基于集成学习的入侵检测模型

Intrusion Detection Model Based on Ensemble Learning

入侵检测系统通过对网络上的恶意行为检测,来保证网络安全和计算机系统的稳定,随着人工智能技术的发展,机器学习与深度学习算法被广泛应用在入侵检测系统中。以入侵检测模型为研究目标,针对网络异常行为检测中的不平衡数据多分类问题,对现有的网络异常行为检测多分类模型进行优化,提出了一种基于卷积神经网络、LSTM(Long Short-Term Memory)神经网络与XGBoost(eXtreme Gradient Boosting)算法集成的检测模型(CNN+LSTM-In-XGBoost)。该模型包括数据预处理、长短期神经网络模型训练、数据降维、采样后XGBoost模型训练3个部分,通过对UNSW-NB15数据集进行实验分析,发现其准确率和分类平均f1-score均高于基准算法,特别少数类样本的分类准确率相比基准机器学习算法与神经网络模型有较大提升。

With the development of artificial intelligence technology,machine learning and deep learning algorithms are widely used in intrusion detection systems.The purpose of the research is to study the intrusion detection model,aiming at the multi-classification problem of unbalanced data in network abnormal behavior detection,the existing multi-classification model of network abnormal behavior detection was optimized,and a detection model(CNN+LSTM-in-XGBoost)was proposed based on the integration of convolutional neural network,LSTM neural network and XGBoost algorithm.The model includes three parts such as data preprocessing,long and short term neural network model training,data dimension reduction,and XGBoost model training after sampling.Through experimental analysis of UNSW-NB15data set,the accuracy and average f1-score of classification are higher than the benchmark algorithm.Compared with the benchmark machine learning algorithm and neural network model,the classification accuracy of special minority samples is greatly improved.