针对基于随机森林的网络入侵检测模型的优化研究  

Research on Optimization of Random-Forest-Based Network Intrusion Detection Model

作　　者：章缙 李洪赭 李赛飞[1] ZHANG Jin;LI Hongzhe;LI Saifei(School of Information Science and Technology,Southwest Jiaotong University,Chengdu 611756)

机构地区：[1]西南交通大学信息科学与技术学院,成都611756

出　　处：《计算机与数字工程》2022年第1期106-110,179,共6页Computer & Digital Engineering

基　　金：四川省重大科技专项课题(编号:2018GZDX0005,2019YFG0399,2019ZDZX0007);中央高校基本科研业务费专项(编号:2682019CX63)资助。

摘　　要：为了应对大规模网络环境下日益复杂的网络安全威胁,越来越多的研究使用机器学习算法来建立入侵检测模型,其中一些基于随机森林的检测方法具有较好的效果。但传统随机森林中一些分类能力较差的决策树的存在,以及入侵检测数据集的不平衡性,都可能会导致基于传统随机森林的入侵检测模型的性能有所下降。针对这些问题,论文在基于传统随机森林的入侵检测模型上加入了精英选择、加权投票和上采样几种优化方法,并在UNSW-NB15数据集上进行了测试,结果表明优化后的模型具有更好的检测能力。In order to deal with the increasingly complex network security threats in large-scale network environments,more and more studies use machine learning algorithms to build intrusion detection models,some models based on RF(random forest)have good performance.But due to the existence of decision trees which are bad at classification in traditional RF and the imbalance of intrusion detection dataset,the performance of traditional-RF-based intrusion detection models can decline.In order to solve these problems,this paper adds some optimization methods,such as elite selection,weighted voting and over sampling,to the tradi⁃tional-RF-based intrusion detection model,and then tests the classification ability of the new model on the UNSW-NB15 dataset.Experimental results show that the optimized model has better performance.

关 键 词：网络入侵检测 随机森林 决策树 上采样 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]