融合改进堆叠编码器和多层BiLSTM的入侵检测模型  

Fusion of Improved Stacked Encoder and Multi-Layer BiLSTM for Intrusion Detection Model

作　　者：陈虹[1] 姜朝议 金海波 武聪 卢健波 CHEN Hong;JIANG Chaoyi;JIN Haibo;WU Cong;LU Jianbo(College of Software,Liaoning Technical University,Huludao,Liaoning 125105,China;Institute of Science and Technology,Liaoning Technical University,Fuxin,Liaoning 123000,China)

机构地区：[1]辽宁工程技术大学软件学院,辽宁葫芦岛125105 [2]辽宁工程技术大学科学技术研究院,辽宁阜新123000

出　　处：《计算机工程与应用》2025年第3期306-314,共9页Computer Engineering and Applications

基　　金：国家自然科学基金(62173171);辽宁省教育厅科研项目(LJKFZ20220198)。

摘　　要：针对基于机器学习入侵检测模型需要大量特征工程,且对不平衡数据处理欠佳,导致检测率低、误报率高等问题。构建了一种SE-MBL的入侵检测模型。采用自适应合成采样(ADASYN)方法对少数类样本进行样本扩展,解决数据不平衡问题,形成相对对称的数据集。采用改进的堆叠自编码器进行数据降维,消除特征冗余,并引入Dropout机制来增强信息融合,提升模型的泛化能力。提出一种融合一维CNN和多层BiLSTM的模块,分别提取空间特征和时间特征,以提高模型的分类性能。在NSL-KDD和CICIDS2017数据集上的实验结果表明,该模型可以实现较高的正确率和召回率,优于传统机器学习和深度学习方法。Aiming at the problems of machine learning-based intrusion detection model that requires a large amount of feature engineering and poorly handles unbalanced data,resulting in low detection rate and high false alarm rate.An intrusion detection model for SE-MBL is constructed.Firstly,the adaptive synthetic sampling(ADASYN)method is used to expand the samples of a few classes of samples to solve the data imbalance problem and form a relatively symmetric dataset.Secondly,an improved stacked self-encoder is used for data dimensionality reduction to eliminate feature redundancy,and a Dropout mechanism is introduced to enhance information fusion and improve the generalization ability of the model.Finally,a module that fuses one-dimensional CNN and multilayer BiLSTM is proposed to extract spatial and temporal features respectively to improve the classification performance of the model.Experimental results on NSL-KDD and CICIDS2017 datasets show that the model can achieve high correctness and recall,outperforming traditional machine learning and deep learning methods.

关 键 词：网络安全 入侵检测 数据不平衡 数据降维 多层BiLSTM 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]