基于BOA-DF-LightGBM的入侵检测方法  

Intrusion Detection Method Based on BOA-DF-LightGBM

作　　者：蒋子昂 朱志亮[1] 翁德华 伍默然 叶南 JIANG Ziang;ZHU Zhiliang;WENG Dehua;WU Moran;YE Nan(Wenzhou University,National-Local Joint Engineering Research Center of Electrical Digital Design Technology,Wenzhou 325035,China;Yalong Intelligent Equipment Group Co.,Ltd.,Wenzhou 325102,China)

机构地区：[1]温州大学电气数字化设计技术国家地方联合工程研究中心,浙江温州325035 [2]亚龙智能装备集团有限公司,浙江温州325102

出　　处：《计算机测量与控制》2024年第12期88-95,共8页Computer Measurement &Control

基　　金：温州市科研项目(ZF2022003)。

摘　　要：入侵检测模型在训练时经常面临数据不平衡问题,即其中正常行为的样本数量远远超过异常入侵行为的样本数量;为解决数据不平衡问题,将深度森林和LightGBM结合作为入侵检测模型,其中通过深度森林中的多粒度扫描生成更丰富的特征作为LightGBM的输入,从而提升分类器的性能;并且深度森林生成的特征表示可以提高少数类样本的可分性,配合LightGBM的权重调整机制,可以更好地处理不平衡数据问题,并通过全局搜索能力强大的棕熊优化算法对模型进行参数调优进一步提升模型的预测准确度;经UNSW_NB15数据集验证所提方法,BOA-DF-LightGBM模型较其他模型指标更为优异,预测准确率达到95.15%,较DF提升了近2%;为进一步验证其对数据不平衡问题的能力,通过更严苛的数据不平衡实验得出,BOA-DF-LightGBM模型在数据不平衡实验中的准确率为94.23%,较DF提升了2.68%,较神经网络模型提升了3.42%;验证了BOA-DF-LightGBM在数据不平衡情况下的有效性和优异性。Intrusion detection models often face the problem of data imbalance during training,that is,the number of samples of normal behavior far exceeds the number of samples of abnormal intrusion behavior.In order to solve the problem of data imbalance,the deep forest and LightGBM are combined as an intrusion detection model,in which richer features are generated by multi-granularity scanning in the deep forest as the input of LightGBM,so as to improve the performance of the classifier.Moreover,the feature representation generated by deep forest can improve the distinguishability of minority samples,and with the weight adjustment mechanism of LightGBM,it can better deal with unbalanced data problems,and the brown bear optimization algorithm with powerful global search ability is used to tune the parameters of the model to further improve the prediction accuracy of the model.The proposed method is verified on the UNSW_NB15 dataset,and the BOA-DF-LightGBM model is better than other model indicators,with the prediction accuracy reaching 95.15%,which is nearly 2%higher than DF.In order to further verify its ability to solve the problem of data imbalance,the accuracy of the BOA-DF-LightGBM model in the data imbalance experiment is 94.23%,which is 2.68%higher than that of DF and 3.42%higher than that of neural network model.The effectiveness and superiority of BOA-DF-LightGBM in the case of data imbalance are verified.

关 键 词：入侵检测 集成学习 棕熊优化算法 深度森林 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]