基于异常保持的弱监督学习网络入侵检测模型  

Weakly-supervised IDS with abnormal-preserving transformation learning

作　　者：谭郁松[1] 王伟[1] 蹇松雷 易超雄 TAN Yu-song;WANG Wei;JIAN Song-lei;YI Chao-xiong(College of Computer Science and Technology,National University of Defense Technology,Changsha 410073,China)

机构地区：[1]国防科技大学计算机学院,湖南长沙410073

出　　处：《计算机工程与科学》2024年第5期801-809,共9页Computer Engineering & Science

基　　金：国家自然科学基金(U19A2060)。

摘　　要：网络入侵检测系统对维护网络安全至关重要,目前针对只有较少异常标记网络数据的入侵检测场景的研究较少。基于数据的异常保持性,设计了基于异常保持的弱监督学习网络入侵检测模型WIDS-APL,该检测模型包含数据转换层、表征学习层、转换分类层和异常判别层4部分,利用一组可学习的编码器将样本映射到不同区域并压缩到超球体,利用异常样本的标签信息学习正常样本和异常样本的分类界限,得到样本的异常分数。在4个数据集上的测试结果表明了该模型的有效性和鲁棒性,相比4个主流算法,在AUC-ROC值上分别提升了4.80%,5.96%,1.58%和1.73%,在AUC-PR性能上分别提升了15.03%,2.95%,4.71%和9.23%。Network intrusion detection systems are crucial for maintaining network security,and there is currently limited research on intrusion detection scenarios with only a few abnormal markers of network data.This paper designs a weakly-supervised learning intrusion detection model,called WIDS-APL,based on the anomaly retention of data.The detection model consists of four parts:data transformation layer,representation learning layer,transformation classification layer,and anomaly discrimination layer.By using a set of learnable encoders to map samples to different regions and compress them into a hypersphere,the label information of abnormal samples is used to learn the classification boundaries of normal and abnormal samples,and the abnormal score of the samples is obtained.Testing the WIDS-APL system on four datasets demonstrates the effectiveness and robustness of the system,with improvements in the AUC-ROC values of 4.80%,5.96%,1.58%,and 1.73% respectively compared to other mainstream methods.Furthermore,there are enhancements of 15.03%,2.95%,4.71%,and 9.23% in AUC-PR performance.

关 键 词：网络入侵检测 弱监督学习 深度学习 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]