改进的门控循环单元模型研究与应用  

Research and Application of Improved Gated Recurrent Unit Model

作　　者：韩忠华[1,2] 黎恺嘉 陈赵琦 尚文利 HAN Zhong-hua;LI Kai-jia;CHEN Zhao-qi;SHANG Wen-li(Faculty of Information and Control Engineering,Shenyang Jianzhu University,Shenyang Liaoning 110168,China;Department of Digital Factory,Shenyang Institute of Automation,Chinese Academy of Sciences(CAS),Shenyang Liaoning 110016,China;Physics College,Northeast Normal University,Changchun Jilin 130024,China;School of Electronics and Communication Engineering,Guangzhou University,Guangzhou Guangdong 510006,China)

机构地区：[1]沈阳建筑大学信息与控制工程学院,辽宁沈阳110168 [2]中国科学院沈阳自动化研究所数字工厂研究室,辽宁沈阳110016 [3]东北师范大学物理学院,吉林长春130024 [4]广州大学电子与通信工程学院,广东广州510006

出　　处：《计算机仿真》2022年第12期429-435,541,共8页Computer Simulation

基　　金：国家自然科学基金(61773368);辽宁省重点研发计划项目(2020JH2/10100039);辽宁省教育厅科学技术项目(Injc201912);辽宁省教育厅青年科技人才“育苗”项目(Inqn201912)。

摘　　要：在传统机器学习方法在应对大规模、高维度的非线性数据分析处理方面,其性能需要进一步提升,特别是在网络安全入侵检测分析方面,网络攻击呈现出多样性、隐蔽性的特征,需要探索更好的异常数据分类与攻击识别方法。提出一种基于堆叠降噪自编码网络的门控循环单元(SDAN-GRU)深度学习模型的入侵检测方案。门控循环单元中重置门和更新门的设计有助于捕捉时序数据中的短期和长期依赖关系,相较于其它深度学习模型更适合对攻击样本所具有的时序特征进行识别和分类。同时针对入侵检测样本中包含的冗余信息和噪声数据问题,进一步引入堆叠降噪自编码网络对流量数据进行降维和特征抽取,并通过与门控循环单元结合构建深度学习模型,通过KDDCUP99数据集进行仿真验证。实验结果表明,基于堆叠降噪自编码网络的门控循环单元(SDAN-GRU)深度学习模型构建的入侵检测方案,能有效的提高流量数据的分类速率和攻击的识别精度。The performance of traditional machine learning methods in dealing with large-scale, high-dimensional nonlinear data analysis and processing needs to be further improved. Especially in network security intrusion detection and analysis, network attacks show diverse and concealed characteristics, and it is necessary to explore better anomalous data classification and attack identification methods. This paper proposes an intrusion detection scheme based on a gated recurrent unit(SDAN-GRU) deep learning model of stacked denoising auto-encoder network. The design of reset and update gates in the gated recurrent unit helps to capture the short-term and long-term dependencies in the time series data and is more suitable for identifying and classifying the time series characteristics of attack samples than other deep learning models. At the same time, in view of the redundant information and noise data contained inthe intrusion detection samples, the stacked denoising auto-encoder network is further introduced to reduce the dimensionality and feature extraction of the traffic data, and the deep learning model is constructed by combining with the gated recurrent unit, and the KDDCUP99 data is used Set for simulation verification. The experimental results show that the intrusion detection scheme based on the gated recurrent unit(SDAN-GRU) deep learning model of the stacked denoising auto-encoder network can effectively improve the classification rate of traffic data and the accuracy of attack recognition.

关 键 词：自编码网络 堆叠降噪自编码网络 门控循环单元 入侵检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]