Abstract:

To solve the problem of poor performance of network intrusion detection under unbalanced data, a new intrusion detection model based on cPCA and AMSOM is proposed. By setting a small number of classes as background data, cPCA can reduce the dimension and improve the classifier’s ability to recognize attacks on a small number of classes. AMSOM constructs a more flexible dynamic neuron network in the output layer and maintains the corresponding relationship between the two spaces, which solves the problem of misshapen in the training process of SOM and improves the recognition rate of the clustering results of output neurons. Using NSL-KDD dataset, the experimental results show that the proposed model has good performance against a few network attacks, with higher accuracy, recall rate and [F1] value.

Key words: network security, intrusion detection, neural network, self organizing map, NSL-KDD dataset

摘要：

针对网络入侵检测在数据不均衡下检测性能较差的问题，提出了一种对比主成分分析（cPCA）结合可改变网络结构的自组织映射（AMSOM）的入侵检测模型。通过把少数类设置为背景数据，cPCA在降维的同时提高模型对少数类攻击的识别能力。AMSOM在输出层构建一个更加灵活的动态神经元网络，保持两个空间的对应关系，解决了SOM在训练过程中产生畸形的问题，提高输出神经元的聚类结果识别率。使用NSL-KDD数据集，实验结果表明提出的模型对少数的网络攻击表现出良好的性能，具有更高的准确率、召回率和[F1]值。

关键词: 网络安全, 入侵检测, 神经网络, 自组织映射, NSL-KDD数据集