面向不平衡数据和特征冗余的网络入侵检测  

Network Intrusion Detection for Unbalanced Data and Feature Redundancy

作　　者：张翼英[1] 王德龙 渠慧颖 张傲 张磊[1] ZHANG Yiying;WANG Delong;QU Huiying;ZHANG Ao;ZHANG Lei(College of Artificial Intelligence,Tianjin University of Science&Technology,Tianjin 300457,China)

机构地区：[1]天津科技大学人工智能学院,天津300457

出　　处：《天津科技大学学报》2023年第5期57-63,共7页Journal of Tianjin University of Science & Technology

基　　金：国家自然科学基金项目(61807024)。

摘　　要：为了解决传统方法因数据不平衡及特征冗余而导致检测准确率不高的问题,提出了一种结合SMOTE(synthetic minority over-sampling technique)算法采样的SDAE-LSTM(stacked deep auto-encoder-long short term memory)入侵检测模型。首先,针对数据不平衡问题,采用SMOTE算法在少数类样本点之间随机插入样本增加其数量,达到类间平衡的目的。其次,针对特征冗余问题,利用堆叠式深度自编码器(stacked deep auto-encoder,SDAE)进行降维,实现数据的深度特征提取。最后,基于长短期记忆(long short term memory,LSTM)神经网络,精准捕获网络入侵特征,准确地实现入侵检测。通过在UNSW-NB15数据集上的大量实验,有效证明了本文模型与其他模型相比有着更好的入侵检测效果。In order to solve the problem of low detection accuracy caused by data imbalance and feature redundancy in traditional methods,a stacked deep auto-encoder-long short term memory(SDAE-LSTM)intrusion detection model combined with synthetic minority over-sampling technique(SMOTE)sampling is proposed in our current study.Firstly,aiming at the problem of data imbalance,a SMOTE method was used to randomly insert samples between a few sample points to increase their number,so as to achieve the goal of category balance.Secondly,aiming at the problem of feature redundancy,the stacked deep auto-encoder(SDAE)was used to reduce the dimension and realize the depth feature extraction of data.Finally,based on the long short term memory(LSTM)neural network,the network intrusion characteristics was accurately captured and the intrusion detection was accurately implemented.Through a large number of experiments on UNSW-NB15 datasets,our proposed model is effectively proved to have better intrusion detection effect than other models.

关 键 词：不平衡数据 特征冗余 SMOTE 堆叠式深度自编码器 长短期记忆神经网络 网络入侵检测 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]