一种基于神经网络的入侵检测技术

Technology of Intrusion Detection Based on Neural Network

应用神经网络技术不仅能识别已知的网络入侵行为,而且也能识别许多未知的网络入侵的变种。BP神经网络是一种成功的神经网络技术,然而,标准BP算法学习速率固定,不能根据实际情况动态改变学习速率。为了自适应当前网络学习的状况,提高网络的收敛速度,提出了一种基于综合增加动量项与自适应调节学习速率相结合的改进BP算法,可以满足入侵检测分类识别的需求。选用Kddcup 1999 Data网络连接数据集进行特征提取和预处理之后,送入神经网络进行训练和测试,得到较高的检测率和较低的误报率。实验表明,基于改进的BP神经网络的入侵检测方法是有效的。

Neural network can recognize the known action of network attacks as well as the unknown variation of the known network intrusion. Neural network based on BP algorithm is a kind of successful technology. However, the learning rate of the standard BP algorithm is static, and cannot be adjusted dynamically according to current real situation. In order to self- adjust the current studying status of neural network and enhance the speed of convergence of network, here present and apply the improved BP algorithm combined a method of adding momentum item（s） with the self- adjusting learning rate in the paper. The improved BPNN can meet the needs of classifted recognition of IDS. Experiments with KDD CUP 1999 network traffic connections which have been preprocessed after feature abstraction have shown that the improved BPNN is effective for intrusion detection owing to good performance of the higher attack detection rate and the lower false positive rate.