基于CNN和BiLSTM的分层注意力网络入侵检测方法

Hierarchical Attention Network Intrusion Detection Method Based on CNN and BiLSTM

目前基于深度学习的入侵检测方法仍然存在特征提取不足、检测精度不佳等问题。对此,该文提出了一种基于CNN和BiLSTM的分层注意力网络入侵检测方法。在每一个CNN层和BiLSTM层之后引入自注意力机制,单层的CNN和BiLSTM与自注意力机制结合分别形成一个CA和BA结构,用于提取局部的空间特征和时序特征,多层的CA和BA结构组合可以充分学习流量数据的多层次空时特征,将学习到的特征通过拼接操作进行特征融合,最后送入到多层感知机中进行预测分类;针对数据集的类不平衡问题,采用变分自编码器(VAE)对少数类进行数据增强,以平衡数据集。在公开数据集NSL-KDD上的实验结果表明,与其他现有入侵检测方法相比,该方法在二分类中的准确率和F1分数分别达到了85.61%和85.55%,在多分类中的准确率和F1分数分别达到了81.07%和80.63%,有效提高了网络入侵的检测性能。

At present,deep learning-based intrusion detection methods still face problems such as insufficient feature extraction and poor detection accuracy.We propose a multi-layer attention network intrusion detection method based on CNN and BiLSTM.After each CNN layer and BiLSTM layer,a self-attention mechanism is introduced.The single-layer CNN and BiLSTM are combined with the self-attention mechanism to form a CA and BA structure,respectively,for extracting local spatial and temporal features.By combining multi-layer CA and BA structures,the multi-level spatio-temporal features of traffic data can be fully learned.The learned features are merged through concatenation operations and finally fed into a multi-layer perceptron for predictive classification.To address the problem of class imbalance in the dataset,Variational Autoencoder(VAE) is used to enhance the data of minority classes and balance the dataset.The experimental results on the public dataset NSL-KDD show that compared with other existing intrusion detection methods,the accuracy and F1 score of the proposed method in binary classification reach 85.61% and 85.55%,and the accuracy and F1 score in multi-classification reach 81.07% and 80.63%,respectively,effectively improving the detection performance of network intrusion.