基于LightGBM的网络入侵检测研究  

RESEARCH ON NETWORK INTRUSION DETECTION BASED ON LIGHTGBM

作　　者：唐朝飞 努尔布力[2] 艾壮 Tang Chaofei;Nurbol;Ai Zhuang(College of Software,Xinjiang University,Urumqi 830046,Xinjiang,China;Network Centre,Xinjiang University,Urumqi 830046,Xinjiang,China;College of Information Science and Engineering,Xinjiang University,Urumqi 830046,Xinjiang,China)

机构地区：[1]新疆大学软件学院,新疆乌鲁木齐830046 [2]新疆大学网络中心,新疆乌鲁木齐830046 [3]新疆大学信息科学与工程学院,新疆乌鲁木齐830046

出　　处：《计算机应用与软件》2022年第8期298-303,311,共7页Computer Applications and Software

基　　金：国家自然科学基金重点项目(重大联合)(61433012);自治区创新环境(人才、基地)建设专项(PT1811)。

摘　　要：针对传统的常用机器学习算法在网络入侵检测中存在准确率不够高、训练速度慢的缺点,提出基于特征选择、LightGBM的网络入侵检测系统。使用PCA进行特征选择,采用QPSO为LightGBM算法选择最优参数,在Spark集群上运行,缩短了训练时间。此外,由于使用了基于PCA的特征选择方法,仅使用了41个特征中的9个(21.95%),达到优于使用全部特征训练模型的性能。在NSL-KDD数据集上测试了提出的系统的性能,其能准确、快速地对入侵行为样本进行识别。Aiming at the shortcomings of traditional commonly-used machine learning algorithms in network intrusion detection,such as low accuracy and slow training speed,a network intrusion detection system based on feature selection and LightGBM is proposed.The PCA was used for feature selection,and then the QPSO was used to select the optimal parameters for the LightGBM algorithm.It ran on the Spark cluster,which shortened the training time.In addition,because the PCA-based feature selection method was used,only 9 of the 41 features(21.95%)were used,which achieved better performance than training models by using all features.The performance of the proposed system was tested on the NSL-KDD dataset.This system can accurately and quickly identify intrusion behavior samples.

关 键 词：网络入侵检测 特征选择 lightGBM QPSO SPARK 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]