages 1-6, 2015.

Sebastian Garcia, Martin Grill, Jan Stiborek, and Alejandro Zunino. An empirical comparison of botnet detection methods. Computers & Security , 45:100-123, 2014.

Mahbod Tavallaee, Ebrahim Bagheri, Wei Lu, and Ali A Ghorbani. A detailed analysis of the kdd cup 99 dataset. In Proceedings of IEEE symposium on computational intelligence for security and defense applications , pages 1-6. IEEE, 2009.

Marius Dr˘ agoi, Elena Burceanu, Emanuela Haller, Andrei Manolache, and Florin Brad. Anoshift: A distribution shift benchmark for unsupervised anomaly detection. arXiv preprint arXiv:2206.15476 , 2022.

Netzer Yuval. Reading digits in natural images with unsupervised feature learning. In Proceedings of the NIPS Workshop on Deep Learning and Unsupervised Feature Learning , 2011.

A. Krizhevsky. Learning multiple layers of features from tiny images. Master's Thesis, University of Toronto , 2009.

Zhiqiu Lin, Jia Shi, Deepak Pathak, and Deva Ramanan. The clear benchmark: Continual learning on real-world imagery. In Proceeding of 35th Conference on Neural Information Processing Systems Datasets and Benchmarks Track , 2021.

Rahaf Aljundi, Eugene Belilovsky, Tinne Tuytelaars, Laurent Charlin, Massimo Caccia, Min Lin, and Lucas Page-Caccia. Online continual learning with maximal interfered retrieval. In Proceeding of 33rd Conference on Neural Information Processing Systems (NeurIPS 2019) , 2019.

Xisen Jin, Arka Sadhu, Junyi Du, and Xiang Ren. Gradient-based editing of memory examples for online task-free continual learning. In Proceeding of 34th Conference on Neural Information Processing Systems (NeurIPS 2021) , 2021.

Stephen E Smaha. Haystack: An intrusion detection system. In Fourth Aerospace Computer Security Applications Conference , volume 44. Orlando, FL, USA, 1988.

Varun Chandola, Arindam Banerjee, and Vipin Kumar. Anomaly detection: A survey. ACM Comput. Surv. , 41(3), jul 2009.

Hung-Jen Liao, Chun-Hung Richard Lin, Ying-Chih Lin, and Kuang-Yuan Tung. Intrusion detection system: A comprehensive review. Journal of Network and Computer Applications , 36(1):16-24, 2013.

Sang-Woong Lee, Mokhtar Mohammadi, Shima Rashidi, Amir Masoud Rahmani, Mohammad Masdari, Mehdi Hosseinzadeh, et al. Towards secure intrusion detection systems using deep learning techniques: Comprehensive analysis and review. Journal of Network and Computer Applications , 187:103111, 2021.

Ankush Singla and Elisa Bertino. How deep learning is making information security more intelligent. IEEE Security & Privacy , 17(3):56-65, 2019.

David A Cieslak, Nitesh V Chawla, and Aaron Striegel. Combating imbalance in network intrusion datasets. In Proeeding of IEEE International Conference on Granular Computing , pages 732-737, 2006.

Nitesh V Chawla, Kevin W Bowyer, Lawrence O Hall, and W Philip Kegelmeyer. Smote: synthetic minority over-sampling technique. Journal of artificial intelligence research , 16:321357, 2002.

Sotiris Kotsiantis, Dimitris Kanellopoulos, Panayiotis Pintelas, et al. Handling imbalanced datasets: A review. GESTS international transactions on computer science and engineering , 30(1):25-36, 2006.

Charles X Ling and Victor S Sheng. Cost-sensitive learning and the class imbalance problem. Encyclopedia of machine learning , 2011:231-235, 2008.

James Kirkpatrick, Razvan Pascanu, Neil Rabinowitz, Joel Veness, Guillaume Desjardins, Andrei A Rusu, Kieran Milan, John Quan, Tiago Ramalho, Agnieszka Grabska-Barwinska, et al. Overcoming catastrophic forgetting in neural networks. Proceedings of the national academy of sciences , 114(13):3521-3526, 2017.

Friedemann Zenke, Ben Poole, and Surya Ganguli. Continual learning through synaptic intelligence. In Proceeding of International Conference on Machine Learning , pages 39873995. PMLR, 2017.

Andrei A Rusu, Neil C Rabinowitz, Guillaume Desjardins, Hubert Soyer, James Kirkpatrick, Koray Kavukcuoglu, Razvan Pascanu, and Raia Hadsell. Progressive neural networks. arXiv preprint arXiv:1606.04671 , 2016.

Joseph KJ and Vineeth N Balasubramanian. Meta-consolidation for continual learning. Advances in Neural Information Processing Systems , 33:14374-14386, 2020.

Chris Dongjoo Kim, Jinseo Jeong, and Gunhee Kim. Imbalanced continual learning with partitioning reservoir sampling. In Proceeding of European Conference on Computer Vision , pages 411-428. Springer, 2020.

Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of IEEE conference on computer vision and pattern recognition , pages 770-778, 2016.

L Dhanabal and SP Shantharajah. A study on nsl-kdd dataset for intrusion detection system based on classification algorithms. International journal of advanced research in computer and communication engineering , 4(6):446-452, 2015.

Iman Sharafaldin, Arash Habibi Lashkari, and Ali A Ghorbani. A Realistic Cyber Defense Dataset (CSE-CIC-IDS2018) , 2018. https://registry.opendata.aws/ cse-cic-ids2018/ [Accessed: April,2023].

Nour Moustafa and Jill Slay. The evaluation of network anomaly detection systems: Statistical analysis of the unsw-nb15 data set and the comparison with the kdd99 data set. Information Security Journal: A Global Perspective , 25(1-3):18-31, 2016.

Nour Moustafa, Jill Slay, and Gideon Creech. Novel geometric area analysis technique for anomaly detection using trapezoidal area estimation on large-scale networks. IEEE Transactions on Big Data , 5(4):481-494, 2017.

Nour Moustafa, Gideon Creech, and Jill Slay. Big data analytics for intrusion detection system: Statistical decision-making using finite dirichlet mixture models. In Data analytics and decision support for cybersecurity , pages 127-156. Springer, 2017.

Mohanad Sarhan, Siamak Layeghy, Nour Moustafa, and Marius Portmann. Netflow datasets for machine learning-based network intrusion detection systems. In Big Data Technologies and Applications , pages 117-135. Springer, 2020.

David Lopez-Paz and Marc'Aurelio Ranzato. Gradient episodic memory for continual learning. In Proceedings of 31st Conference on Neural Information Processing Systems (NIPS 2017) , 2017.

Arslan Chaudhry, Marc'Aurelio Ranzato, Marcus Rohrbach, and Mohamed Elhoseiny. Efficient lifelong learning with a-gem. arXiv preprint arXiv:1812.00420 , 2018.

Rahaf Aljundi, Min Lin, Baptiste Goujaud, and Yoshua Bengio. Gradient based sample selection for online continual learning. In Proceeding of 33rd Conference on Neural Information Processing Systems (NeurIPS 2019) , 2019.

Giuseppina Andresini, Feargus Pendlebury, Fabio Pierazzi, Corrado Loglisci, Annalisa Appice, and Lorenzo Cavallaro. Insomnia: Towards concept-drift robustness in network intrusion detection. In Proceedings of the 14th ACM workshop on artificial intelligence and security , pages 111-122, 2021.

Arslan Chaudhry, Marcus Rohrbach, Mohamed Elhoseiny, Thalaiyasingam Ajanthan, Puneet K Dokania, Philip HS Torr, and Marc'Aurelio Ranzato. On tiny episodic memories in continual learning. arXiv preprint arXiv:1902.10486 , 2019.

Pietro Buzzega, Matteo Boschini, Angelo Porrello, and Simone Calderara. Rethinking experience replay: a bag of tricks for continual learning. In Proceedings of 25th International Conference on Pattern Recognition (ICPR) , pages 2180-2187. IEEE, 2021.

Jaehong Yoon, Divyam Madaan, Eunho Yang, and Sung Ju Hwang. Online coreset selection for rehearsal-based continual learning. In Proceeding of International Conference on Learning Representations (ICLR 2022) . International Conference on Learning Representations, ICLR, 2022.

Kyle Hundman, Valentino Constantinou, Christopher Laporte, Ian Colwell, and Tom Soderstrom. Detecting spacecraft anomalies using lstms and nonparametric dynamic thresholding. In Proceedings of the 24th ACM SIGKDD international conference on knowledge discovery & data mining , pages 387-395, 2018.

Ya Su, Youjian Zhao, Chenhao Niu, Rong Liu, Wei Sun, and Dan Pei. Robust anomaly detection for multivariate time series through stochastic recurrent neural network. In Proceedings of the 25th ACM SIGKDD international conference on knowledge discovery & data mining , pages 2828-2837, 2019.

David Alvarez-Melis and Nicolo Fusi. Geometric dataset distances via optimal transport. pages 21428-21439, 2020.

Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper considers the application of deep learning (DL) for network intrusion detection systems (NIDS). The paper correctly points out that, in real contexts, NIDS must be continously updated with new data-points to mitigate the impact of \"concept drift\". A way to do so is by employing \"continual learning\" (CL) methods---which, unfortunately, are affected by many issues which the paper seeks to address.\nSpecifically, the main contribution is a novel approach to deal with (i) class-imbalance problems leading to \"catatrophic forgetting\" (CF); and (ii) the computational overhead deriving from ways to mitigate CF. These contributions, whose intuitions are based on empirical evidence, are experimentally assessed on many datasets. The results show a good improvement over the baselines.\n\nSTRENGTHS:\n+ Relevant problem\n+ Large evaluation\n+ Good results\n+ (somewhat) theoretically grounded\n+ Multiple repetitions\n+ Good quality of writing\n+ The supplementary material is rich with details\n\nThe paper addresses a relevant problem within the machine learning (ML) domain, which has received only limited attention in the specific context of network intrusion detection (NID). The proposed methods are theoretically grounded (especially Section 3.1), and the findings are derived by a large sets of experiments carried out on various datasets (which are not limited to NID data) and considering many baselines. The conclusions are drawn by repeating the experiments 5 times, increasing the overall soundness of the results---showing a substantial improvements over the baselines.\n\nWEAKNESSES:\n## High Level\n\n- Inappropriate datasets\n- (somewhat) confusing theoretical arguments \n- Bold assumptions\n- (risk of) data snooping\n- (some) missing details\n\n## Low Level (and suggestions)\n\nBelow is an extended description of the abovementioned weaknesses. I will also provide some actionable means to rectify such issues, as well as abundant references that can be used to improve this paper and/or support some of my critiques. \n\n### Inappropriate datasets\n\nThis is by far the biggest concern I have with the paper: the data used as basis for the experiments is inappropriate to test the hypothesis and provide a _convincing_ answer. Let me explain.\n\nFirst, the paper deals with the problem of NID. As such, _any finding that derives on data that does not pertain to NID is redundant_. This automatically makes all the evaluations carried out on, e.g., on CIFAR, SVHN, CLEAR to be of zero-value to the NID community (do note that a recent paper [D] highlighted that many papers on security problems carry out evaluations on data that does not reflect a security context, leading to skepticism by practitioners). I acknowledge that these datasets were added due to some limitations of (some) existing datasets for NID, but this is not an acceptable reason: if the authors were better aware of the NID context, they would know that there are (publicly available) datasets that allow a better representation of a real CL scenario. (more on this below).\n\nSecond, among the chosen NID datasets, there is the NSL-KDD and KDD Cup'99. These datasets are well-known to be flawed [C]; furthermore, they are also almost 25 years old, and the security community does not find them to be of any interest from a practical viewpoint [B, I]. Hence, even these experiments do not allow to provide a convincing argument in favor of the paper's conclusions.\n\nThird, the NID datasets also include the CIC-IDS17 and its enhanced variant, the CIC-IDS18. Unfortunately, also these two datasets are flawed [G, H]. Note that [G] came out in 2021, and it has already been well-received by the NID community (e.g., [A, F]), so it is concerning that this paper (which has been submitted to a top-venue such as NeurIPS) performs the experiments on the \"flawed\" variant of these two datasets---especially given that a \"fixed\" version exists (provided both in [G] and [H]). In short, these experiments are questionable; plus, what is even more questionable is that CIC-IDS17 and CIC-IDS18 are used to derive some observations that motivate the theoretical design of the proposed method.\n\nFourth, overlooking the previous two points, all the NID datasets span over a very short period of time, and do not enable any assessment that can be used to test \"time-aware\" applications of machine learning-based NIDS [F] -- or, at least, do so in a way that is appropriate for NeurIPS. The only exception could, potentially, be ANONIDS: however, such a dataset contains data-points from different networks, which raises many concerns [S, O]. Hence, even this dataset has dubious utility for the problem at hand.\nThe way to circumvent all these issues is not to use \"image datasets\", but rather to use NID datasets captured (i) over a long period of time and (ii) in the same network: _such datasets **exist**_, and a prominent example is the MCP dataset, which is built upon the well-known CTU13 dataset (see [J,K]). \n\nTo summarize: all the experiments carried out in the paper are performed on datasets that are inappropriate to test the underlying hypothesis without there being a sensible reason to do so.\n\n### Bold Assumptions\n\nThis is a \"pragmatic\" weakness, which does not invalidate the paper, but significantly limits its real-world relevance.\n\nPut simply, the paper proposes a method that is rooted in the application of \"deep learning\" (DL) for NID. The problem, however, is that real developers of ML-NIDS are very skeptical of DL in NID [L]. The reasons are many, but at the basis of this is that they are hardly explainable [M], but also that they are outperformed by \"traditional\" machine learning approaches (assuming that they can be applied). For example, [E] shows that multi-layer perceptrons are inferior to a random forest from a detection-performance perspective. Moreover, [B] reveals that fine-tuning a DL method requires months of data. Finally, the recent [F] shows that training \"shallow\" methods (such as decision trees) is very short. Note that [F] uses similar datasets as the ones used in this paper: to give some context, training a binary classifier using a decision tree on UNSW-NB15 requires less than 5s, whereas the MLP used in this paper requires 350s (looking at Table 3) -- and the experiments done in this paper entail much better hardware.\n\nIn light of this, it is questionable whether the proposed method has any relevance in reality. Yes, perhaps it provides some advantages -- but if the price of such advantages is an unacceptably high training time (which the method itself seeks to reduce) then the overall contribution of this paper to the state-of-the-art is low.\n\nTo address this issue, I invite the authors to include also \"shallow\" methods that do not entail (deep) neural networks, and show that the proposed method allows the resulting architectures to achieve a comparable degree of performance of \"shallow\" methods.\n\n\nNotwithstanding, there is another \"bold assumption\" made in the paper: the fact that the \"malicious classes\" are going to remain stable. Indeed (to the best of my understanding), the paper seeks to analyze the effect of distribution shift of the \"benign\" samples (this is explicitly stated in the introduction), and the set of malicious classes is always known beforehand. This is quite unrealistic (and it had been known since [O]), and may further decrease the value of the proposed method in practice: what would happen in case a new \"unknown\" attack appears, and is then assigned a \"new\" label? \n\nOn this note, the other \"practical\" limitation is that the paper assumes that there will be an influx of (correctly labelled) samples that are fed into the system. How is this done in practice? Abundant work (see [N] for a summary) pointed out that doing this is expensive, and especially so in NID context. As a matter of fact, what is not shown in the paper is a clear \"use-case\" that depicts how the system is designed to be deployed in practice: without such a schematic, it is difficult to determine if the proposed method is even \"conceivable\" to be deployed into real systems (as also highlighted in [F], practitioners are very interested in the \"system infrastructure\" envisioned in research papers). Note that I did look in the supplementary material, but the \"schematic\" provided in Figure 3 does not allow to answer my doubts: the \"continual learning module\" appears to be a \"black-box\" that receives its inputs from a \"training dataset\". However, how is such training data collected (given that we are in an \"continual learning\" setting)? The way I see it, it requires an enormous amount of manual effort.  \n\n\n### (somewhat) confusing technical arguments\n\nWhile I had no issues in understanding the rationale of Section 3.1 (aside from the following unclear sentence ```In our approach, we choose this parameter based on global information.```), I found that the description of Section 3.2 to be lacking in terms of clarity and soundness. Setting aside that the experiments are based on \"inappropriate\" datasets, I did not find compelling evidence of ```virtual SGD parameter update is a slowly varying process.``` -- and this may be due to Figure 3 not being introduced in any way (e.g., what do the x and y axis report? what is the line? the y-axis is also not uniform).\n\nI also did not find the \"motivation\" (mentioned in the Introduction) that leads up to Section 3.2 to be clear. To my understanding, the problem is that the implementation of memory-replay techniques is expensive from a computational perspective---but is this really the case for NID? As I mentioned above, \"shallow\" methods are much faster to train.\n\nAlso, at the end of the Introduction it stated that ```[PAPA] lead[s] to improved scalability.```. What does this mean? The key-term is \"scalability\". I do not see any evidence in Section 3.2 that makes me believe that PAPA leads to better scalability. I invite reading [P, Q].\n\n\n### Potential Data Snooping\n\nI have reason to believe that the methodology followed in the paper is affected by the \"data snooping\" problem [15]. In other words: the proposed method is designed in a way that would not be typically \"known\" in advance.\n\nThis is epitomized by Section 3.2, wherein some conclusions are drawn by analyzing CIC-IDS18 (and CIFAR), and then used to develop the proposed methodology. At the same time, this is also likely to be present in the experimental setup:\n\n> The intuition behind the memory size is to store nearly 1% of the total training sample of the benchmark dataset in the buffer memory, and 75% of the buffer memory samples will be used for replay.\n\nThe point is that a real developer has no clue about the size of the \"training dataset\": in real settings, an organization will collect some training data, and then use it to train a model; however, they would not know \"how much data will appear in the future\". It is possible to address this later issue by assuming a \"fixed amount\" (e.g., 1000 samples) which does not depend on the size og a given benchmark (this is what is done, e.g., in [N]). \n\n\n### Some additional issues:\n\n* In the caption of Figure 1, it is not stated what \"m\" refers to\n* Bad formatting on Page 6 (the text overlaps with Algorithm 2)\n* Also about formatting: tables and figures (and their captions) are almost impossible to discern from the text itself. I think the authors played too much with margins.\n* Given the importance of hardware in determining the runtime [F], the main paper should include also details on the experimental platform.\n* There is an excessive usage of acronyms in the paper. For instance, SBCP occurs only 3 times (and is strikingly similar to CBRS). Also, MR and MIR are very similar in how they appear, but they denote different concepts. HIDS is also redundant. \n* Reference [14] is incomplete\n* In Section 3.1, I had a hard time distinguishing between terms such as \"maximal\", \"majority\", \"full\", \"largest.\"\n* The \"Limitations\" are only mentioned in the supplementary material\n* The features used to train the models are not mentioned (I found such a lack to be surprising given that the paper cites [15]). Some network features have been demonstrated to be redundant for the sake of NID classification (see [G, H, S]), and not mentioning them casts doubts on the experiments done in the paper. Note that I did not find any mentioning of these also in the supplementary material\n* I was surprised of not finding [A] among the cited works, and especially among the \"comparison\" methods, given that it considers a very similar problem (and is also evaluated on the --fixed-- CIC-IDS17)\n* Please report the size of the training / test data. I couldn't find a clear mention of this in the experimental section (note that this is a well-known problem in related literature [N]). \n* The \"bread and butter\" of CL is that the performance should be measured \"over-time\". However, given the way the experiments are designed (at least based on how the results are presented), I cannot understand if this is truly the case. \n\nThe following is a list of paragraphs in the text for which I have concerns:\n\n> NIDS must evolve continuously and effortlessly learn from the limited novel attack data.\n\nWhat does \"limited novel attack data\" mean? How is such \"novelty\" determined?\n\n> Furthermore, formulating NID as a supervised binary classification problem (SBCP) will be helpful in differentiating out-of-distribution normal samples from known intrusions well.\n\nIsn't this the de-facto standard in many NIDS evaluations? I think this statement is redundant.\n\n> (e.g., the difference between the number of samples of the minority classes DDOS attack-HOIC and SQL Injection of the CICIDS-2018 [18] dataset is 0.68 million).\n\nUnclear.\n\n> However, this strategy has a pitfall when the count of minority class samples in the finite buffer memory appears to come from a majority class.\n\nUnclear. Plus, what does such \"pitfall\" lead to?\n\n> making our approach suitable for large-scale training.\n\nWhat does this mean? Plus, is this a problem in NID?\n\n> Typically, the benign class samples must be chosen for replacement whenever new minority class samples arrive.\n\nDefine \"typically\". Is it \"typical\" in research? Is it typical \"in practice\"? On what grounds is this statement made?\n\n> we use original class labels to organize the buffer memory to learn SBCP and chose class samples in memory with higher running statistic values for the replacement to accommodate newly arriving samples.\n\nThis statement is clear, but it contrasts with the underlying assumption of seeing NID as a binary classification problem. Indeed, providing (accurate) fine-grained attack labels is a tough problem in NID [N, R].\n\n> This ensured that each task contained a mix of benign and attack data, maintaining the class imbalance resembling real-world network traffic.\n\nHow is the \"resemblance\" achieved?\n\n> We created five tasks for KD249 DCUP’99 [22] and NSL-KDD [49], ten 250 for CICIDS-2017/2018 [18, 50], nine for UNSW-NB [24, 51, 52, 53, 54], and ten for ANOSHIFT [25] benchmark contains naturally occurring distribution shifts spanning over ten years of network traffic.\n\nThe last sentence does not connect with the previous ones.\n\n> We use M=13333 for CICIDS-2017/2018, Anoshift, 5333/1333 for KDDCUP’99/NSL-KDD, 500 for SVHN, CIFAR-10/100 and 666/2666 for CLEAR-10/100.\n\nI do not understand why the first settings have only \"M\", and the others have two numbers.\n\n### EXTERNAL REFERENCES\n\n[A]: Andresini, Giuseppina, et al. \"INSOMNIA: towards concept-drift robustness in network intrusion detection.\" Proceedings of the 14th ACM workshop on artificial intelligence and security. 2021.\n\n[B]: Apruzzese, Giovanni, et al. \"The role of machine learning in cybersecurity.\" Digital Threats: Research and Practice 4.1 (2023): 1-38.\n\n[C]: Kim, Daniel E., and Mikhail Gofman. \"Comparison of shallow and deep neural networks for network intrusion detection.\" 2018 IEEE 8th Annual Computing and Communication Workshop and Conference (CCWC). IEEE, 2018.\n\n[D]: Apruzzese, Giovanni, et al. \"“Real Attackers Don't Compute Gradients”: Bridging the Gap Between Adversarial ML Research and Practice.\" 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML). IEEE, 2023.\n\n[E]: Pontes, Camila FT, et al. \"A new method for flow-based network intrusion detection using the inverse Potts model.\" IEEE Transactions on Network and Service Management 18.2 (2021): 1125-1136.\n\n[F]: Apruzzese, Giovanni, Pavel Laskov, and Johannes Schneider. \"SoK: Pragmatic Assessment of Machine Learning for Network Intrusion Detection.\" IEEE EuroS&P (2023).\n\n[G]: Liu, Lisa, et al. \"Error Prevalence in NIDS datasets: A Case Study on CIC-IDS-2017 and CSE-CIC-IDS-2018.\" 2022 IEEE Conference on Communications and Network Security (CNS). IEEE, 2022.\n\n[H]: Engelen, Gints, Vera Rimmer, and Wouter Joosen. \"Troubleshooting an intrusion detection dataset: the CICIDS2017 case study.\" 2021 IEEE Security and Privacy Workshops (SPW). IEEE, 2021.\n\n[I]: Silva, João Vitor Valle, Martin Andreoni Lopez, and Diogo MF Mattos. \"Attackers are not stealthy: Statistical analysis of the well-known and infamous kdd network security dataset.\" 2020 4th Conference on Cloud and Internet of Things (CIoT). IEEE, 2020.\n\n[J]: Dietz, Christian, et al. \"DMEF: Dynamic Malware Evaluation Framework.\" NOMS 2022-2022 IEEE/IFIP Network Operations and Management Symposium. IEEE, 2022.\n\n[K]: Venturi, Andrea, et al. \"Drelab-deep reinforcement learning adversarial botnet: A benchmark dataset for adversarial attacks against botnet intrusion detection systems.\" Data in Brief 34 (2021): 106631.\n\n[L]: De Shon, Markus. \"Information Security Analysis as Data Fusion.\" 2019 22th International Conference on Information Fusion (FUSION). IEEE, 2019.\n\n[M]: Jacobs, Arthur S., et al. \"AI/ML for Network Security: The Emperor has no Clothes.\" Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security. 2022.\n\n[N]: Apruzzese, Giovanni, Pavel Laskov, and Aliya Tastemirova. \"SoK: The impact of unlabelled data in cyberthreat detection.\" 2022 IEEE 7th European Symposium on Security and Privacy (EuroS&P). IEEE, 2022.\n\n[O]: Sommer, Robin, and Vern Paxson. \"Outside the closed world: On using machine learning for network intrusion detection.\" 2010 IEEE symposium on security and privacy. IEEE, 2010.\n\n[P]: Hill, Mark D. \"What is scalability?.\" ACM SIGARCH Computer Architecture News 18.4 (1990): 18-21.\n\n[Q]: Luke, Edward A. \"Defining and measuring scalability.\" Proceedings of Scalable Parallel Libraries Conference. IEEE, 1993.\n\n[R]: Van Ede, Thijs, et al. \"Deepcase: Semi-supervised contextual analysis of security events.\" 2022 IEEE Symposium on Security and Privacy (SP). IEEE, 2022.\n\n[S]: Apruzzese, Giovanni, Luca Pajola, and Mauro Conti. \"The cross-evaluation of machine learning-based network intrusion detection systems.\" IEEE Transactions on Network and Service Management (2022).\n\n[T]: Pendlebury, Feargus, et al. \"TESSERACT: Eliminating experimental bias in malware classification across space and time.\" Proceedings of the 28th USENIX Security Symposium. USENIX Association, 2019.\n\nQUESTIONS:\nI thank the authors for carrying out the research discussed in this paper. Ultimately, I **really** liked the paper: the research direction is crucial, the proposed methodology is \"sensible\", the evaluation is massive and (on the surface) rigorous. However -- as discussed in my review -- I have some doubts on the \"practical\" effectiveness of the proposed method. \n\nBelow is a set of questions that I invite the authors to answer. I must stress that my goal, here, is to assist the authors in realizing a work that is \"outstanding\": given the effort put by the authors in this submission, I have reason to believe that the authors are capable of this.\n\n* Q1) What is the envisioned system infrastructure in which the proposed method is meant to be deployed?\n* Q2) Can the authors, in the (short) timespan allotted for NeurIPS'23 review process, carry out additional experiments on a better dataset? (see my review)\n* Q3) Can you explain Figure 3 in detail?\n* Q4) What features are analyzed by the NIDS models?\n* Q5) Please provide convincing arguments that the paper is not affected by data-snooping -- and, if this is not the case, then provide feasible ways in which the paper can be amended.\n* Q6) Please elucidate how the \"temporal\" aspect is accounted for in the experiments. Suggestions are in [A, F, T].\n\nPlease answer these questions fairly.\n\nLIMITATIONS:\nThe limitations are stated, but only in the supplementary material. However, according to this reviewer, these limitations should be expanded significantly (the reasons are provided in my review). For instance, most assumptions are overly optimistic (i.e., immutable attack landscape, widespread deployment of deep neural networks for NID) and the data hardly reflects a real network and/or which is in constant evolution.\n\n\n## UPDATE AFTER AUTHOR's RESPONSE\n\nI am increasing my score from a 5 to a 6, as well as the \"Contribution\" (from a 2 to a 3) in light of the clarifications and experiments carried out by the authors during the discussion phase.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-06-19"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose techniques for improving how to select samples for\nreplacement in the memory for continual learning and how to estimate\nvirtual SGD in MIR to reduce computation.\n\nFor replacement in memory, CBRS does not keep track of class counts,\nand replacement might occur on non-majority samples in the memory.\nInstead the authors propose ECBRS (Extended Class Balancing Reservoir\nSampling) keeps track of class counts (global information) and\nreplacement prefers classes with the highest count.  Each class c has\ngamma(c) as the expected count in the memory with weights favoring\nsmaller classes.  Based on gamma(c), the next largest class might be\nchosen.\n\nThey also propose Perturbation Assistance for Parameter Approximation\n(PAPA) for MIR. In MIR sampling from the memory is informed by the\nloss from virtual SGD parameter (VSP) updates for each sample, which\nincur additional overhead.  They observe that VSP overlaps or scatter\naround regular SGD parameter (RSP) updates.  They modeled the\ndifference between VSP and RSP with a two-component Gaussian Mixture\nModel (GMM).  Then they estimate VSP from RST and GMM.  The GMM is\ntrained on one task and used in the remaining tasks.\n\nEmpirical results indicate that ECBRS generally outperforms 7 existing\non 12 datasets.  ECBRS can also improve the performance of MIR.  The\ntraining time for PAPA is lower than MIR on 11 datasets, but achieve\nsimilar accuracy.\n\nI have read the authors' response and commented on them.\n\nSTRENGTHS:\n1.  The idea of estimaing virtual SGD updates is interesting.\n\n2.  Empirical results indicate that ECBRS generally outperforms and\n    PAPA can reduce training time.\n\nWEAKNESSES:\n1.  While PAPA is interesting, the reasoning for the error\n    distribution from one task is applicable to another task could be\n    further discussed/explored--see questions below.\n\n2.  Font sizes for Table 2-4 and some figures are quite\n    small--difficult to read.\n\n3.  Some items can be clarified--see questions below.\n\nQUESTIONS:\n1.  Alg 1: \"select a class that is the largest, having higher running\n    statistics value and non-zero samples in the buffer. Otherwise,\n    select a class with next higher running statistic value that has\n    m_c >γ(c).\"\n\n    It seems the next highest class is selected when the largest class\n    has no samples in the the buffer.  This seems to be different from:\n\n    line 172: \"once it reaches the threshold of the benign class\n    (gamma(.)= 262), the ECBRS selects the class with\n    the next highest running static value\"\n\n2.  line 233: The GMM is trained based on one task and is used for the\n    other tasks.  This implies all the tasks has similar error\n    distributions, which does not seem to be the case in Figure 3.  Learning\n    a GMM for each task, and compare the GMMs would be helpful.\n\n3.  Even if the error distributions are similar for the tasks in the paper, \n     can other tasks have similar error distributions?  If not, a separate\n     GMM would need to be learned, which might negate the computation\n     savings in estimating VSP.\n\n4.  line 266: \"a randomly chosen single attack class and the remaining\n    nine classified as benign.\"  Would one (large) benign class with\n    the remaining (small) clases as attacks be more realistic (similar\n    to the example in Figure 1)?.\n\nMinor comment:\n\nline 174: static -> statistic\n\nLIMITATIONS:\nLimitations of the proposed approach do not seem to be mentioned.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 2, "SOUNDNESS_CORRECTNESS": 2, "DATE": "2023-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper improves upon existing memory replay-based continual learning methods for anomaly detection. First the authors extend class balancing reservoir sampling (CBRS) and develop ECBRS, using global information in order to keep more accurate information about class imbalance. Second, the authors proposed a perturbation-assisted parameter approximation (PAPA) method for estimating virtual SGD parameter (VSP) updates, resulting in reduced training time for methods like maximally interfered retrieval (MIR). The proposed methods are evaluated on intrusion detection, computer vision, and anomaly detection datasets, and shown to increase performance while reducing training time.\n\nSTRENGTHS:\nThis paper relies on simple heuristics that are shown to be quite effective for improving upon existing CL methods. The authors have also done extensive evaluation of their methods using several datasets, including ablation studies. In addition to performance improvements, the proposed methods can also reduce training times, resulting in better scalability.\n\nWEAKNESSES:\n- Since the paper heavily relies on CBRS and MIR, I suggest that the authors briefly describe these methods to make the paper more standalone and to make its novelties more clear. \n- While the proposed methods are sound, I am not sure if the utilized evaluation datasets can fully support the paper's claims. The paper mainly focuses on learning from data with distribution shifts, however all but one of the evaluated datasets correspond to a short time period with little to no distribution shift.\n- Related to the above, I am not sure if the inclusion of image datasets is needed as the proposed methods are presented for network intrusion datasets. The authors mention that they include image dataset to evaluate learning on data with distribution shifts, but I am not sure if image datasets contain any distribution shift.\n- The authors should also include the standard deviation of AUC scores in Tables 2, 3.\n\nQUESTIONS:\n- Do the authors have an idea on why PAPA achieves better performance as compared to MIR in Table 3? Since PAPA performs an approximation, I would have expected the AUC scores to be slightly lower than those for MIR.\n- Do the authors have an insight as to why the error between regular/virtual parameter updates resembles a two-component GMM? Is it reasonable to expect this assumption to hold on other datasets?\n- What is the reason for including image datasets for evaluation. If the reason is distribution shifts, can you state why you expect these datasets to contain distribution shifts?\n\nLIMITATIONS:\nLimitations are adequately discussed.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 4, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2023-07-05"}