摘要
该研究通过评估一个通用特征集对不同网络环境和攻击类型的泛化性能,旨在缩小和实际应用的差距.分别在三个数据集上对两个特征集(NetFlow和CICFlowMeter)进行了评估.实验结果表明,NetFlow特征集显著提高了两种机器学习模型在不同数据集上检测入侵的准确性.此外,由于学习模型的复杂性,一种可解释的人工智能方法(SHAP),被用来解释两个机器学习模型的分类决策.通过在多个不同数据集上分析了特征的Shapley值,以确定每个特征对最终机器学习模型预测结果的影响.
By evaluating the generalization performance of a common feature set for different network environments and attack types,this study aims to narrow the gap between the application and the actual application.Two feature sets(NetFlow and CICFlowMeter)are evaluated on three datasets.The experimental results show that NetFlow feature set can significantly improve the accuracy of intrusion detection on different data sets.In addition,due to the complexity of the learning model,an interpretable artificial intelligence method(SHAP)is used to explain the classification decisions of two machine learning models.In order to determine the influence of each feature on the prediction results of the final machine learning based model,the shapley values of features are analyzed on several different datasets.
作者
魏明锐
WEI Mingrui(School of Economics and Technology, Anhui Agricultural University, Hefei, Anhui 230011)
出处
《绵阳师范学院学报》
2021年第11期83-89,共7页
Journal of Mianyang Teachers＇ College
基金
高校学习成果认定与转换系统数据模型构建与应用研究(KJ2020A1174).
关键词
入侵检测
可解释学习
物联网安全
intrusion detection
interpretable learning
IoT security
