非平衡技术在高速网络入侵检测中的应用

Application of unbalanced data approach in high-speed network intrusion detection

针对现有的高速网络入侵检测系统丢包率高、检测速度慢以及检测算法对不同类型攻击检测的非平衡性等问题,提出了采用两阶段的负载均衡策略的检测模型。在线检测阶段对网络数据包按协议类型进行分流的检测,离线建模阶段对不同协议类型的数据进行学习建模,供在线部分检测。在讨论非平衡数据处理的各种采样技术基础上,采用改进后的过抽样少数样本合成过采样技术(SMOTE)对网络数据进行预处理,采用AdaBoost、随机森林算法等进行分类。另外对特征选取等方面进行了实验,结果表明SMOTE过抽样可提高各少数类的检测,随机森林算法分类效果好而且建模所用的时间稳定。

In view of the current problems of high-speed network intrusion detection system, such as high packet loss rate, slow pace of testing for attacks and unbalanced data for detection, this paper proposed a new two-stage strategy with load balancing intrusion detection model. In the on-line phase, the system captured the packets from network and split into small ones according to the protocol type, and then detected through each sensor. In the off-line phase, training dataset was used to build module which can detect intrusion. The authors discussed different approaches to unbalanced data, empirically evaluated the SMOTE over-sampling approaches and classified with AdaBoost and random forests algorithm. The experimental results show that SMOTE and the AdaBoost Algorithm by using random forests as weak learner not only can provide better performance to small class, but also has steady model building time.