面向不完备信息的网络入侵检测方法  

Network intrusion detection method for incomplete information

作　　者：张翼英[1] 阮元龙 尚静 周保先 ZHANG Yi-ying;RUAN Yuan-long;SHANG Jing;ZHOU Bao-xian(College of Artificial Intelligence,Tianjin University of Science and Technology,Tianjin 300457,China)

机构地区：[1]天津科技大学人工智能学院,天津300457

出　　处：《计算机工程与设计》2022年第5期1224-1231,共8页Computer Engineering and Design

基　　金：国家自然科学基金项目(61807024)。

摘　　要：为解决信息不完备情况下的检测准确率低、时间长的问题,提出面向不完备信息的网络入侵检测方法。针对信息不完备,采用基于SMOTE的采样方法增加少数类样本,实现信息特征稳定下的数据完备化。针对特征冗余,构建基于DBN的特征低维映射,实现数据降维,以便轻量级检测。基于SVM算法,精准捕捉入侵特征,实现快速的轻量级入侵检测。实验结果表明,信息完备化处理提高了罕见攻击的检测准确率,特征降维大幅降低了检测时长。To solve the problem of low detection accuracy and long detection time in the case of incomplete information,a network intrusion detection method for incomplete information was proposed.In view of the incomplete information,SMOTE(synthetic minority oversampling technique)sampling method was used to increase a small number of samples to realize the data completion under the condition of keeping information characteristics stable.Aiming at feature redundancy,a low dimension feature mapping based on DBN(deep belief network)was constructed to reduce the dimension of data for lightweight detection.Based on SVM(support vector machine)algorithm,the intrusion features were accurately captured to achieve fast and lightweight intrusion detection.Experimental results show that the information completion processing improves the detection accuracy of rare attacks,and the feature dimension reduction greatly reduces the detection time.

关 键 词：不完备信息 采样方法 深度信念网络 支持向量机分类器 网络入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]