基于SDN的智能入侵检测系统模型与算法  

SDN based intelligent intrusion detection system model and algorithm

作　　者：马琳 张莎莎 宋姝雨 王磊 Ma Lin;Zhang Shasha;Song Shuyu;Wang Lei(Information Section, PLA Air Force Hangzhou Special Service Convalescent Center, Hanghzhou 310012;Institute of Information Science and Electronic Engineering, Zhejiang University, Hangzhou 310027;Academy of Broadcasting Science, National Radio and Television Administration, Beijing 100866)

机构地区：[1]空军杭州特勤疗养中心信息科,杭州310012 [2]浙江大学信息与电子工程学院,杭州310027 [3]国家广播电视总局广播电视科学研究院,北京100866

出　　处：《高技术通讯》2020年第5期533-537,共5页Chinese High Technology Letters

基　　金：国家重点研发计划(2018YFB0803702)资助项目。

摘　　要：基于软件定义网络(SDN)的集中式管理、全局控制等优势,提出了一种智能的入侵检测系统架构模型。基于该模型,可以动态使用不同的机器学习算法对入侵的数据流进行检测,从而提升系统的检测性能。本文针对入侵数据流多特征、不平衡性等特点,提出了一种改进的随机森林算法,通过动态更新决策树的权重来提高分类的准确度。使用KDD CUP99数据集对改进的算法进行训练和测试,实验结果表明,改进的随机森林算法在检测精度、代价等指标上都得到了明显的提升,验证了新模型和新算法的有效性。An intelligent intrusion detection system model is proposed.The model takes the advantage of central management and global control in software defined networking(SDN).Different machine learning algorithm can be used dynamically for data flow detection.This can improve the performance of intrusion detection system.To solve the problem of diverse characters and unbalance flow data distribution,this work improves current random forest algorithm.The metrics of decision tree will be update dynamically to improve the accuracy of classification.KDD CUP99 dataset is used for algorithm training and testing.Simulation results show that the improved random forest algorithm has good performance on detection accuracy and cost.It proves the efficiency of new model and new algorithm.

关 键 词：软件定义网络(SDN) 入侵检测系统 机器学习 随机森林 

分 类 号：TP3[自动化与计算机技术—计算机科学与技术]