In online intrusion detection, a classification model able to identify different types of attacks is valuable as it can help users respond instantly and adequately against unexpected adversaries. This paper presents a new active learning mechanism to secure effective multiple attack classification for online intrusion detection. The new mechanism is built over our previous lifelong sampling (LS) mechanism which uses its random forest (RF) operation to pursue favorable binary classification in online environments. The new mechanism advances the LS-RF framework by using the Mondrian forest (MF)—an innate lifelong learning procedure able to avoid cumulative training data without additional effort—to develop a desired multiple classification architecture. We choose MF to realize online multiple classification mainly because it can train a model to identify different attack types in the online process and can hence fortify classification and detection to help users act promptly against sudden maliciousness. Experimental results show that, by effective model training, our Multi-Classification mechanism performs desirable classification and detection—in terms of precision, accuracy and F1-scores—at moderate time cost (which is feasible and negligible when compared with the significant performance gain).
