基于多通道特征提取的入侵检测模型研究

Research on Intrusion Detection Model Based on Multi-channel Feature Extraction

网络流量数据的高维、冗余和噪声严重影响了入侵检测模型的实时检测能力。为了提高入侵检测模型的检测速度与准确率,提出了一种基于多通道特征提取的入侵检测模型。该模型将深度学习与浅层学习技术相结合,利用多个深度自编码器对无标签的高维数据进行特征提取,再利用支持向量机多分类器对低维数据进行入侵检测。为了评估该模型的有效性,在现有的入侵数据集NSL-KDD与UNSW-NB15上进行试验评估。试验结果表明:相比于单一的支持向量机入侵检测模型,该模型的准确率和检测速度在NSL-KDD上分别提高24.9%和91.69%,在UNSW-NB15上分别提高36.9%和94.91%,从而帮助支持向量机提高了对高维数据的检测能力。

The high dimensionality, redundancy and noise of network traffic data seriously affect the realtime detection capability of the intrusion detection model. In order to improve the detection speed and accuracy of the intrusion detection model, an intrusion detection model based on multi-channel feature extraction has been proposed. The model combines deep learning and shallow learning technology, which uses multiple deep autoencoders to extract features from unlabeled high-dimensional data, and utilizes support vector machine multiclassifiers to perform intrusion detection on low-dimensional data. In order to evaluate the effectiveness of the model, an experimental evaluation is carried out on the existing intrusion data sets including NSL-KDD and UNSW-NB15. The experimental results show that the accuracy and detection speed of this model are improved by 24.9% and 91.69% respectively on NSL-KDD, and 36.9% and 94.91% respectively on UNSW-NB15,compared with the single SVM intrusion detection model. Therefore, the proposed model can help the support vector machine to improve the detection ability of high-dimensional data.