Multi-objective evolutionary neural architecture search for network intrusion detection

Abstract

Network Intrusion Detection (NID) becomes significantly important for protecting the security of information systems, as the frequency and complexity of network attacks are increasing with the rapid development of the Internet. Recent research studies have proposed various neural network models for NID, but they need to manually design the network architectures based on expert knowledge, which is very time-consuming. To solve this problem, this paper proposes a Multi-objective Evolutionary Neural Architecture Search (MENAS) method, which can automatically design neural network models for NID. First, a comprehensive search space is designed and then a weight-sharing mechanism is used to construct a supernet for NID, allowing each subnet to inherit weights from the supernet for direct performance evaluation. Subsequently, the subnets are encoded as chromosomes for multi-objective evolutionary search, which simultaneously optimizes two objectives: enhancing the model’s detection performance and reducing its complexity. To improve the search capability, a path-based crossover method is designed, which can iteratively refine the subnets’ architectures by simultaneously optimizing their accuracy and complexity for NID. At last, our MENAS method has been validated through extensive experiments on three well-known NID datasets: NSL-KDD, UNSW-NB15, and CICIDS2017. The experiments show that our MENAS method obtains an average 1.45% improvement on accuracy and an average 68.70% reduction on floating-point operations through multi-objective optimization process on six scenarios, which outperforms some state-of-the-art NID methods.