关键词: 特征选择, 一维卷积, 双向长短期记忆网络, 自注意力机制, 入侵检测

Abstract: As network attacks frequently occur, correct and efficient detection against attack behavior is essential to network security. To detect malicious behavior, this paper proposes a self-attention mechanism using one-dimensional convolutional neural network（1D CNN） and bidirectional long short-term memory network（BiLSTM）. Firstly, random forest is used to select important features as model inputs to reduce the redundancy of input data. Then 1D CNN and BiLSTM are applied to extract spatial and temporal features respectively. The features extracted by the two parallel are merged to obtain the fused features. In order to express useful input information better, the proposed method introduces self-attention mechanism to assign different weights for the fused features, trains them with a gated recurrent unit（GRU） model, and finally uses the softmax function for classification. In order to verify the effectiveness of the model, an evaluation is conducted on the UNSW_NB15 dataset. Experiments show that the model has a significant performance improvement over a single model. This paper combines feature selection and deep learning model, which can effectively remove noise redundancy, speed up model training, and has a good application prospect.

Key words: feature selection, one-dimensional convolution, bidirectional long short-term memory network, self-attention mechanism, intrusion detection