基于采样集成算法的入侵检测系统设计  

Design of Intrusion Detection System Based on Sampling Ensemble Algorithm

作　　者：郇文明 林海涛[1] HUAN Wen-ming;LIN Hai-tao(College of Electronics Engineering,Naval University of Engineering,Wuhan 430000,China)

机构地区：[1]海军工程大学电子工程学院,武汉430000

出　　处：《计算机科学》2021年第S02期705-712,共8页Computer Science

摘　　要：入侵检测系统作为防火墙之后的第二道防线已经在网络安全领域得到了广泛应用,基于机器学习的入侵检测系统因其优越的检测性能吸引了越来越多的关注。为了提高入侵检测系统在多类非平衡数据中的检测性能,文中提出基于采样集成算法(OSEC)的入侵检测系统。OSEC首先根据“一对多”原则将多类别检测问题转化为多个二分类问题,然后在每个二分类问题中根据AUC值选择最优的采样集成算法以缓解数据的非平衡问题,最后根据文中设计的类别判决模块判断待测样本的具体类别。在NSL-KDD数据集上进行仿真验证,发现本系统相较于传统方法在R2L,U2R上的F1得分分别提高了0.595和0.185;对比最新的入侵检测系统,所提方法在整体检测准确率上提高了1.4%。As the second line of defense after firewalls,intrusion detection systems have been widely used in the field of network security.Machine learning-based intrusion detection systems have attracted more and more interest due to their superior detection performance.In order to improve the detection performance of the intrusion detection system in multiple types of imbalanced data,this paper proposes an intrusion detection system based on the optimal sampling ensemble algorithm(OSEC).OSEC first converts the multi-category detection problem into multiple binary classification problems according to the“one-to-all”principle,and then selects the optimal sampling ensemble algorithm according to the AUC value in each binary classification problem to alleviate the data imbalance problem.Finally,the category judgment module designed in this article judges the specific category of the sample to be tested.We perform simulation verification on the NSL-KDD data set,and find that compared with the traditional method,the F1 score of this system on R2L and U2R has increased by 0.595 and 0.185 respectively;compared with the latest intrusion detection system,the method in this paper improves the overall detection accuracy by 1.4%.

关 键 词：入侵检测 多类非平衡 重采样 集成学习 AUC NSL-KDD 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]