基于DBN和TSVM的混合入侵检测模型研究  

RESEARCH ON HYBRID INTRUSION DETECTION MODEL BASED ON DBN AND TSVM

作　　者：张克君[1,2] 鲜敏 Zhang Kejun;Xian Min(Department of Computer Science and Technology,Beijing Electronic Science and Technology Institute ,Beijing 100070, China;School of Computer Science and Technology, Xidian University, Xi＇ an 710071, Shaanxi, China)

机构地区：[1]北京电子科技学院计算机科学与技术系,北京100070 [2]西安电子科技大学计算机学院,陕西西安710071

出　　处：《计算机应用与软件》2018年第5期313-317,333,共6页Computer Applications and Software

基　　金：国家自然科学基金项目(61772047)

摘　　要：针对传统机器学习方法在处理大规模入侵数据的检测精度低和检测速度慢等问题,提出一种基于深度学习的混合入侵检测模型DBN-PBT-TSVM。该模型利用深度信念网络DBN(Deep Belief Network)减少特征集的维度,获得原始数据集的最优的低维表示;综合对支持向量机TSVM(Twin Support Vector Machine)和偏二叉树的优势,构造了一种基于偏二叉树的对支持向量机多类分类器,对网络入侵数据进行识别。基于KDDCUP'99数据集实验比较的结果表明,DBN-PBT-TSVM模型实现了在保证分类性能的同时,还显著地降低了检测时间,尤其是在处理大规模数据时效果更明显,为入侵检测在处理大规模数据时提供了一种全新的思路。The traditional machine learning method has low accuracy and slow speed in detection when dealing with large-scale data intrusion. This paper proposes a hybrid intrusion detection model named DBN-PBT-TSVM which is based on the deep learning. Deep Belief Network（ DBN） is utilized to reduce the dimension of the feature set and then the model obtains the optimal low-dimensional representation of the original data set. With combination of Twin Support Vector Machine（ TSVM） and partial binary tree,a multi-class classifier of TSVM is constructed based on the partial binary tree,which can identify the network data intrusion. The experimental results of KDDCUP＇99 data set show that DBN-PBT-TSVM model can ensure the classification performance and also reduce the detection time,especially for largescale data. It provides a new idea for intrusion detection in dealing with large-scale data.

关 键 词：深度学习 入侵检测 深度信念网络 偏二叉树 对支持向量机 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]