电子学报 ›› 2017, Vol. 45 ›› Issue (3): 730-739.DOI: 10.3969/j.issn.0372-2112.2017.03.033

• 学术论文 • 上一篇    下一篇

基于自编码网络特征降维的轻量级入侵检测模型

高妮1,2, 高岭1, 贺毅岳3, 王海1   

  1. 1. 西北大学信息科学与技术学院, 陕西西安 710069;
    2. 西安财经学院信息学院, 陕西西安 710100;
    3. 西北大学经济管理学院, 陕西西安 710127
  • 收稿日期:2015-06-12 修回日期:2015-08-24 出版日期:2017-03-25
    • 作者简介:
    • 高妮 女,1982年生于陕西省咸阳市.博士,讲师.主要研究方向为网络安全、机器学习等.E-mail:gaoni@nwu.edu.cn
    • 基金资助:
    • 国家自然科学基金 (No.61373176); 教育部人文社会科学研究青年项目 (No.16XJC630001); 陕西省自然基金 (No.2015JQ7278)

A Lightweight Intrusion Detection Model Based on Autoencoder Network with Feature Reduction

GAO Ni1,2, GAO Ling1, HE Yi-yue3, WANG Hai1   

  1. 1. School of Information Science and Technology, Northwest University, Xi'an, Shaanxi 710127, China;
    2. School of Information, Xi'an University of Finance and Economics, Xi'an, Shaanxi 710100, China;
    3. School of Economics and Management, Northwest University, Xi'an, Shaanxi 710100, China
  • Received:2015-06-12 Revised:2015-08-24 Online:2017-03-25 Published:2017-03-25
    • Supported by:
    • National Natural Science Foundation of China (No.61373176); Humanities and Social Science Research Projects of Ministry of Education of China (No.16XJC630001); Nature Foundation of Shaanxi Province (No.2015JQ7278)

摘要:

基于支持向量机(SVM)的入侵检测方法受时间和空间复杂度约束,在高维特征空间计算时面临"维数灾害"的问题.为此,本文提出一种基于自编码网络的支持向量机入侵检测模型(AN-SVM).首先,该模型采用多层无监督的限制玻尔兹曼机(RBM)将高维、非线性的原始数据映射至低维空间,建立高维空间和低维空间的双向映射自编码网络结构,进而运用基于反向传播网络的自编码网络权值微调算法重构低维空间数据的最优高维表示,从而获得原始数据的相应最优低维表示;最后,采用SVM分类算法对所学习到的最优低维表示进行入侵识别.实验结果表明,AN-SVM模型降低了入侵检测模型中分类的训练时间和测试时间,并且分类效果优于传统算法,是一种可行且高效的轻量级入侵检测模型.

关键词: 特征降维, 自编码网络, 限制玻尔兹曼机, 支持向量机, 入侵检测

Abstract:

Owing to the constraints of time and space complexity,support vector machine (SVM) faced with the problem of ‘curse of dimensionality’ when computation happens in high-dimensional feature space.Therefore,an intrusion detection model of support vector machine based on autoencoder network (AN-SVM) is proposed.First,the multilayer unsupervised restricted boltzmann machine (RBM) in our model is employed in mapping the vector of raw dada from high-dimensional nonlinear space to low-dimensional space,and a mutual mapping autoencoder network of high-dimensional space and low-dimensional space is constructed.Then autoencoder network weights of fine-tuning algorithm based on back propagation network is employed to reconstruct the new optimal high-dimensional representation of data in low-dimensional space,and the corresponding optimal low-dimensional representation of raw data can be obtained.Furthermore,SVM classification algorithm is employed to detect intrusion from the optimal low-dimensional data.The experimental results demonstrate that AN-SVM model can effectively reduce the training time and testing time of classifier in the intrusion detection model and its classification performance outperforms those traditional methods.So,AN-SVM model is a feasible and efficient lightweight intrusion detection model.

Key words: feature reduction, autoencoder network, restricted boltzmann machine, support vector machine, intrusion detection

中图分类号: