基于膨胀卷积和门控循环单元组合的入侵检测模型  

Intrusion detection model based on combination of dilated convolution and gated recurrent unit

作　　者：张全龙 王怀彬 ZHANG Quanlong;WANG Huaibin(School of Computer Science and Engineering,Tianjin University of Technology,Tianjin 300384,China)

机构地区：[1]天津理工大学计算机科学与工程学院,天津300384

出　　处：《计算机应用》2021年第5期1372-1377,共6页journal of Computer Applications

基　　金：国家自然科学基金资助项目(61773286)。

摘　　要：基于机器学习的入侵检测模型在网络环境的安全保护中起着至关重要的作用。针对现有的网络入侵检测模型不能够对网络入侵数据特征进行充分学习的问题,将深度学习理论应用于入侵检测,提出了一种具有自动特征提取功能的深度网络模型。在该模型中,使用膨胀卷积来增大对信息的感受野并从中提取高级特征,使用门控循环单元(GRU)模型提取保留特征之间的长期依赖关系,再利用深层神经网络(DNN)对数据特征进行充分学习。与经典的机器学习分类器相比,该模型具有较高的检测率。在著名的KDD CUP99、NSL-KDD和UNSW-NB15数据集上进行的实验表明,该模型具有由于其他分类器的性能。具体来说,该模型在KDD CUP99数据集上的准确率为99.78%,在NSL-KDD数据集上的准确率为99.53%,在UNSW-NB15数据集上的准确率为93.12%。Intrusion detection model based on machine learning plays a vital role in the security protection of network environment.Aiming at the problem that the existing network intrusion detection model cannot fully learn the data features of network intrusion,the deep learning theory was applied to intrusion detection,and a deep network model with automatic feature extraction function was proposed.In this model,the dilated convolution was used to increase the receptive field of information and extract high-level features from it,the Gated Recurrent Unit(GRU)model was used to extract long-term dependencies between retained features,then the Deep Neural Network(DNN)was used to fully learn the data features.Compared with the classical machine learning classifier,this model has a higher detection rate.Experiments conducted on the famous KDD CUP99,NSL-KDD and UNSW-NB15 datasets show that the model has the performance better than other classifiers.Specifically,the model has the accuracy of 99.78%on KDD CUP99 dataset,the accuracy of 99.53%on NSLKDD dataset,and the accuracy of 93.12%on UNSW-NB15 dataset.

关 键 词：网络入侵检测模型 深度学习 门控循环单元 膨胀卷积 网络安全 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]