Formulating Parallel Supervised Machine Learning Designs For Anomaly-Based Network Intrusion Detection in Resource Constrained Use Cases
Formulating Parallel Supervised Machine Learning Designs For Anomaly-Based Network Intrusion Detection in Resource Constrained Use Cases
复制标题
DOI：
10.1109/mass56207.2022.00117
复制
发表时间：
2022-10
期刊：
影响因子：
--
通讯作者：
Varun Joshi;John Korah
中科院分区：
文献类型：
--
作者：
Varun Joshi;John Korah
将有监督机器学习用于大型网络中基于异常的网络入侵检测(NID)的主要问题之一是训练中使用的海量动态数据集以及它们在训练阶段引入的计算开销。在资源受限的情况下，缺乏传统上用于处理高计算负载的强大机器。我们专注于并行处理设计，通过降低基于异常的NID的有监督机器学习的计算开销，特别是对于小批量梯度下降，来工作在这样的资源受限的用例中。我们避免了传统并行化框架的黑盒方法，并允许用户通过给予对并行化的更大控制来最大化其稀缺计算资源的利用，同时利用正在实施的优化算法的关键方面。为了演示这一点，我们使用计算统一设备架构(CUDA)和消息传递接口(MPI)库实施了基于并行的初始数据和模型设计，旨在最大限度地利用有限数量的CPU和GPU。我们使用名为KDD CUP 1999的大型真实网络入侵数据集进行了初步的性能比较研究；我们的结果表明，与串行方法相比，仅使用1个GPU(4000个线程)每秒的历元数高达8.5倍，使用1个计算节点(7核)的收敛速度高达37倍。
One of the main problems with using supervised machine learning for anomaly-based Network Intrusion Detection (NID) in large cyber networks is the massive and dynamic data sets used in training and the computational overhead they induce in the training phase. In resource-constrained situations, there is a lack of powerful machines that would be traditionally used to deal with a high computational load. We focus on parallel processing designs that work in such resource-constrained use cases by lowering the computational overhead of supervised machine learning for anomaly-based NID, specifically for Mini-batch gradient descent. We avoid the black-box approach of traditional parallelization frameworks and allow the user to maximize the utilization of their scarce computational resources by granting greater control over parallelization while leveraging key aspects of the optimization algorithms being implemented. To demonstrate this, we implemented initial data and model parallel based designs, using the Compute Unified Device Architecture (CUDA) and Message Passing Interface (MPI) libraries, aimed at maximizing the use of a limited number of CPUs and GPUs. We conducted an initial comparative performance study using a large real-world network intrusion dataset called the KDD cup 1999; our results demonstrate up to 8.5 times more epochs per second using just 1 GPU (4000 threads) and up to 37 times faster convergence using just 1 compute node (7 cores) when compared to a serial approach.