Simple Efficient Evolutionary Ensemble Learning on Network Intrusion Detection Benchmarks

Training and deploying genetic programming (GP) classifiers for intrusion detection tasks on the one hand remains a challenge (high cardinality and high class imbalance). On the other hand, GP solutions can also be particularly ‘lightweight’ from a deployment perspective, enabling detectors to be deployed ‘at the edge’ without specialized hardware support. We compare state-of-the-art ensemble learning solutions from GP and XGBoost on three examples of intrusion detection tasks with 250,000 to 700,000 training records, 8 to 115 features and 2 to 23 classes. XGBoost provides the most accurate solutions, but at two orders of magnitude higher complexity. Training time for the preferred GP ensemble is in the order of minutes, but the combination of simplicity and specificity is such that the resulting solutions are more informative and discriminatory. Thus, as the number of features increases and/or classes increase, the resulting ensembles are composed from particularly simple trees that associate specific features with specific behaviours.