VAE过采样与迁移学习在网络入侵检测中的应用  

Application of VAE oversampling and transfer learning in network intrusion detection

作　　者：黄仲英 杨印根[1] 雷震春[1] Huang Zhongying;Yang Yingen;Lei Zhenchun(School of Computer and Information Engineering,Jiangxi Normal University,Nanchang,Jiangxi 330022,China)

机构地区：[1]江西师范大学计算机信息工程学院,江西南昌330022

出　　处：《计算机时代》2021年第7期50-54,57,共6页Computer Era

基　　金：国家自然科学基金(No.61662030)。

摘　　要：在网络入侵检测中,异常样本通常要比正常样本少得多,数据的不平衡问题会导致检测模型的分类结果倾向于多数类,影响模型准确率。文章提出应用变分自编码器(VAE)模型对网络入侵检测中的不平衡数据进行过采样,通过学习原数据的特征后生成新样本重新平衡数据分布,以提高检测模型的性能。在训练检测模型时采用迁移学习方法,先在过采样后混合的数据集上预训练,再迁移到原数据集上进行训练,得到最终的检测模型。在NSL-KDD数据集上进行实验,网络入侵检测模型使用前馈神经网络。结果表明,基于深度学习的VAE过采样方法比传统的SMOTE过采样方法要更加有效,提高了网络入侵检测模型准确率3.23%。In network intrusion detection,the number of malicious samples is extremely less than that of normal samples.The data imbalance will lead to the classification results of detection models inclined to most categories,which leads to the low accuracy of the detection models.This paper proposes to use the variational auto-encoder(VAE)model to oversample the imbalanced data in network intrusion detection,and rebalance the data distribution with the new samples generated by learning the features of the original data,so as to improve the performance of detection model.When training the detection model,the transfer learning method is adopted,the final model is pre-training on the oversampled and mixed data set,and then training on the original data set.The experiment is carried out on NSL-KDD data set,and the network intrusion detection model uses feedforward neural network.The results show that the VAE oversampling method based on deep learning is more effective than the traditional SMOTE oversampling method,and the accuracy of network intrusion detection model is improved by 3.23%.

关 键 词：网络入侵检测 VAE 迁移学习 SMOTE 不平衡数据 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]