面向网络入侵检测系统的深度卷积神经网络模型

Deep convolutional neural network model for network intrusion detection system

鉴于卷积神经网络(CNN)在计算机视觉等诸多领域取得的巨大成就,提出一种将卷积神经网络应用到网络入侵检测(IDS)领域的方法,以达到网络攻击行为的高准确度识别的目的 .该方法将IDS中的网络数据转化成卷积神经网络能够输入的数据,利用卷积神经网络对大量高维无标签原始数据进行特征降维,再采用BP神经网络反向微调结构参数,从而获得原始数据的最优低维表示.实验中,用Softmax分类器进行网络攻击行为识别,采用KDD CUP99数据集进行实验测试,证明该方法分类效果优于传统机器学习方法,在保证精度的同时,较其方法,该方法误检率平均降低0.5%,是一种可行且高效的方法,为网络入侵检测系统领域提供一种全新的思路.

In view of the tremendous achievements made by the convolutional neural network（ CNN） in many fields,such as computer vision,etc.,a method of applying convolution neural network to the domain of network intrusion detection system（ IDS） was proposed in order to achieve the purpose of high-precision identification of network attack. Firstly,the network data in IDS was transformed into the data that can be input by convolution neural network. Secondly,the convolution neural network was used to reduce the dimensionality of a large number of non-tagged original data,and the optimal low-dimensional representation of the original data was obtained. Finally,Softmax classifier was adopt for the recognition of the network attack behavior. This method aimed at the problem of traditional CNN network structure to improve CNN. KDD CUP99 data set was used to carry out the experimental test. It is proved that the classification effect of this method is better than that of the traditional machine learning method. Comparing the results by two methods under the guaranteed accuracy,the error detection rate of the improved CNN method was reduced by 0. 5 percent on average,demostrating that this method is feasible and efficient,which may provide a new way of thinking for network intrusion detection system.