WOS-ELM算法在入侵检测中的研究  

Research on Intrusion Detection Based on WOS-ELM Algorithm

作　　者：康松林[1] 刘楚楚[1] 樊晓平[1] 李宏[1] 杨宁[1] 

机构地区：[1]中南大学信息科学与工程学院,长沙410083

出　　处：《小型微型计算机系统》2015年第8期1779-1783,共5页Journal of Chinese Computer Systems

基　　金：国家自然科学基金项目(60773013)资助

摘　　要：随着信息化建设的深入,网络攻击变得复杂多变,严重威胁着网络安全与信息安全.一个好的入侵检测系统往往要求具有高效性,高速性,智能性,实时性,以及应对不同网络环境在线数据的鲁棒性.基于以上五点要求,提出一种权值更新的在线贯序极限学习机算法(WOS-ELM)来应用于网络入侵检测.该算法采用一个一个数据或一块一块数据添加的增量学习算法,将多次迭代求解的神经网络训练转变为一次求解的线性方程组,并通过一种有效的权值赋予的方法来解决网络环境数据不均衡的问题.实验表明,该方法具有很高的正确率,并能在短时间内达到很好的分类效果;较之其他算法,它更适合处理大规模网络实时环境中大量的原始数据,对统计数据依赖性小,对不均衡数据分类具有较好的鲁棒性.因此,基于权值更新的在线贯序极限学习机算法更适应于复杂多变的网络环境下的入侵检测.With the construction of informatization developing deeply, network attacks become more complicated and serious, threating our network security and information security seriously. A good intrusion detection system often requires to be efficient, high-speed, intelligent, real-time, and robustness to online data in different network environment. In this paper, a weighted online sequential extreme learning machine（WOS-ELM）algorithm for network attack detection was proposed. This algorithm is a general incremental learning method that adds data by both chunk-by-chunk and one-by-one learning, transforms neural network of iterative solution into linear e- quation that can be solved in one time;and an appropriate weight setting for class imbalance learning of network was selected in a computationally efficient manner. Experimental results show its good classification performance with little time. Compared with other algorithm,it is more suitable for processing large amounts of raw data in the real-time network environment. Moreover,it has a good robustness to imbalance dataset classification. Therefore,this improved online sequential algorithm is more suitable for network intrusion detection in complex environment.

关 键 词：网络入侵检测 在线贯序极限学习机 增量学习 权值更新 不均衡数据分类 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]