基于DBN和TSVM的混合入侵检测模型研究

RESEARCH ON HYBRID INTRUSION DETECTION MODEL BASED ON DBN AND TSVM

针对传统机器学习方法在处理大规模入侵数据的检测精度低和检测速度慢等问题,提出一种基于深度学习的混合入侵检测模型DBN-PBT-TSVM。该模型利用深度信念网络DBN(Deep Belief Network)减少特征集的维度,获得原始数据集的最优的低维表示;综合对支持向量机TSVM(Twin Support Vector Machine)和偏二叉树的优势,构造了一种基于偏二叉树的对支持向量机多类分类器,对网络入侵数据进行识别。基于KDDCUP'99数据集实验比较的结果表明,DBN-PBT-TSVM模型实现了在保证分类性能的同时,还显著地降低了检测时间,尤其是在处理大规模数据时效果更明显,为入侵检测在处理大规模数据时提供了一种全新的思路。

The traditional machine learning method has low accuracy and slow speed in detection when dealing with large-scale data intrusion. This paper proposes a hybrid intrusion detection model named DBN-PBT-TSVM which is based on the deep learning. Deep Belief Network（ DBN） is utilized to reduce the dimension of the feature set and then the model obtains the optimal low-dimensional representation of the original data set. With combination of Twin Support Vector Machine（ TSVM） and partial binary tree,a multi-class classifier of TSVM is constructed based on the partial binary tree,which can identify the network data intrusion. The experimental results of KDDCUP＇99 data set show that DBN-PBT-TSVM model can ensure the classification performance and also reduce the detection time,especially for largescale data. It provides a new idea for intrusion detection in dealing with large-scale data.