Abstract:

In the case of a large amount of distributed data, the existing intrusion detection models have good detection performance. However, the distribution of massive intrusion data in the network is usually unbalanced, and most detection models have low detection rates for rare attack types. Aiming at this problem, an intrusion detection model DBN-XGBDT based on the Decision Tree（DT） is proposed in this paper, which is a Deep Belief Networks（DBN） mixed together with eXtreme Gradient Boosting（XGBoost）. The model inputs the preprocessed data set into the deep belief network to realize the dimensionality reduction processing of the intrusion detection data. The obtained feature data are divided into two groups according to the attack category, and the gradient lifting tree is constructed one by one by the XGBoost algorithm. And it is divided into two categories. Finally, the control variable method and XGBoost’s built-in cross-validation are used to adjust the parameters, and the model parameters are optimally adjusted to effectively detect unknown network attacks. Based on the NSL-KDD data set, the DBN-XGBDT model and the superior models such as XGBoost, DBN-BP and DBN-MSVM are tested. The experimental results show that the accuracy of DBN-XGBDT model is 2.07 and 1.14 percentage points higher than that of the above three single and mixed classification models. The detection rate of U2R is increased to 75.37%, and the average false alarm rate is reduced to 56.23%. The DBN-XGBDT model provides a new method for intrusion detection to process unbalanced data and improve the detection performance of rare attacks.

Key words: unbalanced data, intrusion detection, Deep Belief Networks（DBN）, eXtreme Gradient Boosting（XGBoost）

摘要：

在分布均匀的海量数据情况下，现有的入侵检测模型均具备良好的检测性能。但网络中产生的海量入侵数据的分布通常具有不均衡特点，而大多数检测模型针对罕见攻击类型的检测率低。针对上述问题，提出了一种深度信念网络（Deep Belief Networks，DBN）融合极限梯度提升（eXtreme Gradient Boosting，XGBoost）基于决策树算法（Decision Tree，DT）的入侵检测模型（DBN-XGBDT）。该模型将预处理后的数据集输入深度信念网络中，实现对入侵检测数据的降维处理，将得到的特征数据根据攻击类别任两类为一组，通过XGBoost算法逐一构建梯度提升树并细化为二分类；最后运用控制变量法和XGBoost内置的交叉验证进行调参，择优调整模型参数，对未知网络攻击实现有效检测。基于NSL-KDD数据集对DBN-XGBDT模型与XGBoost、DBN-BP、DBN-MSVM等优越模型进行了检测实验。实验结果表明，DBN-XGBDT模型较上述3个单一、混合分类模型的正确率分别提升2.07个百分点、1.14个百分点，对U2R的检测率提升至75.37%，平均误报率降至56.23%，为入侵检测处理不均衡数据且提高对罕见攻击的检测性能提供了新方法。

关键词: 不均衡数据, 入侵检测, 深度信念网络（DBN）, 极限梯度提升（XGBoost）