关键词: 不均衡数据, 入侵检测, 深度信念网络（DBN）, 极限梯度提升（XGBoost）

Abstract:

In the case of a large amount of distributed data, the existing intrusion detection models have good detection performance. However, the distribution of massive intrusion data in the network is usually unbalanced, and most detection models have low detection rates for rare attack types. Aiming at this problem, an intrusion detection model DBN-XGBDT based on the Decision Tree（DT） is proposed in this paper, which is a Deep Belief Networks（DBN） mixed together with eXtreme Gradient Boosting（XGBoost）. The model inputs the preprocessed data set into the deep belief network to realize the dimensionality reduction processing of the intrusion detection data. The obtained feature data are divided into two groups according to the attack category, and the gradient lifting tree is constructed one by one by the XGBoost algorithm. And it is divided into two categories. Finally, the control variable method and XGBoost’s built-in cross-validation are used to adjust the parameters, and the model parameters are optimally adjusted to effectively detect unknown network attacks. Based on the NSL-KDD data set, the DBN-XGBDT model and the superior models such as XGBoost, DBN-BP and DBN-MSVM are tested. The experimental results show that the accuracy of DBN-XGBDT model is 2.07 and 1.14 percentage points higher than that of the above three single and mixed classification models. The detection rate of U2R is increased to 75.37%, and the average false alarm rate is reduced to 56.23%. The DBN-XGBDT model provides a new method for intrusion detection to process unbalanced data and improve the detection performance of rare attacks.

Key words: unbalanced data, intrusion detection, Deep Belief Networks（DBN）, eXtreme Gradient Boosting（XGBoost）