基于SSAE-ResNet的入侵检测模型的研究

Research on Intrusion Detection Model Based on SSAE-ResNet

针对无线局域网流量冗余特征多、安全日益突出、网络入侵检测存在误报和漏报的问题,构建了堆叠稀疏编码器(Stacked Sparse Auto-Encoder,SSAE)和一维残差网络(ResNet)入侵检测模型,以在无线局域网数据集AWID为数据样本,首先对海量高维数据进行数据预处理,将数据处理为模型能够适应的数据类型,然后设计了自编码器和残差网络组合模型。为了避免模型过拟合以及对特征的提取不完全,在自编码器中添加了正则项,并设计堆叠自编码器进行特征提取,将提取到的特征作为分类器的输入,分类器采用改进的一维ResNet设计,使流量数据无需转换为图像,节省数据转换图像的时间。通过实验对比表明,上述模型具有较好检测的效果,运行稳定,从而表明该模型的有效性。

Aiming at the problems of multiple redundant features in wireless LAN traffic,increasingly prominent security,false positives and false negatives in network intrusion detection,this paper proposed an intrusion detection model combined stacked sparse encoder(SSAE) and one-dimensional residual network(ResNet).Using the wireless local area network dataset AWID as the data sample,we first preprocessed the massive high-dimensional data into data types that the model can adapt to.Then,we designed a combination model of autoencoder and residual network.In order to avoid overfitting of the model and incomplete feature extraction,regularization terms were added to the autoencoder,and a stacked autoencoder was designed for feature extraction.The extracted features were used as inputs to the classifier,which adopted an improved one-dimensional ResNet design to save time in converting traffic data into images.The experimental results show that this model has good results,stable running environments,which explains the effectiveness of the model.