基于极端随机树的入侵检测模型研究  

Research on Intrusion Detection Model Based on Extreme Random Tree

作　　者：张状状 杜星熠 王啸 胡静[1] 宋铁成[1] Zhang Zhuangzhuang;Du Xingyi;Wang Xiao;Hu Jing;Song Tiecheng(School of Information Science and Engineering Southeast University Nanjing 211102,China)

机构地区：[1]东南大学信息科学与工程学院,南京211102

出　　处：《信息化研究》2022年第2期32-37,43,共7页INFORMATIZATION RESEARCH

基　　金：国家重点研发计划(2020YFB1600104);江苏省重点研发计划(BE2020084-2)。

摘　　要：传统机器学习算法训练网络入侵数据集时,容易出现特征维数多、过拟合与数据集不平衡等问题,导致入侵检测算法的准确率降低以及时间效率低下。为解决上述问题,文章提出基于极端随机树的入侵检测模型,使用线性判别式分析进行数据降维,然后利用过采样减少网络入侵数据集样本类别不平衡带来的影响,最后使用极端随机树进行模型训练。实验结果表明,经过LDA降维和过采样后,使用极端随机树分类模型能够提高多分类下不平衡数据集的整体识别性能并能满足网络入侵检测实际应用的时间效率要求。When traditional machine learning algorithms train network intrusion data sets,they are prone to problems such as too many feature dimensions,over fitting and imbalance of data sets,which lead to the reduction of accuracy and time efficiency of intrusion detection algorithms.In order to solve the above problems,this paper proposes an intrusion detection model based on Extreme Random Tree,uses linear discriminant analysis(LDA)to reduce the dimension of data,then uses oversampling to reduce the impact of sample category imbalance in network intrusion data set,and finally uses Extreme Random Tree for model training.The experimental results show that after LDA dimensionality reduction and oversampling,the use of Extreme Random Tree classification model can improve the overall recognition performance of unbalanced data sets under multi classification,and can meet the time efficiency requirements of practical application of network intrusion detection.

关 键 词：入侵检测 线性判别分析 采样技术 不平衡数据集 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]