基于深度循环神经网络和改进SMOTE算法的组合式入侵检测模型

Combinatorial intrusion detection model based on deep recurrent neural network and improved SMOTE algorithm

已有入侵检测模型普遍只针对网络入侵行为的静态特征进行分析检测,造成检测率低及误报率高等缺陷,且无法有效应用低频攻击。为此提出一种新的基于深度循环神经网络(DRNN)和区域自适应合成过采样算法(RA-SMOTE)的组合式入侵检测模型(DRRS)。首先,RA-SMOTE对数据集中低频攻击样本进行自适应区域划分,实现差别样本增量,从数据层面提升低频攻击样本数量;其次,利用DRNN特有的层间反馈单元,完成多阶段分类特征的时序积累学习,同时多隐层网络结构实现对原始数据分布的最优非线性拟合;最后,使用训练好的DRRS模型完成入侵检测。实验结果表明,相比已有入侵检测模型,DRRS在改善整体检测效果的同时显著提高了低频攻击检测率,且对未知新型攻击具有一定检出率,适用于实际网络环境。

Existing intrusion detection models generally only analyze the static characteristics of network intrusion actions, resulting in low detection rate and high false positive rate, and cannot effectively detect low-frequency attacks. Therefore, a novel combinatorial intrusion detection model（DRRS） based on deep recurrent neural network（DRNN） and region adaptive synthetic minority oversampling technique algorithm（RA-SMOTE） was proposed. Firstly, RA-SMOTE divided the low frequency attack samples into different regions adaptively and improved the number of low-frequency attack samples with different methods from the data level. Secondly, the multi-stage classification features were learned by using the level feedback units in DRNN, at the same time, the multi-layer network structure achieved the optimal non-linear fitting of the original data distribution. Finally, the intrusion detection was completed by trained DRRS. The empirical results show that compared with the traditional intrusion detection models, DRRS significantly improves the detection rate of low-frequency attacks and overall detection efficiency. Besides, DRRS has a certain detection rate for unknown new attacks. So DRRS model is effective and suitable for the actual network environment.