联合多重卷积与注意力机制的网络入侵检测

Network intrusion detection based on multiple convolutions and attention mechanism

利用深度学习方法建立一种网络入侵检测模型CAL.该模型通过多重卷积提取数据流的深层特征,利用注意力机制提取代表数据流结构特点的关键特征,以提高对不同数据流特点的表达能力,并通过池化计算压缩数据,提高模型泛化能力,使用基于CuDNN加速的长短时记忆网络,在学习数据流上下文特征和时序信息的同时,加速模型收敛.在数据集UNSW-NB15上进行实验,结果表明,CAL模型的识别准确率为90.37%,多类型入侵流的识别准确率为78.94%,性能表现优于其他已有方法.

A network intrusion detection model named CAL is proposed by using deep learning method.The important features of the data flow are extracted through multiple convolutions in this model.The attention mechanism is utilized to extract the key features representing the structural characteristics of the data flow,so as to express the characteristics of various types of flows.And the pooling calculation is used to compress data and improve the generalization ability of the model.The CuDNN based long short term memory network is applied to accelerate the model convergence and reduce the cost while learn the context characteristics and time related information of the data flow.Experimental results on the UNSW-NB15 dataset show the recognition accuracy of CAL is 90.37%,and the recognition accuracy for multi-type intrusion flows is 78.94%.The performance is better than other existing methods.