基于尖点突变模型的IP网络异常行为检测方法

由于数据挖掘、贝叶斯等传统异常检测方法仅依据网络正常行为特征而没考虑异常行为特征,致使其异常检测率偏低和误报率偏高,该文基于尖点突变模型而针对性地提出了一种新的IP网络异常行为描述模型及其检测机制。它们充分利用了尖点突变模型的多稳态性和突变性,准确地描述了网络正常行为特征和异常行为特征。最后以Kdd-Cup 99数据集为例,对比了不同机制的异常检测性能,结果显示,与贝叶斯BN和决策树C4.5等机制相比,所提出的检测机制在检测率和误报率方面都有所优势。

人工免疫中一种新的基因库初始化方法

在基于人工免疫的入侵检测研究领域,一般都是应用随机产生字符串的方法来生成检测器。这种方法生成检测器的速度较慢,而且生成的检测器集的检测率低。由于非我样本中存在着关于非我空间的信息,提出通过应用非我样本来初始化基因库并应用基因库来生成检测器的方法来检测入侵。应用KDD Cup 1999入侵检测数据集,通过实验证明该方法是有效的,能更快地生成检测率更高的检测器集。

模糊逻辑理论在入侵检测系统中的应用研究

通过基于模糊逻辑的数据挖掘方法实现特征选择,使用模糊逻辑推理进行数据分析,以及支持响应回卷的模糊默认逻辑推理处理预警响应,使得入侵检测系统在特征选择和预警响应方面得到改善。实验结果显示,该检测方法能够有效检测入侵攻击,具有较低的误报率和漏报率。

基于聚类和支持向量机的入侵检测研究

提出了一种基于聚类和支持向量机的入侵检测算法,该算法可以有效地减小计算复杂性,提高检测性能。算法首先使用K-MEANS聚类算法对数据做一个初步的划分得到多个类;然后考察每个类中数据的标识,只有当类中的数据标识不止一个时才进行支持向量的查找。最后使用KDDCUP1999进行了计算机仿真实验,实验结果说明了该算法的有效性。

半监督学习在网络入侵分类中的应用研究

为了解决网络环境中已标记入侵数据获取代价大的问题,将半监督学习引入网络入侵分类领域。根据网络攻击类型的不同,将少量的已标记入侵数据分为三部分,分别作为最初的训练集训练分类器,形成三个差异较大的初始化分类器。通过三个分类器协同学习,实现对未标记入侵数据进行标记。详细介绍了使用KDD Cup99数据集构造半监督分类实验数据集的过程。实验结果表明,半监督学习能有效地挖掘未标记入侵数据信息,具有较高的入侵分类率。

基于粒子群和支持向量机的网络入侵检测模型的建立与仿真

为了有效增强网络入侵的检测效果,尽可能地预防网络入侵行为的发生,文中基于协同量子粒子群CQPSO算法以及最小二乘支持向量机LSSVM,建立了CQPSO-LSSVM网络入侵检测模型。该模型利用CQPSO算法对网络入侵的相关特征进行选择,从而获得最优特征子集,减少后续LSSVM所需处理的输入特征给数,有效降低计算量,并提高检测效率。经过KDD CUP 99数据集的仿真测试实验,该模型检测效果良好,具有较高的检测率、较低的误报率和漏报率,且检测速率较快,能够满足网络入侵检测的实时性与准确性的要求,为相关网络入侵检测模型的设计和建立提供参考。

基于自适应直觉模糊推理的入侵检测系统设计与实现

通过对入侵检测技术和自适应神经-直觉模糊推理系统的研究,设计并实现了基于自适应直觉模糊推理的入侵检测系统.首先,详细阐述了系统的总体框架设计及各模块的设计.其次,选用KDDCUP99数据集作为入侵检测数据集,对设计的入侵检测系统进行实现,并详细叙述了具体的检测步骤.最后,通过获得的检测结果验证了系统的可行性.

A Novel Intrusion Detection Algorithm Based on Long Short Term Memory Network

In recent years,machine learning technology has been widely used for timely network attack detection and classification.However,due to the large number of network traffic and the complex and variable nature of malicious attacks,many challenges have arisen in the field of network intrusion detection.Aiming at the problem that massive and high-dimensional data in cloud computing networks will have a negative impact on anomaly detection,this paper proposes a Bi-LSTM method based on attention mechanism,which learns by transmitting IDS data to multiple hidden layers.Abstract information and high-dimensional feature representation in network data messages are used to improve the accuracy of intrusion detection.In the experiment,we use the public data set KDD-Cup 99 for verification.The experimental results show that the model can effectively detect unpredictable malicious behaviors under the current network environment,improve detection accuracy and reduce false positive rate compared with traditional intrusion detection methods.

Boosting方法在网络攻击分类中的性能分析

针对KDD CUP99网络攻击数据集的分类建模问题,论文结合NaiveBayes、RIPPER和SVM三类算法分别介绍了各自的学习过程。Boosting方法属提升算法,通过多轮迭代实现弱分类器的加权组合,最终决策结果较基算法较为理想。为分析Boosting方法在KDD CUP99集上的分类性能,实验选用AdaBoost算法为代表,将以上三类算法作为基算法,依次应用到数据集上。分类预测结果表明:RIPPER算法的总体性能优于其他算法,尤其对少类的分类效果较好,使用AdaBoost后,性能改善明显。在不考虑分类效率的前提下,论文所提方法中,基于RIPPER的Boosting对KDD CUP99更为适合。

IoT Wireless Intrusion Detection and Network Traffic Analysis

Enhancement in wireless networks had given users the ability to use the Internet without a physical connection to the router.Almost every Internet of Things(IoT)devices such as smartphones,drones,and cameras use wireless technology(Infrared,Bluetooth,IrDA,IEEE 802.11,etc.)to establish multiple interdevice connections simultaneously.With the flexibility of the wireless network,one can set up numerous ad-hoc networks on-demand,connecting hundreds to thousands of users,increasing productivity and profitability significantly.However,the number of network attacks in wireless networks that exploit such flexibilities in setting and tearing down networks has become very alarming.Perpetrators can launch attacks since there is no first line of defense in an ad hoc network setup besides the standard IEEE802.11 WPA2 authentication.One feasible countermeasure is to deploy intrusion detection systems at the edge of these ad hoc networks(Network-based IDS)or at the node level(Host-based IDS).The challenge here is that there is no readily available benchmark data available for IoT network traffic.Creating this benchmark data is very tedious as IoT can work on multiple platforms and networks,and crafting and labelling such dataset is very labor-intensive.This research aims to study the characteristics of existing datasets available such as KDD-Cup and NSL-KDD,and their suitability for wireless IDS implementation.We hypothesize that network features are parametrically different depending on the types of network and assigning weight dynamically to these features can potentially improve the subsequent threat classifications.This paper analyses packet and flow features for the data packet captured on a wireless network rather than a wired network.Combining domain heuristcs and early classification results,the paper had identified 19 header fields exclusive to wireless network that contain high information gain to be used as ML features in Wireless IDS.

一种半监督网络入侵检测系统SSIDS-CV

为了提高网络入侵检测的性能,提出一种基于半监督学习的网络入侵检测系统SSIDS-CV。系统由网络嗅探器、训练集生成器和半监督分类器三部分组成。通过对无标记入侵数据进行伪标记,将伪标记后的样本加入到有标记数据集中,参与交叉验证,选取能使分类器误差最小的标记作为最终的标记,扩充有标记数据数目,训练入侵检测分类器。使用KDD Cup 99数据集模拟半监督入侵检测过程,实验结果表明SSIDS-CV能有效地挖掘未标记入侵数据信息,具有较高的入侵检测率。

基于智能进化算法的DDoS攻击检测防御研究

为了减少分布式拒绝服务攻击(DDoS),将蚂蚱优化算法(GOA)与机器学习算法结合使用,通过创建入侵检测系统(IDS)来满足监控环境的要求,并能够区分正常和攻击流量。所设计的基于GOA的IDS技术(GOIDS)能够从原始IDS数据集中选择最相关的特征来帮助区分典型的低速DDoS攻击,然后将选择的特征传递给支持向量机(SVM)、决策树(DT)、朴素贝叶斯(NB)和多层感知器(MLP)等分类器来识别攻击类型。利用KDD Cup 99和CIC-IDS 2017公开数据集作为实验数据,仿真结果表明,基于决策树的GOIDS具有较高的检测率和较低的假阳性率。

一种基于聚类的异常入侵检测方法

传统的K均值聚类算法采用欧式距离计算样本间的相似度,由于未考虑不同样本属性对于衡量样本间距离区分度的重要性,导致相似度计算不准确,聚类性能较差。提出了一种改进的K均值聚类算法,通过计算每个属性相对于聚类类别的信息增益率,将信息增益率作为属性权重计算加权欧式距离,使对类别区分度贡献较大的属性拥有较大的权重,以提高样本间的相似性度量的准确性。在经典的入侵检测数据集UCI KDD CUP上的实验结果证明,与传统的基于K均值的入侵检测方法相比,此方法能够有效地提高检测准确率。

基于NDNN的入侵检测系统

本文设计了一种新的深度神经网络(New Deep Neural Network,NDNN)模型,并将其应用到入侵检测系统中.NDNN以其突出的特征学习能力充分学习训练数据的特征,在输出层,NDNN通过Softmax分类器对网络攻击报文与正常报文数据进行识别和分类,检测异常报文与入侵攻击.实验通过对KDD Cup 99数据集进行仿真,实验结果表明本文设计的基于NDNN的入侵检测系统模型,进一步提高了入侵检测系统的精度,增强了网络的安全性.

An Improved Artificial Immune System-Based Network Intrusion Detection by Using Rough Set

With theincreasing worldwide network attacks, intrusion detection (ID) hasbecome a popularresearch topic inlast decade.Several artificial intelligence techniques such as neural networks and fuzzy logichave been applied in ID. The results are varied. Theintrusion detection accuracy is themain focus for intrusion detection systems (IDS). Most research activities in the area aiming to improve the ID accuracy. In this paper, anartificial immune system (AIS) based network intrusion detection scheme is proposed. An optimized feature selection using Rough Set (RS) theory is defined. The complexity issue is addressed in the design of the algorithms. The scheme is tested on the widely used KDD CUP 99 dataset. The result shows that theproposed scheme outperforms other schemes in detection accuracy.

An Active Rule Approach for Network Intrusion Detection with Enhanced C4.5 Algorithm

Intrusion detection systems provide additional defense capacity to a networked information system in addition to the security measures provided by the firewalls. This paper proposes an active rule based enhancement to the C4.5 algorithm for network intrusion detection in order to detect misuse behaviors of internal attackers through effective classification and decision making in computer networks. This enhanced C4.5 algorithm derives a set of classification rules from network audit data and then the generated rules are used to detect network intrusions in a real-time environment. Unlike most existing decision tree based approaches, the spawned rules generated and fired in this work are more effective because the information-theoretic approach minimizes the expected number of tests needed to classify an object and guarantees that a simple (but not necessarily the simplest) tree is found. The main advantage of this proposed algorithm is that the generalization ability of enhanced C4.5 decision trees is better than that of C4.5 decision trees. We have employed data from the third international knowledge discovery and data mining tools competition (KDDcup’99) to train and test the feasibility of this proposed model. By applying the enhanced C4.5 algorithm an average detection rate of 93.28 percent and a false positive rate of 0.7 percent have respectively been obtained in this work.

Comparing the Area of Data Mining Algorithms in Network Intrusion Detection

The network-based intrusion detection has become common to evaluate machine learning algorithms. Although the KDD Cup’99 Dataset has class imbalance over different intrusion classes, still it plays a significant role to evaluate machine learning algorithms. In this work, we utilize the singular valued decomposition technique for feature dimension reduction. We further reconstruct the features form reduced features and the selected eigenvectors. The reconstruction loss is used to decide the intrusion class for a given network feature. The intrusion class having the smallest reconstruction loss is accepted as the intrusion class in the network for that sample. The proposed system yield 97.90% accuracy on KDD Cup’99 dataset for the stated task. We have also analyzed the system with individual intrusion categories separately. This analysis suggests having a system with the ensemble of multiple classifiers;therefore we also created a random forest classifier. The random forest classifier performs significantly better than the SVD based system. The random forest classifier achieves 99.99% accuracy for intrusion detection on the same training and testing data set.

高速铁路信号系统网络入侵检测技术研究

入侵检测作为一种网络主动防御技术,能够有效阻止来自黑客的多种手段攻击。随着机器学习的发展,相关技术也开始应用到入侵检测中。本文采用sklearn库中preprocessing模块的函数对KDD CUP 99数据集进行预处理,基于朴素贝叶斯和逻辑回归算法,建立了网络入侵检测模型,并利用信息增益算法对入侵相关特征进行选择,然后进行训练与预测。实验结果表明,选择特征子集进行训练和预测能够保证预测准确率并大幅提高检测效率。研究成果可为高速铁路信号系统网络入侵检测模型的设计和建立提供参考。