一种基于改进ReliefF算法的入侵检测模型

An intrusion detection model based on improved ReliefF algorithm

针对现有入侵检测算法中特征提取不充分、未考虑特征权重的影响、模型分类不够精确等问题,提出一种基于改进ReliefF算法的入侵检测模型。通过优化入侵数据特征权重计算,提出改进的ReliefF算法;根据计算特征的Pearson相关系数,建立特征相关性量表。只保留其中一个相关性高的特征,以实现特征的二次优化;对最优特征子集分别使用决策树(decision tree,DT)、k-最近邻(k-nearest neighbor,KNN)、随机森林(random forest,RF)、朴素贝叶斯(naive bayes,NB)和支持向量机(support vector machine,SVM)5种分类器评价该方法的分类性能和准确性。在NSL-KDD和UNSW-NB15两个数据集上的试验结果表明,该方法不仅具有较好的检测性能,还能有效降低特征维度,对分类器的计算复杂度有积极的影响。

Aiming at the problems of insufficient feature extraction in the existing intrusion detection algorithms,the influence of feature weights was not considered,and the model classification was not accurate enough,an intrusion detection model based on the improved ReliefF algorithm was proposed.By optimizing the calculation of the feature weight of the intrusion data,an improved algorithm of ReliefF was proposed,based on the Pearson correlation coefficient of the calculated feature,a feature correlation scale was established.Only one of the features with high correlation was retained to realize the secondary optimization of the features,and finally decision tree,k-nearest neighbor,random forest,naive bayes and support vector machine classifier were used to evaluate the classification performance and accuracy.Experimental results on NSL-KDD and UNSW-NB15 data sets showed that this method could not only effectively reduce the feature dimension,but also had better detection performance,which had a positive effect on the computational complexity of the classifier.