基于图像凸包特征的CBAM-CNN网络入侵检测方法

CBAM-CNN Network-Based Intrusion Detection Method Using Image Convex Hull Features

针对入侵检测领域中多分类准确率较低和模型训练时间较长的问题,文章根据现有的基准数据集NSL-KDD的特点,提出一种新颖且有效的预处理方法。首先,对数据集进行字符特征数值化和归一化处理,并转化成RGB图像数据集;其次,使用Canny边缘检测算法提取图像数据集中的各种攻击类型的边缘特征,根据图像的边缘特征使用凸包算法构建凸包,并计算各类攻击的平均凸包面积、平均凸包周长和平均顶点数,将这3项指标作为RGB的3个通道,分别生成各种攻击类型的凸包特征图;再次,使用拉普拉斯金字塔图像特征融合算法将原始图像数据集与凸包特征图进行融合,构建包含凸包特征的图像数据集,并对训练集中的多数类样本采用随机欠采样,对少数类样本进行仿射变换,生成平衡训练集;最后,基于CBAM-CNN模型进行多分类实验。文章模型在NSL-KDD数据集上的准确率和F1分数分别达到了96.20%和86.71%,优于传统的网络入侵检测方法,且比其他深度学习模型具有更好的检测性能。

To address the issues of low multi-class classification accuracy and lengthy model training time in the field of intrusion detection,this paper proposed a novel and effective preprocessing method based on the characteristics of the existing benchmark dataset NSL-KDD.Firstly,the dataset was numerically encoded and normalized based on character features,and then transformed into an RGB image dataset.Secondly,the Canny edge detection algorithm was employed to extract edge features of various attack types in the image dataset.Based on the edge features of the images,convex hulls were constructed using the convex hull algorithm,and the average convex hull area,average convex hull perimeter,and average number of vertices for each attack class were calculated.These three metrics were used as the RGB's three channels to generate convex hull feature maps for various attack types.Thirdly,the laplacian pyramid image feature fusion algorithm was used to fuse the original image dataset with convex hull feature maps,creating an image dataset containing convex hull features.Majority class samples in the training set were randomly under-sampled,while minority class samples were subjected to affine transformations to generate a balanced training set.Finally,multi-class experiments were conducted based on the CBAM-CNN model.The accuracy and F1 score of this model on the NSL-KDD dataset reach 96.20%and 86.71%,respectively,outperforming traditional network intrusion detection methods and exhibiting better performance than other deep learning models.