共形预测框架下的高可靠入侵检测算法

High-Reliability Intrusion Detection Algorithm Under Conformal Prediction Framework

入侵检测算法广泛应用于网络安全领域,然而现有基于机器学习的入侵检测算法仅输出数据的预测结果标签,缺少对预测结果置信值的评价机制,难以确保预测结果的可靠性。提出一种基于共形预测的高可靠入侵检测算法。将共形预测融入到传统机器学习算法中,得到数据分类标签和对应的置信值、可信度,提高网络数据分类的可靠性。通过对网络数据进行数字化、标准化和降维预处理,根据传统机器学习算法的特点,设计在共形预测框架下与各算法相对应的不一致得分计算公式,并引入平滑因子改进p-value的计算公式,使其能够以更平滑的方式计算预测结果 p-value,提高算法的稳定性。实验结果表明,与单独采用SVM、DT和DT-SVM算法相比,该算法在KDD CUP99数据集上分类准确率分别提高11.1、4.6和3.7个百分点,在AWID数据集上分类准确率分别提高4.0、2.5和1.3个百分点,可保证入侵检测结果的高可靠性。

Intrusion detection algorithms are widely used in the field of network security.However,existing intrusion detection algorithms based on machine learning only output prediction result labels for data and lack evaluation mechanisms for the confidence value of prediction results,making it difficult to ensure the reliability of results. This study proposes a high-reliability intrusion detection algorithm based on Conformal Prediction(CP).CP is integrated into a traditional machine learning algorithm to obtain data classification labels and corresponding confidence values to improve the reliability of network data classification. By digitalization,standardization and reducing the dimensionality of network data according to the characteristics of traditional machine learning algorithms,an inconsistent score calculation formula under the CP framework is designed and a smoothing factor is introduced to improve the calculation of p-value. The improved p-value calculation formula can calculate the p-value of prediction results smoothly and improve the overall stability of the algorithm. Experimental results demonstrate that compared to the SVM,DT and DT-SVM algorithms alone,the classification accuracy of the proposed algorithm on the KDD CUP99 dataset is improved by 11.1,4.6,and 3.7 percentage points,respectively,and that on the AWID dataset is improved by 4.0,2.5,and 1.3 percentage points,respectively,which ensures the high-reliability of intrusion detection results.