基于改进降噪自编码模型的网络入侵检测  

Network Intrusion Detection Based on Improved Denoising Autoencoder Model

作　　者：蔡宇航 廖光忠[2] CAI Yu-hang;LIAO Guang-zhong(School of Computer Science and Technology,Wuhan University of Science and Technology,Wuhan 430065,China;Hubei Province Key Laboratory of Intelligent Information Processing and Real-time Industrial System,Wuhan University of Science and Technology,Wuhan 430065,China)

机构地区：[1]武汉科技大学计算机科学与技术学院,湖北武汉430065 [2]武汉科技大学智能信息处理与实时工业系统湖北省重点实验室,湖北武汉430065

出　　处：《计算机技术与发展》2023年第2期119-124,共6页Computer Technology and Development

基　　金：国家自然科学基金项目(61502359)。

摘　　要：针对网络入侵数据中样本不平衡现象导致多分类准确率普遍不高的问题,提出一种基于改进降噪自编码模型的网络入侵检测方法。在数据处理方面,对原始网络入侵数据进行数值化和归一化预处理,并且使用生成对抗网络模型来对现有入侵数据进行数据增强,从而扩充少数类样本。在入侵检测方面,对传统的降噪自编码器模型进行改进,通过在编解码网络中引用门控循环单元结构,使得该模型在具有一定的鲁棒性的同时,也保证了网络入侵数据的时序信息传递的连贯性,避免了重要数据特征的遗漏。使用UBSW-NB15数据集对所提方法进行有效性验证,实验结果表明,与决策树、随机森林、GRU-RNN等传统方法相比,所提方法在攻击类型少数类上的检测率明显提高,并且整体的检测性能更好。A network intrusion detection method based on an improved denoising autoencoder model is proposed for the problem of generally low accuracy of multi-classification due to the phenomenon of sample imbalance in network intrusion data.In terms of data processing,the original network intrusion data is preprocessed numerically and normalized,and the existing intrusion data is augmented using a generative adversarial network model to expand the minority class samples.In terms of intrusion detection,the traditional denoising autoencoder model is improved by invoking a gated recurrent unit structure in the codec network,which makes the model robust while ensuring the coherence of the temporal information transfer of network intrusion data and avoiding the omission of important data features.The effectiveness of the proposed method is verified using the UBSW-NB15 dataset,and the experimental results show that the proposed method can achieve a significant improvement in the detection rate of a few classes of attack types compared with traditional methods such as decision trees,random forests,and GRU-RNN,and the overall detection performance is excellent.

关 键 词：网络入侵检测 样本不平衡 生成式对抗网络 降噪自编码器 门控循环单元 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]