基于混合二进制灰狼算法的入侵检测特征选择方法  

INTRUSION DETECTION FEATURE SELECTING METHOD BASED ON HYBRID BINARY GREY WOLF OPTIMIZATION

作　　者：胡琦渊 赵志衡[1] 罗思婕 刘勇[1] Hu Qiyuan;Zhao Zhiheng;Luo Sijie;Liu Yong(School of Electrical Engineering and Automation,Harbin Institute of Technology,Harbin 150001,Heilongjiang,China)

机构地区：[1]哈尔滨工业大学电气工程及自动化学院,黑龙江哈尔滨150001

出　　处：《计算机应用与软件》2024年第11期350-357,共8页Computer Applications and Software

基　　金：2020年工业互联网创新发展工程项目(TC200H037)。

摘　　要：为了减少数据集的冗余特征对入侵检测分类器训练用时和检测精度的影响,对二进制灰狼算法的变异概率问题进行分析,重构逼近向量表达式,改善算法的种群变异机制,加快特征降维,减少分类器训练用时;融入粒子群算法的迭代决策形式,增强算法寻优能力;采用混合二进制灰狼算法进行包裹式特征选择,使得数据集特征结构适合于决策树分类器。经NSL-KDD数据集测试,该方法对DoS、Probe攻击流量的检测精度较好,适合用于数据平衡分布的数据集。In order to reduce the negative impact of data set s redundant features on classifier s training speed and detection accuracy,which is used for intrusion detection,the binary gray wolf optimization(BGWO)mutation probability is analyzed and its mutation related vector s expression is reconstructed,improving BGWO s mutation mechanism,speeding up feature dimensionality reduction,and reducing classifier s training time.In addition,the iterative decision-making form of PSO was integrated,enhancing BGWO s optimization capabilities.Hybrid BGWO was adopted for wrapped feature selection,making data set s feature structure more suitable for the decision tree classifier.The NSL-KDD data set tests show that this method has good detection accuracy for DoS,Probe attack traffic,and is suitable for data sets with balanced data distribution.

关 键 词：二进制灰狼算法 特征选择 入侵检测 决策树 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]