摘要
针对传统入侵检测方法受限于数据集类不平衡以及所选特征代表性不强等问题,提出一种基于VAE-CWGAN和特征统计重要性融合的检测方法。首先,为提升数据质量对数据集进行预处理;其次,搭建VAE-CWGAN模型生成新样本以解决数据集类不平衡问题,使分类模型不再偏向于多数类;再次,使用标准差、中值均值差对特征进行排序,并融合其统计重要性来进行特征选择旨在获得代表性更强的特征,从而使模型更好地学习数据信息;最后,通过一维卷积神经网络对特征选择后的混合数据集进行分类。实验结果表明,所提方法在NSL-KDD、UNSW-NB15和CIC-IDS-2017数据集上都表现出较好的性能优势,准确率分别为98.95%、96.24%和99.92%,有效提升了入侵检测性能。
Considering the problems of traditional intrusion detection methods limited by the class imbalance of datasets and the poor representation of selected features,a detection method based on VAE-CWGAN and fusion of statistical importance of features was proposed.Firstly,data preprocessing was conducted to enhance data quality.Secondly,a VAE-CWGAN model was constructed to generate new samples,addressing the problem of imbalanced datasets,ensuring that the classification model no longer biased towards the majority class.Next,standard deviation,difference of median and mean were used to rank the features and fusion their statistical importance for feature selection,aiming to obtain more representative features,which made the model can better learn data information.Finally,the mixed data set after feature selection was classified through a one-dimensional convolutional neural network.Experimental results show that the proposed method demonstrates good performance advantages on three datasets,namely NSL-KDD,UNSW-NB15,and CIC-IDS-2017.The accuracy rates are 98.95%,96.24%,and 99.92%,respectively,effectively improving the performance of intrusion detection.
作者
刘涛涛
付钰
王坤
段雪源
LIU Taotao;FU Yu;WANG Kun;DUAN Xueyuan(Department of Information Security,Naval University of Engineering,Wuhan 430033,China;School of Mathematics and Information Engineering,Xinyang Vocational and Technical College,Xinyang 464000,China;College of Computer and Information Technology,Xinyang Normal University,Xinyang 464000,China)
出处
《通信学报》
EI
CSCD
北大核心
2024年第2期54-67,共14页
Journal on Communications
基金
国家重点研发计划基金资助项目(No.2018YFB0804104)。
关键词
入侵检测
网络流量
类不平衡
特征选择
统计重要性融合
intrusion detection
network traffic
class imbalance
feature selection
fusion of statistical importance
