Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm

Binghao YAN; Guodong HAN

doi:10.11959/j.issn.2096-109x.2018056

您当前的位置：

首页 >

文章列表页 >

Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm

Papers | 更新时间：2024-06-03

- Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm
- Chinese Journal of Network and Information Security Vol. 4, Issue 7, Pages: 48-59(2018)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018056
  CLC： TP393.08
- Online First：2018-07，
  
  Published：15 July 2018
- 稿件说明：
移动端阅览
Binghao YAN, Guodong HAN. Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm[J]. Chinese Journal of Network and Information Security, 2018, 4(7): 48-59.
DOI：

Binghao YAN, Guodong HAN. Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm[J]. Chinese Journal of Network and Information Security, 2018, 4(7): 48-59. DOI： 10.11959/j.issn.2096-109x.2018056.

摘要

已有入侵检测模型普遍只针对网络入侵行为的静态特征进行分析检测，造成检测率低及误报率高等缺陷，且无法有效应用低频攻击。为此提出一种新的基于深度循环神经网络（DRNN）和区域自适应合成过采样算法（RA-SMOTE）的组合式入侵检测模型（DRRS）。首先，RA-SMOTE 对数据集中低频攻击样本进行自适应区域划分，实现差别样本增量，从数据层面提升低频攻击样本数量；其次，利用 DRNN 特有的层间反馈单元，完成多阶段分类特征的时序积累学习，同时多隐层网络结构实现对原始数据分布的最优非线性拟合；最后，使用训练好的DRRS模型完成入侵检测。实验结果表明，相比已有入侵检测模型，DRRS在改善整体检测效果的同时显著提高了低频攻击检测率，且对未知新型攻击具有一定检出率，适用于实际网络环境。

Abstract

Existing intrusion detection models generally only analyze the static characteristics of network intrusion actions

resulting in low detection rate and high false positive rate

and cannot effectively detect low-frequency attacks.Therefore

a novel combinatorial intrusion detection model (DRRS) based on deep recurrent neural network (DRNN) and region adaptive synthetic minority oversampling technique algorithm (RA-SMOTE) was proposed.Firstly

RA-SMOTE divided the low frequency attack samples into different regions adaptively and improved the number of low-frequency attack samples with different methods from the data level.Secondly

the multi-stage classification features were learned by using the level feedback units in DRNN

at the same time

the multi-layer network structure achieved the optimal non-linear fitting of the original data distribution.Finally

the intrusion detection was completed by trained DRRS.The empirical results show that compared with the traditional intrusion detection models

DRRS significantly improves the detection rate of low-frequency attacks and overall detection efficiency.Besides

DRRS has a certain detection rate for unknown new attacks.So DRRS model is effective and suitable for the actual network environment.

关键词

Keywords

references

国家互联网应急中心 . 2017年7月我国互联网安全威胁报告 [R ] . 2017 .

National Internet Emergency Center . The report of China’s Internet security threat in July [R ] . 2017 .

LEI Y , LIU J , YIN H . Intrusion detection techniques based on improved intuitionist fuzzy neural networks [J ] . Applied Mechanics＆ Materials , 2014 , 713-715 ( 1 ): 2507 - 2510 .

THASEEN I S , KUMAR C A . Intrusion detection model using fusion of chi-square feature selection and multi class SVM [J ] . Journal of King Saud University-Computer and Information Sciences , 2016 , 29 ( 4 ): 462 - 472 .

DASTANPOUR A , IBRAHIM S , MASHINCHI R . Comparison of genetic algorithm optimization on artificial neural network and support vector machine in intrusion detection system [C ] // IEEE International Conference on Open Systems , 2014 : 72 - 77 .

ABDLHAMED M , KIFAYAT K , SHI Q . Intrusion prediction systems [J ] . Information Fusion for Cyber-Security Analytics , 2017 , 69 ( 1 ): 155 - 174 .

PARSAEI M , ROSTAMI S , JAVIDAN R . A hybrid data mining approach for intrusion detection on imbalanced NSL-KDD dataset [J ] . International Journal of Advanced Computer Science and Applications , 2016 , 7 ( 6 ): 20 - 25 .

POZI M , SULAIMAN M , MUSTAPHA N . Improving anomalous rare sttack detection rate for intrusion detection system using support vector machine and genetic programming [J ] . Neural Processing Letters , 2016 , 44 ( 2 ): 279 - 290 .

高妮 , 高岭 , 贺毅岳 . 基于自编码网络特征降维的轻量级入侵检测模型 [J ] . 电子学报 , 2017 , 45 ( 3 ): 730 - 739 .

GAO N , GAO L , HE Y Y . A lightweight intrusion detection model based on autoencoder network with feature reduction [J ] . Acta Electronica Sinica , 2017 , 45 ( 3 ): 730 - 739 .

DIRO A , CHILAMKURTI N . Distributed attack detection scheme using deep learning approach for Internet of Things [J ] . Future Generation Computer Systems , 2018 , 82 ( 1 ): 761 - 768 .

CHINCHORE R , SAMBARE S . Intrusion detection system by layered approach and hidden Markov model [J ] . International Journal of Computer Application , 2015 , 5 ( 2 ): 7 - 14 .

CHAWLA NV , BOWYER KW , HALL LO , et al . SMOTE:synthetic minority over-sampling technique [J ] . Journal of Artificial Intelligence Research , 2002 , 16 ( 1 ): 321 - 357 .

HINTON G , SALAKHUTDINOV R . Reducing the dimensionality of data with neural networks [J ] . Science , 2006 , 313 ( 28 ): 504 - 507 .

徐彬 , 陈渤 , 刘宏伟 . 基于注意循环神经网络模型的雷达高分辨率距离像目标识别 [J ] . 电子与信息学报 , 2016 , 38 ( 12 ): 2988 - 2995 .

XU B , CHEN B , LIU H W . Attention-based recurrent neural network model for radar high-resolution range prfile target recognition [J ] // Journal of Electronics ＆ Information Technology , 2016 , 38 ( 12 ): 2988 - 2995 .

THANDA A , VENKATESAN S M . Audio visual speech recognition using deep recurrent neural networks [C ] // IAPR Workshop on Multimodal Pattern Recognition of Social Signals in Human-Computer Interaction , 2016 : 98 - 109 .

GUAMAN F , JOTY S , MARQUEZ L , et al . Machine translation evaluation with neural networks [J ] . Computer Speech ＆ Language , 2017 , 45 ( 1 ): 180 - 200 .

JORDAN MI , . Attractor dynamics and parallelism in connectionist sequential machine [C ] // Eighth Conference of the Cognitive Science Society , 1986 : 531 - 546 .

SONG J , TAKAKURA H , OKABE Y . Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation [C ] // The Workshop on Building Analysis Datasets ＆ Gathering Experience Returns for Security . 2011 : 29 - 36 .

TAVALLAEE M , BAGHERI E , LU W . A detailed analysis of the KDD CUP 99 data set [C ] // IEEE International Conference on Computational Intelligence for Security and Defense Applications . 2009 : 53 - 58 .

Views

1796

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

Security scheme for time-critical TRDP message

Secure multidimensional interconnection network for the software defined system on wafer

Related Author

JIANG Yuchang

JIANG Libing

HUANG Kai

Guo Kai

Wang Heng

Ma Ziqiang

HOU Ronghao

HE Ming

Related Institution

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

School of Cyber Security, University of CAS

⁰