决策树入侵检测模型中基于改进PIO的特征选择算法  

Feature Selection Algorithm Based on Improved Pigeon-inspired Optimization in Decision Tree Intrusion Detection Model

作　　者：陈孝文 张安琳 黄道颖 李建春 李航天 CHEN Xiaowen;ZHANG Anlin;HUANG Daoying;LI Jianchun;LI Hangtian(College of Computer and Communication Engineering,Zhengzhou University of Light Industry,Zhengzhou 450001,China;Engineering Training Center,Zhengzhou University of Light Industry,Zhengzhou 450001,China)

机构地区：[1]郑州轻工业大学计算机与通信工程学院,郑州450001 [2]郑州轻工业大学工程训练中心,郑州450001

出　　处：《火力与指挥控制》2022年第10期152-158,共7页Fire Control & Command Control

基　　金：国家科技支撑计划基金(2006BAK01A38);河南省教育厅基础研究基金资助项目(15A120020)。

摘　　要：在基于决策树的入侵检测模型中,入侵检测数据集中冗余和不相关的特征字段影响分类器的性能,存在训练效率低下的问题。提出一种改进的鸽子启发优化(pigeon-inspired optimization,PIO)算法(称为Jaccardcrossover PIO,JCPIO)来优化减少入侵检测数据集的特征字段。JCPIO使用PIO算法实现特征字段的选择优化,其中,通过Jaccard相似度定义鸽子速度,对鸽子个体进行离散二值化,通过在landmark算子操作中引入交叉操作,增加解空间的多样性,找到全局最优解。实验结果表明,JCPIO在保证入侵检测模型准确性的前提下,将原始数据集中的数据量减少了82.9%,增加了模型的训练效率;与传统的特征选择算法相比,识别模型的准确率提高了2.6%~5.5%,误报率降低了6.43%~14.33%。In the Intrusion detection(ID)model based on decision tree,there is a problem of low training efficiency because redundant and irrelevant feature segments in ID dataset affect the performance of classifier.An improved Pigeon-inspired optimization(PIO) algorithm called Jaccard Crossover PIO(JCPIO) is proposed to optimize the feature fields of ID dataset.JCPIO uses PIO algorithm to realize the feature fields selection optimization.Among them,the pigeon is discretized and binarized by defining the pigeon-speed by Jaccard similarity coefficient,by introducing the crossover into landmark-operator operation,the diversity of solution space is increased to find the global optimal solution.The experimental results show that JCPIO reduces the amount of data in the original dataset by82.9%on the premise of ensuring the accuracy of ID model to improve the training efficiency of the model greatly.Compared with the traditional feature-selection algorithms,the ID model accuracy is improved by 2.6%~5.5%,and the false positive rate is reduced by 6.43%~14.33%.

关 键 词：特征选择 入侵检测 鸽群优化 决策树 KDDCUP99数据集 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]