基于多粒度级联森林优化算法的网络入侵检测模型研究  

Research on network intrusion detection model based on multi-granularitycascaded forest optimization algorithm

作　　者：刘学朋 于东升 胡铁娜 李京儒 陈广勇[1] 曲洁[1] Liu Xuepeng;Yu Dongsheng;Hu Tiena;Li Jingru;Chen Guangyong;Qu Jie(Network Security Level Protection Center of the Third Research Institute of the Ministry of Public Security,Beijing 100142,China)

机构地区：[1]公安部第三研究所网络安全等级保护中心,北京100142

出　　处：《网络安全与数据治理》2024年第11期7-12,共6页CYBER SECURITY AND DATA GOVERNANCE

基　　金：基本科研业务费专项资金项目(KYC24363)。

摘　　要：针对大规模网络入侵方式层出不穷,为应对多形态下的网络安全威胁,提出一种基于多粒度级联森林优化算法的网络入侵检测模型。首先对原始数据进行预处理,然后融合Fisher Score算法对不同特征信息进行权重选择排序,最后将其排序后的特征信息送入级联森林的卷积层和森林层,对特征信息进行深度表达和分类,从而得到精准的分类结果。经KDD 99数据集进行验证,在不同测试集占比为90%、70%和30%三组实验情况下,分别实现了98.20%、99.00%、99.27%的分类精度。实验结果证明,所提算法能够准确识别多种网络攻击,为现有网络入侵检测提供有效区分依据。To address the ever-evolving and diverse nature of large-scale network intrusions and the subsequent cybersecurity threats,this paper proposes a network intrusion detection model based on the Multi-Granularity Cascaded Forest(GCForest).The model initially preprocesses raw data,subsequently incorporates the Fisher Score algorithm to rank different feature information by their weights,and ultimately feeds the ranked feature information into the convolutional layer and forest layer of the cascaded forest for deep feature expression and classification,thereby achieving precise classification results.Validation using the KDD 99 dataset demonstrates that under three experimental scenarios with training set proportions of 90%,70%,and 30%,the model achieves classification accuracies of 98.20%,99.00%,and 99.27%respectively.The experimental results prove that the proposed algorithm in this paper can accurately identify various network attacks,providing an effective basis for distinguishing and detecting network intrusions in existing systems.

关 键 词：Fisher Score 随机森林 级联森林 网络入侵 

分 类 号：TP391[自动化与计算机技术—计算机应用技术]