Abstract:To address the problem that incremental intrusion detection algorithms do not classify old category data with high accuracy due to catastrophic forgetting of old knowledge, this study proposes an incremental intrusion detection algorithm (ImFace) based on asymmetric multi-feature fusion auto-encoder (AMAE) and fully connected classification deep neural network (C-DNN). In the incremental learning phase, ImFace trains an AMAE model and a C-DNN model for each new batch of the dataset. At the same time, this study solves the problem of C-DNN’s insufficient ability to detect certain categories of data due to unbalanced datasets by oversampling the data through a variational auto-encoder (VAE). In the detection phase, ImFace makes the input data pass through all AMAEs and C-DNNs and then uses the result of AMAEs as the confidence level to select the output result of a C-DNN as the final result. In this study, the CICIDS2017 dataset is used to test the effectiveness of the ImFace algorithm. The experimental results show that the ImFace algorithm not only retains the ability to classify old categories but also has a high detection accuracy for new categories of data.