基于LightGBM的网络入侵检测研究

RESEARCH ON NETWORK INTRUSION DETECTION BASED ON LIGHTGBM

针对传统的常用机器学习算法在网络入侵检测中存在准确率不够高、训练速度慢的缺点,提出基于特征选择、LightGBM的网络入侵检测系统。使用PCA进行特征选择,采用QPSO为LightGBM算法选择最优参数,在Spark集群上运行,缩短了训练时间。此外,由于使用了基于PCA的特征选择方法,仅使用了41个特征中的9个(21.95%),达到优于使用全部特征训练模型的性能。在NSL-KDD数据集上测试了提出的系统的性能,其能准确、快速地对入侵行为样本进行识别。

Aiming at the shortcomings of traditional commonly-used machine learning algorithms in network intrusion detection,such as low accuracy and slow training speed,a network intrusion detection system based on feature selection and LightGBM is proposed.The PCA was used for feature selection,and then the QPSO was used to select the optimal parameters for the LightGBM algorithm.It ran on the Spark cluster,which shortened the training time.In addition,because the PCA-based feature selection method was used,only 9 of the 41 features(21.95%)were used,which achieved better performance than training models by using all features.The performance of the proposed system was tested on the NSL-KDD dataset.This system can accurately and quickly identify intrusion behavior samples.