基于自编码器的网络零日攻击检测  

Network zero-day attack detection based on autoencoder

作　　者：白雪擎 王宏志 程超[1] BAI Xueqing;WANG Hongzhi;CHENG Chao(School of Computer Science&Engineering,Changchun University of Technology,Changchun 130102,China)

机构地区：[1]长春工业大学计算机科学与工程学院,吉林长春130102

出　　处：《长春工业大学学报》2023年第6期529-538,共10页Journal of Changchun University of Technology

基　　金：国家自然科学基金面上项目(62372063);吉林省优秀青年科技人才项目(20230508112RC)。

摘　　要：针对误用入侵检测系统无法识别零日攻击的问题,提出了基于自编码器的异常检测方法用于检测零日攻击。在验证部分,使用入侵检测数据集CICIDS 2017和NSL-KDD进行评估,同时,为了证明模型的有效性,引入了单类支持向量机模型进行对比实验。实验表明,自编码器模型适合检测复杂的零日攻击,该模型在准确率和召回率方面均表现出良好的效果。Therefore,in view of the misuse intrusion detection system cannot identify zero-day attacks,this paper proposes an anomaly detection method based on autoencoder to detect zero-day attacks.Two famous intrusion detection datasets CICIDS2017 and NSL-KDD are used for evaluation.At the same time,in order to prove the effectiveness of the model,the One-Class Support Vector Machine(OCSVM)model is introduced for comparison experiments.Experiments show that the autoencoder model is suitable for detecting complex zero-day attacks.The model shows an excellent result in terms of accuracy or recall both separately and overall.

关 键 词：自编码器 零日攻击 入侵检测系统 单类支持向量机 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]