基于深度学习的时空特征融合网络入侵检测模型研究  

Research on Deep Learning-based Spatio-temporal Feature Fusion Network Intrusion Detection Model

作　　者：李聪聪 袁子龙[1] 滕桂法 Li Congcong;Yuan Zilong;Teng Guifa(College of Information Science and Technology,Hebei Agricultural University,Baoding,Hebei 071001;Hebei Key Laboratory of Agricultural Big Data(Hebei Agricultural University),Baoding,Hebei 071001)

机构地区：[1]河北农业大学信息科学与技术学院,河北保定071001 [2]河北省农业大数据重点实验室(河北农业大学),河北保定071001

出　　处：《信息安全研究》2025年第2期122-129,共8页Journal of Information Security Research

基　　金：国家自然科学基金项目(U20A20180)。

摘　　要：随着网络攻击日益增多,网络入侵检测系统在维护网络安全方面也越来越重要.目前多数研究采用深度学习的方法进行网络入侵检测,但未充分从多个角度利用流量的特征,同时存在实验数据集过于陈旧的问题.提出了一种并行结构的DSC-Inception-BiLSTM网络,使用最新的数据集评估所设计的网络模型.该模型包括网络流量图像和文本异常流量检测2个分支,分别通过改进的卷积神经网络和循环神经网络提取流量的空间特征和时序特征.最后通过融合时空特征实现网络入侵检测.实验结果表明,在CIC-IDS2017,CSE-CIC-IDS2018,CIC-DDoS2019这3个数据集上,该模型分别达到了99.96%,99.19%,99.95%的准确率,能够对异常流量进行高精度分类,满足入侵检测系统的要求.As the number of network attacks increases,network intrusion detection systems are becoming increasingly important in maintaining network security.Most studies have used deep learning approaches for network intrusion detection but have not fully utilized the features of traffic from multiple perspectives.Additionally,these studies often suffer from the use of outdated experimental datasets.In this paper,a parallel-structured DSC-Inception-BiLSTM network is proposed to evaluate the designed network model using state-of-the-art datasets.The model consists of two branches,network traffic image,and text anomaly traffic detection.Spatial and temporal features of traffic are extracted by improved convolutional neural networks and recurrent neural networks,respectively.Finally,network intrusion detection is achieved by fusing spatio-temporal features.The experimental results show that our model achieves 99.96%,99.19%,and 99.95%accuracy on the three datasets of CIC-IDS 2017,CSE-CIC-IDS 2018 and CIC-DDoS 2019,respectively,effectively classifying the anomalous traffic with high precision and meeting the requirements of intrusion detection system.

关 键 词：网络入侵检测 深度学习 特征融合 深度可分离卷积 INCEPTION 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]