结合卷积神经网络和三支决策的入侵检测算法

doi:10.3778/j.issn.1002-8331.2103-0443

摘要/Abstract

摘要： 随着网络入侵行为的多样化和智能化，传统的入侵检测算法在面对高维特征、非线性的海量数据时，存在特征提取不充分、模型分类不够精确等问题，为此，提出了一种结合卷积神经网络（convolutional neural networks，CNN）和三支决策（three-way decision，TWD）的入侵检测算法。卷积神经网络具有优越的特征提取能力；同时，三支决策可以规避因信息不足而盲目分类造成的风险，且减少分类所耗费的时间。该方法通过卷积神经网络对高维数据进行特征提取，构建多粒度特征空间，然后基于三支决策理论对网络行为做出即时决策，对于无法即时决策的网络行为进行延迟决策，即对该部分网络行为再次特征提取以构建不同的粒度特征空间，最后输出分类结果。该方法建立的模型在NSL-KDD、CIC-IDS2017数据集上的实验结果表明，提出的算法可以提升入侵检测系统的性能。

关键词: 卷积神经网络, 三支决策, 特征提取, 入侵检测

Abstract: With the diversification and intelligentization of network intrusion behaviors, traditional intrusion detection algorithms have problems such as inadequate feature extraction and inaccurate model classification when they process massive data with high-dimensional feature and non-linearity. Therefore, an intrusion detection algorithm combining convolutional neural network（CNN） and three-way decision（TWD） is proposed. Convolutional neural network has superior feature extraction ability. At the same time, three-way decision can avoid the risk caused by blind classification due to insufficient information, and reduce the time in classification. This method uses the convolutional neural network to extract high-dimensional data feature and constructs multi-granularity feature space. Then, the real-time decision on network behavior will be made through the theory of three-way decision. When the network behavior cannot be decided immediately, deferred decisions are made. In other words, this part of network behavior will be extracted again to construct feature spaces of different granularity. Finally, the classification results will be output. Experimental results on NSL-KDD and CIC-IDS2017 data sets show that the proposed algorithm can improve the performance of intrusion detection system.

Key words: convolutional neural network（CNN）, three-way decision（TWD）, feature extraction, intrusion detection

吴启睿, 黄树成. 结合卷积神经网络和三支决策的入侵检测算法[J]. 计算机工程与应用, 2022, 58(13): 119-127.

WU Qirui, HUANG Shucheng. Intrusion Detection Algorithm Combining Convolutional Neural Network and Three-Branch Decision[J]. Computer Engineering and Applications, 2022, 58(13): 119-127.

参考文献

[1] GAO X，LIU L Y，ZHU X B.Research on the main threat and prevention technology of computer network security[C]//Proceedings of 2020 Asia Conference on Geological Research and Environmental Technology，2020.
[2] KOCHER G，KUMAR G.Analysis of machine learning algorithms with feature selection for intrusion detection using UNSW-NB15 dataset[J].International Journal of Network Security & Its Applications，2021，13（1）：21-31.
[3] HAMID Y，JOURNAUX L，LEE J A，et al.A novel method for network intrusion detection based on nonlinear SNE and SVM[J].International Journal of Artificial Intelligence and Soft Computing，2018，6（4）：265-286.
[4] ABUROMMAN A A，REAZ M B I.A novel SVM-kNN-PSO ensemble method for intrusion detection system[J].Applied Soft Computing，2016，38：360-372.
[5] MASARAT S，SHARIFIAN S，TAHERI H.Modified parallel random forest for intrusion detection systems[J].The Journal of Supercomputing，2016，72：2235-2258.
[6] GAO N，GAO L，HE Y Y，et al.Intrusion detection model based on deep believing network[J].Journal of Southeast University（English Edition），2015，31（3）：339-346.
[7] ZHANG L B，LI H X，ZHOU X Z，et al.Sequential three-way decision based on multi-granular autoencoder features[J].Information Sciences，2020，507：630-643.
[8] YAN B H，HAN G D.LA-GRU：Building combined intrusion detection model based on imbalanced learning and gated recurrent unit neural network[J].Security and Communication Networks，2018（1）：1-13.
[9] 钱铁云，王毅，张明明，等.基于深度神经网络的入侵检测方法[J].华中科技大学学报（自然科学版），2018，46（1）：6-10.
QIAN T Y，WANG Y，ZHANG M M，et al.Intrusion detection method based on deep neural network[J].Journal of Huazhong University of Science and Technology（Natural Science Edition），2018，46（1）：6-10.
[10] 马明艳，陈伟，吴礼发.基于CNN_BiLSTM网络的入侵检测方法[J].计算机工程与应用，2022，58（10）：116-124.
MA M Y，CHEN W，WU L F.CNN_BiLSTM network based intrusion detection method[J].Computer Engineering and Applications，2022，58（10）：116-124.
[11] 刘月峰，王成，张亚斌，等.用于网络入侵检测的多尺度卷积CNN模型[J].计算机工程与应用，2019，55（3）：90-95.
LIU Y F，WANG C，ZHANG Y B，et al.Multiscale convolution CNN model for network intrusion detection[J].Computer Engineering and Applications，2019，55（3）：90-95.
[12] 杨宏宇，王峰岩.基于改进卷积神经网络的网络入侵检测模型[J].计算机应用，2019，39（9）：2604-2610.
YANG H Y，WANG F Y.Network intrusion detection model based on improved convolutional neural network[J].Journal of Computer Applications，2019，39（9）：2604-2610.
[13] YAO Y.The superiority of three-way decisions in probabilistic rough set models[J].Information Sciences，2011，181（6）：1080-1096.
[14] 贾凡，孔令智.基于卷积神经网络的入侵检测算法[J].北京理工大学学报，2017，37（12）：1271-1275.
JIA F，KONG L Z.Intrusion detection algorithm based on convolutional neural network[J].Transactions of Beijing Institute of Technology，2017，37（12）：1271-1275.
[15] 于洪，王国胤，姚一豫.决策粗糙集理论研究现状与展望[J].计算机学报，2015，38（8）：1628-1639.
YU H，WANG G Y，YAO Y Y.Current research and future respectives on decision-theoretic rough sets[J].Chinese Journal of Computers，2015，38（8）：1628-1639.
[16] 刘盾，梁德翠.广义三支决策与狭义三支决策[J].计算机科学与探索，2017，11（3）：502-510.
LIU D，LIANG D C.Generalized three-way decisions and special three?way decisions[J].Journal of Frontiers of Computer Science and Technology，2017，11（3）：502-510.
[17] GUPTA A，BARBU A.Parameterized principal component analysis[J].arXiv：1608.04695，2016.
[18] LI Y Z，ZHANG S P，LI Y，et al.Research on intrusion detection algorithm based on deep learning and semi-supervised clustering[J].International Journal of Cyber Research and Education（IJCRE），2020，2（2）：38-60.
[19] ZHENG D H，HONG Z，WANG N，et al.An improved LDA?based ELM classification for intrusion detection algorithm in IoT application[J].Sensors，2020，20（6）：1-19.
[20] DU X，LI Y，FENG Z.A semi-supervised intrusion detection algorithm based on auto-encoder[C]//Proceedings of International Conference on Security，Privacy，and Anonymity in Computation，Communication，and Storage，2021.
[21] SHONE N，NGOC T N，PHAI V D，et al.A deep learning approach to network intrusion detection[J].IEEE Transactions on Emerging Topics in Computational Intelligence，2018，2（1）：41-50.
[22] WANG W，SHENG Y，WANG J，et al.HAST-IDS：Learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[J].IEEE Access，2017，6：1792-1806.