基于特征值分布和人工智能的网络入侵检测系统的研究与实现  

Framework for building network intrusion detection system based on feature distribution and AI

作　　者：何俊鹏 罗蕾[1] 肖堃[1] 张海涛 李允[3] He Junpeng;Luo Lei;Xiao Kun;Zhang Haitao;Li Yun(School of Computer Science&Engineering,University of Electronic Science&Technology of China,Chengdu 611731,China;Shanghai Automotive Industry Corporation,Shanghai 200041,China;Chengdu Weichen Information Technology Co.,Ltd.,Chengdu 610097,China)

机构地区：[1]电子科技大学计算机科学与工程学院,成都611731 [2]上海汽车集团股份有限公司,上海200041 [3]成都为辰信息技术有限公司,成都610097

出　　处：《计算机应用研究》2021年第9期2746-2751,共6页Application Research of Computers

基　　金：四川省重大科技专项资助项目(2018GZDZX0009)。

摘　　要：为维护操作系统的安全性和可靠性,提出了一个具备泛用能力、基于人工智能模型的网络入侵检测系统框架,其主要功能是针对来自互联网里各种形式的网络流量进行检测,并嗅探出可能的入侵攻击及恶意网络连接并将其归类。该框架首先使用采样、独热编码、特征选择和归一化将网络流量实例进行预处理,获取基本信息和筛选重要特征;然后利用网络连接实例的特征值分布建立评分机制,对数据进行信息再提取;最后针对不同的网络流量形式,利用不同的基于机器学习或深度学习的模型进行结果判断。实验中使用三个公开基准数据集KDDCup99、UNSW-NB15和CICIDS2017进行训练和测试。通过与相关文献比较,发现提出方法在三个数据集的正确率和F 1得分上均有着优异的表现。In order to maintain security and reliability of operating system,this paper developed a universal framework for network intrusion detection system based on artificial intelligence(AI)model.This framework was capability of detecting all sorts of network traffic,catching out possible malicious connection or attack from Internet and identifying it.Firstly,this system preprocessed the network traffic data by sampling,one-hot encoding,feature selection and normalization for basic feature extraction.Secondly,it utilized feature distribution in network connection instance to build a scoring mechanism for information extraction once again.Thirdly,it applied the different types of ML/DL models for different forms of network traffic to do final classification for extracted features.In experiments,this system applied three benchmark datasets,KDDCup99,UNSW-NB15 and CICIDS2017.The result of experiments shows it possesses exceedingly good performance and has better accuracy and F 1 score than related works under these datasets.

关 键 词：入侵检测 人工智能 特征值分布 机器学习 深度学习 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]