基于概率神经网络的增量式入侵检测方法  

Incremental Intrusion Detection Method based on Probabilistic Neural Networks

作　　者：李珊珊 李兆玉[1,2] 赖雪梅 陈虹羽 LI Shan-shan;LI Zhao-yu;LAI Xue-mei;CHEN Hong-yu(College of Communication and Information Engineering,Chongqing University of Post and Telecommunications,Chongqing 400065,China;Chongqing Key Lab of Mobile Communications Technology,Chongqing University of Posts and Telecommunications,Chongqing 400065,China)

机构地区：[1]重庆邮电大学通信与信息工程学院,重庆400065 [2]重庆邮电大学移动通信技术重庆市重点实验室,重庆400065

出　　处：《计算机仿真》2022年第9期476-482,共7页Computer Simulation

基　　金：长江学者和创新团队发展计划(IRT_16R72)。

摘　　要：为解决现有的入侵检测算法自适应性较差且面对稀疏攻击检出率较低的问题,提出了一种基于概率神经网络的增量式入侵检测方法。方法将可能性理论引入自组织增量神经网络(SOINN),定义可能性隶属度作为样本类别的判别标准,进而得到一种无监督增量式竞争学习网络P-SOINN,其输出可以表征数据分布的原型向量。将所得原型向量作为PNN网络的样本层来构建PS-PNN网络用于入侵检测。仿真结果表明,所提PS-PNN网络在稀疏攻击类型上的检出率明显优于对比算法的同时,测试集总体的准确率和召回率也有显著提升。In order to improve the poor self-adaptability of intrusion detection algorithms and low recall of sparse attacks, an incremental intrusion detection method based on a probabilistic neural network was proposed. The possibility is introduced into a self-organized incremental neural network(SOINN),and probability membership is defined as the criterion of classification so that an unsupervised incremental competitive learning network called P-SOINN is established. Secondly, the prototype which can represent the data distribution is used as the sample layer in the PNN network to establish the PS-PNN for intrusion detection. Finally, experiments show that the PS-PNN is superior to the comparison algorithm in the recall of sparse attacks, and the overall accuracy and recall of the test set are also greatly improved.

关 键 词：入侵检测 自组织增量神经网络 增量学习 可能性理论 概率神经网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]