基于改进SMOTE算法的网络入侵检测研究  

Research on network intrusion detection based on improved SMOTE algorithm

作　　者：王震 佟志勇 彭美华 杨自恒[1] WANG Zhen;TONG Zhiyong;PENG Meihua;YANG Ziheng(College of Electronic Engineering,Heilongjiang University,Harbin 150080,China;Data and Infornation Office,Heilongjiang Military Region of the Chinese People’s Liberation Army,Harbin 150001,China)

机构地区：[1]黑龙江大学电子工程学院,哈尔滨150080 [2]中国人民解放军黑龙江省军区数据信息室,哈尔滨150001

出　　处：《黑龙江大学自然科学学报》2024年第4期470-476,共7页Journal of Natural Science of Heilongjiang University

基　　金：国家自然科学基金资助项目(61471158)。

摘　　要：为了解决入侵检测领域中网络异常样本难以捕捉所导致网络数据正负样本不平衡的问题,提出了一种改进的人工少数类过采样法(Synthetic minority oversampling technique,SMOTE)算法,该算法增加了更多具有边界信息的样本,以提升少数样本的数量。通过对预处理后的少量数据进行过采样,实现数据平衡,将平衡后的数据输入机器模型以提高分类结果。在网络安全实验室-知识发现数据库(Network security laboratory-knowledge discovery in databases,NSL-KDD)数据集中使用了多种机器学习模型进行实验。结果表明,改进的SMOTE算法能够有效解决数据样本不平衡问题,相比于不做处理和传统SMOTE算法,具有较高的准确率、精确率、召回率和F1值(F1-score),此模型具有更快的收敛速度。In order to solve the problem of imbalance between positive and negative samples in network data caused by the difficulty of capturing network anomaly samples in the field of intrusion detection,the improved Synthetic minority oversampling technique(SMOTE)algorithm is proposed,which focuses on adding more samples with boundary information to enhance the number of minority samples.The data are balanced by oversampling a small amount of data after pre-processing,and the balanced data are fed into the machine model to improve the classification results.The various machine learning models in the Network security laboratory-knowledge discovery in databases(NSL-KDD)are experimented.The results show that the improved SMOTE algorithm can effectively solve the data sample imbalance problem.Compared with no processing and traditional SMOTE algorithm,the model has higher accuracy,precision,recall,F1-score(F1),and faster convergence speed.

关 键 词：入侵检测 不平衡数据集 人工少数类过采样法 机器学习 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]