基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型

燕昺昊; 韩国栋

doi:10.11959/j.issn.2096-109x.2018056

您当前的位置：

首页 >

文章列表页 >

基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型

论文 | 更新时间：2024-06-03

- 基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型
- Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm
- 网络与信息安全学报 2018年4卷第7期页码：48-59
- 作者机构：
- 作者简介：
  
  [ "燕昺昊（1994-），男，山西吕梁人，国家数字交换系统工程技术研究中心硕士生，主要研究方向为机器学习、入侵检测、网络安全。" ]
  [ "韩国栋（1964-），男，山东莱西人，博士，国家数字交换系统工程技术研究中心副教授、硕士生导师，主要研究方向为宽带信息处理、信息安全、芯片设计技术。" ]
- 基金信息：
  
  国家科技重大专项基金资助项目;The National Science Technology Major Project(2016ZX01012101);国家自然科学基金资助项目;The National Natural Science Foundation of China(61572520);国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003)
- DOI：10.11959/j.issn.2096-109x.2018056
  中图分类号： TP393.08
- 网络首发：2018-07，
  
  纸质出版：2018-07-15
- 稿件说明：
移动端阅览
燕昺昊, 韩国栋. 基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型[J]. 网络与信息安全学报, 2018,4(7):48-59.

Binghao YAN, Guodong HAN. Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm[J]. Chinese Journal of Network and Information Security, 2018, 4(7): 48-59.
燕昺昊, 韩国栋. 基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型[J]. 网络与信息安全学报, 2018,4(7):48-59. DOI： 10.11959/j.issn.2096-109x.2018056.

Binghao YAN, Guodong HAN. Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm[J]. Chinese Journal of Network and Information Security, 2018, 4(7): 48-59. DOI： 10.11959/j.issn.2096-109x.2018056.

摘要

已有入侵检测模型普遍只针对网络入侵行为的静态特征进行分析检测，造成检测率低及误报率高等缺陷，且无法有效应用低频攻击。为此提出一种新的基于深度循环神经网络（DRNN）和区域自适应合成过采样算法（RA-SMOTE）的组合式入侵检测模型（DRRS）。首先，RA-SMOTE 对数据集中低频攻击样本进行自适应区域划分，实现差别样本增量，从数据层面提升低频攻击样本数量；其次，利用 DRNN 特有的层间反馈单元，完成多阶段分类特征的时序积累学习，同时多隐层网络结构实现对原始数据分布的最优非线性拟合；最后，使用训练好的DRRS模型完成入侵检测。实验结果表明，相比已有入侵检测模型，DRRS在改善整体检测效果的同时显著提高了低频攻击检测率，且对未知新型攻击具有一定检出率，适用于实际网络环境。

Abstract

Existing intrusion detection models generally only analyze the static characteristics of network intrusion actions

resulting in low detection rate and high false positive rate

and cannot effectively detect low-frequency attacks.Therefore

a novel combinatorial intrusion detection model (DRRS) based on deep recurrent neural network (DRNN) and region adaptive synthetic minority oversampling technique algorithm (RA-SMOTE) was proposed.Firstly

RA-SMOTE divided the low frequency attack samples into different regions adaptively and improved the number of low-frequency attack samples with different methods from the data level.Secondly

the multi-stage classification features were learned by using the level feedback units in DRNN

at the same time

the multi-layer network structure achieved the optimal non-linear fitting of the original data distribution.Finally

the intrusion detection was completed by trained DRRS.The empirical results show that compared with the traditional intrusion detection models

DRRS significantly improves the detection rate of low-frequency attacks and overall detection efficiency.Besides

DRRS has a certain detection rate for unknown new attacks.So DRRS model is effective and suitable for the actual network environment.

关键词

Keywords

references

国家互联网应急中心 . 2017年7月我国互联网安全威胁报告 [R ] . 2017 .

National Internet Emergency Center . The report of China’s Internet security threat in July [R ] . 2017 .

LEI Y , LIU J , YIN H . Intrusion detection techniques based on improved intuitionist fuzzy neural networks [J ] . Applied Mechanics＆ Materials , 2014 , 713-715 ( 1 ): 2507 - 2510 .

THASEEN I S , KUMAR C A . Intrusion detection model using fusion of chi-square feature selection and multi class SVM [J ] . Journal of King Saud University-Computer and Information Sciences , 2016 , 29 ( 4 ): 462 - 472 .

DASTANPOUR A , IBRAHIM S , MASHINCHI R . Comparison of genetic algorithm optimization on artificial neural network and support vector machine in intrusion detection system [C ] // IEEE International Conference on Open Systems , 2014 : 72 - 77 .

ABDLHAMED M , KIFAYAT K , SHI Q . Intrusion prediction systems [J ] . Information Fusion for Cyber-Security Analytics , 2017 , 69 ( 1 ): 155 - 174 .

PARSAEI M , ROSTAMI S , JAVIDAN R . A hybrid data mining approach for intrusion detection on imbalanced NSL-KDD dataset [J ] . International Journal of Advanced Computer Science and Applications , 2016 , 7 ( 6 ): 20 - 25 .

POZI M , SULAIMAN M , MUSTAPHA N . Improving anomalous rare sttack detection rate for intrusion detection system using support vector machine and genetic programming [J ] . Neural Processing Letters , 2016 , 44 ( 2 ): 279 - 290 .

高妮 , 高岭 , 贺毅岳 . 基于自编码网络特征降维的轻量级入侵检测模型 [J ] . 电子学报 , 2017 , 45 ( 3 ): 730 - 739 .

GAO N , GAO L , HE Y Y . A lightweight intrusion detection model based on autoencoder network with feature reduction [J ] . Acta Electronica Sinica , 2017 , 45 ( 3 ): 730 - 739 .

DIRO A , CHILAMKURTI N . Distributed attack detection scheme using deep learning approach for Internet of Things [J ] . Future Generation Computer Systems , 2018 , 82 ( 1 ): 761 - 768 .

CHINCHORE R , SAMBARE S . Intrusion detection system by layered approach and hidden Markov model [J ] . International Journal of Computer Application , 2015 , 5 ( 2 ): 7 - 14 .

CHAWLA NV , BOWYER KW , HALL LO , et al . SMOTE:synthetic minority over-sampling technique [J ] . Journal of Artificial Intelligence Research , 2002 , 16 ( 1 ): 321 - 357 .

HINTON G , SALAKHUTDINOV R . Reducing the dimensionality of data with neural networks [J ] . Science , 2006 , 313 ( 28 ): 504 - 507 .

徐彬 , 陈渤 , 刘宏伟 . 基于注意循环神经网络模型的雷达高分辨率距离像目标识别 [J ] . 电子与信息学报 , 2016 , 38 ( 12 ): 2988 - 2995 .

XU B , CHEN B , LIU H W . Attention-based recurrent neural network model for radar high-resolution range prfile target recognition [J ] // Journal of Electronics ＆ Information Technology , 2016 , 38 ( 12 ): 2988 - 2995 .

THANDA A , VENKATESAN S M . Audio visual speech recognition using deep recurrent neural networks [C ] // IAPR Workshop on Multimodal Pattern Recognition of Social Signals in Human-Computer Interaction , 2016 : 98 - 109 .

GUAMAN F , JOTY S , MARQUEZ L , et al . Machine translation evaluation with neural networks [J ] . Computer Speech ＆ Language , 2017 , 45 ( 1 ): 180 - 200 .

JORDAN MI , . Attractor dynamics and parallelism in connectionist sequential machine [C ] // Eighth Conference of the Cognitive Science Society , 1986 : 531 - 546 .

SONG J , TAKAKURA H , OKABE Y . Statistical analysis of honeypot data and building of Kyoto 2006+ dataset for NIDS evaluation [C ] // The Workshop on Building Analysis Datasets ＆ Gathering Experience Returns for Security . 2011 : 29 - 36 .

TAVALLAEE M , BAGHERI E , LU W . A detailed analysis of the KDD CUP 99 data set [C ] // IEEE International Conference on Computational Intelligence for Security and Defense Applications . 2009 : 53 - 58 .

浏览量

1796

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

面向时延敏感的TRDP安全防护机制

面向软件定义晶上系统的安全多维互连网络