融合随机森林和梯度提升树的入侵检测研究  

Research on Intrusion Detection Based on Random Forest and Gradient Boosting Tree

作　　者：周杰英[1] 贺鹏飞 邱荣发 陈国 吴维刚[1] ZHOU Jie-Ying;HE Peng-Fei;QIU Rong-Fa;CHEN Guo;WU Wei-Gang(School of Computer Science and Engineering,Sun Yat-sen University,Guangzhou 510006,China)

机构地区：[1]中山大学数据科学与计算机学院,广东广州510006

出　　处：《软件学报》2021年第10期3254-3265,共12页Journal of Software

基　　金：国家重点研发计划(2018YFB0203803);国家自然科学基金(U1711263,U1801266);广东省自然科学基金(2018A030313492,2018B030312002)。

摘　　要：网络入侵检测系统作为一种保护网络免受攻击的安全防御技术,在保障计算机系统和网络安全领域起着非常重要的作用.针对网络入侵检测中数据不平衡的多分类问题,机器学习已被广泛用于入侵检测,比传统方法更智能、更准确.对现有的网络入侵检测多分类方法进行了改进研究,提出了一种融合随机森林模型进行特征转换、使用梯度提升决策树模型进行分类的入侵检测模型RF-GBDT,该模型主要分为特征选择、特征转换和分类器这3个部分.采用UNSW-NB15数据集对RF-GBDT模型进行了实验测试,与其他3种同领域的算法相比,RF-GBDT既缩短了训练时间,又具有较高的检测率和较低的误报率,在测试数据集上受试者工作特征曲线下的面积可达98.57%.RF-GBDT对于解决网络入侵检测数据不平衡的多分类问题具有较显著的优势,是一种切实可行的入侵检测方法.As a security defense technique to protect the network from attacks,the system of network intrusion detection system,as a security defense technology to protect the network from attacks,plays a very important crucial role in the field of guaranteeing computer system and network security.However,for the multi-classification problem of unbalanced data in network intrusion detection data,machine learning has been widely used in intrusion detection so as to achieve high intelligence and accuracy.In this paper,the current multi-classification method for network intrusion detection is improved,and an intrusion detection model RF-GBDT is proposed,which applies based on the random forest model for to feature conversion and classification using the model of gradient boosting decision tree to classification model is proposed.The model is mainly includes divided into three parts:Feature selection,feature conversion,and classifier.The UNSW-NB15 dataset was used for the experimental data set to test;experimental tests were carried out on the RF-GBDT model.Compared with the other three algorithms in the same field,RF-GBDT,this model not only reduces training time,but also has a higher detection rate and a lower false alarm rate.The area under the subject’s working characteristic curve on the test data set can reach 98.57%.RF-GBDT,the proposed model has significant advantages in solving the multi-class problem of multi-classification of unbalanced data in network intrusion detection data and is a feasible method for network intrusion detection.

关 键 词：网络入侵检测 数据不平衡 随机森林 梯度提升树 UNSW-NB15数据集 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]