基于自编码网络特征降维的轻量级入侵检测模型

doi:10.3969/j.issn.0372-2112.2017.03.033

电子学报 ›› 2017, Vol. 45 ›› Issue (3): 730-739.DOI: 10.3969/j.issn.0372-2112.2017.03.033

基于自编码网络特征降维的轻量级入侵检测模型

高妮^1,2, 高岭¹, 贺毅岳³, 王海¹

1. 西北大学信息科学与技术学院, 陕西西安 710069;
2. 西安财经学院信息学院, 陕西西安 710100;
3. 西北大学经济管理学院, 陕西西安 710127

收稿日期:2015-06-12 修回日期:2015-08-24 出版日期:2017-03-25
- 作者简介:
- 高妮女,1982年生于陕西省咸阳市.博士,讲师.主要研究方向为网络安全、机器学习等.E-mail:gaoni@nwu.edu.cn
- 基金资助:
- 国家自然科学基金 (No.61373176）; 教育部人文社会科学研究青年项目 (No.16XJC630001）; 陕西省自然基金 (No.2015JQ7278）

A Lightweight Intrusion Detection Model Based on Autoencoder Network with Feature Reduction

GAO Ni^1,2, GAO Ling¹, HE Yi-yue³, WANG Hai¹

1. School of Information Science and Technology, Northwest University, Xi'an, Shaanxi 710127, China;
2. School of Information, Xi'an University of Finance and Economics, Xi'an, Shaanxi 710100, China;
3. School of Economics and Management, Northwest University, Xi'an, Shaanxi 710100, China

Received:2015-06-12 Revised:2015-08-24 Online:2017-03-25 Published:2017-03-25
- Supported by:
- National Natural Science Foundation of China (No.61373176); Humanities and Social Science Research Projects of Ministry of Education of China (No.16XJC630001); Nature Foundation of Shaanxi Province (No.2015JQ7278)

摘要/Abstract

摘要：

基于支持向量机（SVM）的入侵检测方法受时间和空间复杂度约束，在高维特征空间计算时面临"维数灾害"的问题.为此，本文提出一种基于自编码网络的支持向量机入侵检测模型（AN-SVM）.首先，该模型采用多层无监督的限制玻尔兹曼机（RBM）将高维、非线性的原始数据映射至低维空间，建立高维空间和低维空间的双向映射自编码网络结构，进而运用基于反向传播网络的自编码网络权值微调算法重构低维空间数据的最优高维表示，从而获得原始数据的相应最优低维表示；最后，采用SVM分类算法对所学习到的最优低维表示进行入侵识别.实验结果表明，AN-SVM模型降低了入侵检测模型中分类的训练时间和测试时间，并且分类效果优于传统算法，是一种可行且高效的轻量级入侵检测模型.

关键词: 特征降维, 自编码网络, 限制玻尔兹曼机, 支持向量机, 入侵检测

Abstract:

Owing to the constraints of time and space complexity,support vector machine (SVM) faced with the problem of ‘curse of dimensionality’ when computation happens in high-dimensional feature space.Therefore,an intrusion detection model of support vector machine based on autoencoder network (AN-SVM) is proposed.First,the multilayer unsupervised restricted boltzmann machine (RBM) in our model is employed in mapping the vector of raw dada from high-dimensional nonlinear space to low-dimensional space,and a mutual mapping autoencoder network of high-dimensional space and low-dimensional space is constructed.Then autoencoder network weights of fine-tuning algorithm based on back propagation network is employed to reconstruct the new optimal high-dimensional representation of data in low-dimensional space,and the corresponding optimal low-dimensional representation of raw data can be obtained.Furthermore,SVM classification algorithm is employed to detect intrusion from the optimal low-dimensional data.The experimental results demonstrate that AN-SVM model can effectively reduce the training time and testing time of classifier in the intrusion detection model and its classification performance outperforms those traditional methods.So,AN-SVM model is a feasible and efficient lightweight intrusion detection model.

Key words: feature reduction, autoencoder network, restricted boltzmann machine, support vector machine, intrusion detection

中图分类号:

TP393.08

高妮, 高岭, 贺毅岳, 等. 基于自编码网络特征降维的轻量级入侵检测模型[J]. 电子学报, 2017, 45(3): 730-739.

GAO Ni, GAO Ling, HE Yi-yue, et al. A Lightweight Intrusion Detection Model Based on Autoencoder Network with Feature Reduction[J]. Acta Electronica Sinica, 2017, 45(3): 730-739.

参考文献

[1] Wang G,Hao J,Ma J,et al.A new approach to intrusion detection using artificial neural networks and fuzzy clustering[J].Expert Systems with Applications,2010,37(9):6225-6232.
[2] Lin W C,Ke S W,Tsai C F.CANN:An intrusion detection system based on combining cluster centers and nearest neighbors[J].Knowledge-Based Systems,2015,78:13-21.
[3] Hoz E D L,Hoz E D L,Ortiz A,et al.Feature selection by multi-objective optimisation:Application to network anomaly detection by hierarchical self-organising maps[J].Knowledge-Based Systems,2014,71:322-338.
[4] Vapnik V N.The nature of statistical learning theory[J].Neural Networks IEEE Transactions on,1995,10(5):988-999.
[5] 尚文利,张盛山,万明,等.基于PSO-SVM的Modbus TCP通讯的异常检测方法[J].电子学报,2014,11(42):2314-2320. Shang Wenli,Zhang Shengshan,Wang Ming,et al.Modbus/TCP communication anomaly detection algorithm based on PSO-SVM[J].Acta Electronica Sinica,2014,11(42):2314-2320.(in Chinese)
[6] Chitrakar R,Huang C.Selection of candidate support vectors in incremental SVM for network intrusion detection[J].Computers & Security,2014,45(3):231-241.
[7] Kuang F,Xu W,Zhang S,Wang Y.A novel approach of KPCA and SVM for intrusion detection[J].Journal of Computational Information Systems,2012,8(8):3237-3244.
[8] Kuang F,Xu W,Zhang S.A novel hybrid KPCA and SVM with GA model for intrusion detection[J].Applied Soft Computing,2014,18(4):178-184.
[9] Ahmad I,Abdullah A,Alghamdi A,et al.Optimized intrusion detection mechanism using soft computing techniques[J].Telecommunication Systems,2013,52(4):2187-2195.
[10] Lakhina S,Joseph S,Verma B.Feature reduction using principal component analysis for effective anomaly-based intrusion detection on NSL-KDD[J].International Journal of Engineering Science & Technology,2010,2(6):1790-1799.
[11] Hinton G E,Salakhutdinov R R.Reducing the dimensionality of data with neural networks[J].Science,2006,313(28):504-507.
[12] Hinton G E,Osindero S.A fast learning algorithm for deep belief nets[J].Neural Computation,2006,18(7):1527-1554.
[13] 余凯,贾磊,陈雨强,等.深度学习的昨天、今天和明天[J].计算机研究与发展,2013,50(9):1799-1804. Yu Kai,Jia Lei,Chen Yuqiang,et al.Deep learning:yesterday,today,and tomorrow[J].Journal of Computer Research and Development,2013,50(9):1799-1804.(in Chinese)
[14] Hinton G E.Training products of experts by minimizing contrastive divergence[J].Neural computation,2002,14(8):1771-1800.
[15] Rumelhart D E,Hinton G E,Williams R J.Learning representations by back-propagating errors[J].Nature,1986,323(6088):533-536.
[16] Stolfo S J,Fan W,Lee W K,et al.Cost-Based Modeling for Fraud and Intrusion Detection:Results from the JAM Project [EB/OL].http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html,2011-06-27.
[17] Chang C C.LIBSVM:a library for support vector machines[J].ACM Transactions on Intelligent Systems & Technology,2011,2(3):389-396.
[18] Larochelle H,Bengio Y,Louradour J,et al.Exploring strategies for training deep neural networks[J].Journal of Machine Learning Research,2009,10(6):1-40.
[19] Williams N,Sebastian Z,Armitage G.A preliminary performance comparison of five machine learning algorithms for practical IP traffic flow classification[J].ACM SIGCOMM Computer Communication Review,2006,36(5):5-16.

基于自编码网络特征降维的轻量级入侵检测模型

A Lightweight Intrusion Detection Model Based on Autoencoder Network with Feature Reduction

PDF

可视化

摘要/Abstract

引用本文

使用本文

参考文献

相关文章 15

编辑推荐

Metrics

[1]	曹源, 宋迪, 胡小溪, 孙永奎. 基于改进时域多尺度散布熵与支持向量机的转辙机故障诊断[J]. 电子学报, 2023, 51(1): 117-127.
[2]	胡向东, 李之涵. 基于胶囊网络的工业互联网入侵检测方法[J]. 电子学报, 2022, 50(6): 1457-1465.
[3]	吴国庆, 王罗胜斌, 庞晨, 李永祯, 王雪松. 雷达极化域变焦角反组合体对抗方法：抗冲淡式干扰[J]. 电子学报, 2022, 50(12): 2969-2983.
[4]	孙晨峰, 吕卫民, 戴洪德, 张浩晨. 一种基于TimeGAN和OCSVM的多元退化设备小子样数据增广方法[J]. 电子学报, 2022, 50(11): 2678-2687.
[5]	杨国为, 万鸣华, 赖志辉, 张凡龙, 黄伟强. 具有合适拒识机制的高正确识别率分类器设计[J]. 电子学报, 2021, 49(8): 1569-1576.
[6]	罗忠涛, 夏杭, 卢琨, 何子述. 超视距雷达中距离-多普勒图的瞬态干扰自动识别方法[J]. 电子学报, 2021, 49(7): 1279-1285.
[7]	钱忠胜, 俞情媛, 宋涛, 朱懿敏, 祝洁, 赵畅. 基于支持向量机回归模型的测试用例生成与重用[J]. 电子学报, 2021, 49(7): 1386-1391.
[8]	张芳鑫, 王法松, 李睿, 左婷. GSSK‑VLC系统中基于SVM的LED选择算法[J]. 电子学报, 2021, 49(7): 1400-1405.
[9]	刘芳, 韩笑. 基于小波变换和深度网络的着陆地貌图像分类[J]. 电子学报, 2021, 49(11): 2171-2176.
[10]	张聿晗, 李艳雄, 江钟杰, 陈昊. 基于联合学习框架的音频场景聚类[J]. 电子学报, 2021, 49(10): 2041-2047.
[11]	刘文军, 郭志民, 吴春明, 阮伟, 周伯阳, 周宁, 吕卓. 基于深度学习的配电网无线通信入侵检测系统[J]. 电子学报, 2020, 48(8): 1538-1544.
[12]	史聪伟, 赵杰煜, 陈瑜. 利用网格卷积特征的三维形变目标分类[J]. 电子学报, 2020, 48(4): 648-653.
[13]	张学军, 景鹏, 何涛, 孙知信. 基于变分模态分解的癫痫脑电信号分类方法[J]. 电子学报, 2020, 48(12): 2469-2475.
[14]	方佳艳, 刘峤. 具有同步化特征选择的迭代紧凑非平行支持向量聚类算法[J]. 电子学报, 2020, 48(1): 44-58.
[15]	周国华, 卢剑炜, 顾晓清, 殷新春. 基于简约凸壳的一类模糊支持向量机[J]. 电子学报, 2019, 47(8): 1708-1716.