改进逆向习得推理的网络异常行为检测模型  

Network abnormal behavior detection model based on improved adversarially learned inference

作　　者：李博超 邵酉辰 LI Bochao;SHAO Youchen(School of Computer Science and Technology,Civil Aviation University of China,Tianjin 300300,China)

机构地区：[1]中国民航大学计算机科学与技术学院,天津300300

出　　处：《现代电子技术》2020年第18期14-18,共5页Modern Electronics Technique

基　　金：国家自然科学基金民航联合研究基金项目(U1833107);国家科技重大专项(2012ZX03002002);中央高校基本科研业务费(ZYGX2018028)。

摘　　要：针对网络异常行为检测中数据不平衡导致召回率低的问题,提出一种改进逆向习得推理(ALI)的网络异常行为检测模型。首先,使用仅由正样本所构成的数据对改进的ALI模型进行训练,通过已训练的改进的ALI模型处理检测数据,生成处理后的检测数据集;然后,使用异常检测函数计算处理后的检测数据与检测数据的距离以判断是否异常。在KDD99数据集上与AnoGAN等常用模型进行对比实验,实验结果表明,所设计模型在数据不平衡时具有较高的召回率,相比AnoGAN,召回率提升16%。In allusion to the poor recall rate caused by data imbalance in the network abnormal behavior detection,a network abnormal behavior detection model based on improved adversarially learned inference(ALI)is proposed.The data only composed of positive samples is used to train the improved ALI model,and the trained ALI model is utilized to process the detection data to generate the processed detection dataset.The distance between the processed detection data and the detected data is calculated by means of the anomaly detection function to determine whether it is abnormal.The detection model is compared with the commonly used models such as AnoGAN on the KDD99 dataset.The experimental results show the designed model has a higher recall rate when the data is unbalanced,and the recall rate is 16%higher than that of AnoGAN.

关 键 词：检测模型 网络异常行为检测 逆向习得推理 模型训练 数据处理 对比实验 

分 类 号：TN711-34[电子电信—电路与系统] TP309[自动化与计算机技术—计算机系统结构]