基于TCN-BiLSTM的入侵检测算法研究

Study on Intrusion Detection Algorithm Based on TCN-BiLSTM

网络安全直接关系到国家安全,如何准确高效地检测到电网中的网络威胁至关重要。针对传统CNN感受野较小以及未考虑数据时序特征的问题,结合网络流量数据的空间特征和时间特征,提出了一种基于时间卷积网络(TCN)和双向长短期记忆网络(BiLSTM)的注意力入侵检测算法。首先将网络流量特征进行特征编码,再使用森林优化特征筛选算法,减少数据的冗余性;然后进行重采样,解决数据不平衡问题;最后将数据输入到深度神经网络中,处理后的数据经过TCN和BiLSTM网络进行特征学习,通过自注意力机制进行权重分配,最终进行分类,实现入侵检测。在NSL-KDD数据集上进行对比实验,相比CNN-BiLSTM注意力模型,所提方法的准确率提升4.3%,F1值提升1.8%,实验结果表明,该算法能有效地对网络入侵检测进行识别。

Network security is directly related to national security.How to accurately and efficiently detect network threats in the power grid is very important.Aiming at the problems of small receptive field and no consideration of data timing characteristics of traditional CNN,combined with spatial and temporal characteristics of network traffic data,an attention intrusion detection algorithm based on time convolution network(TCN)and BiLSTM is proposed.First,feature coding is performed on network traffic characteristics.Then the forest optimization feature screening algorithm is used to reduce the redundancy of the data,and then resampling is carried out to solve the problem of data imbalance.Finally,the data is input into the deep neural network,and the processed data is extracted by the TCN and BiLSTM networks for feature learning.The self-attention mechanism is used for weight allocation,and finally the classification is carried out to realize the intrusion detection.The data set adopts NSL-KDD,and the experimental results show that the algorithm can identify network intrusion detection effectively.