摘要
针对数据集中少数分类用例过采样问题,本文依据网络入侵行为具有时序特征的特点,将门控循环单元记忆模块引入递归神经网络当中,提出了一种基于记忆和时序的入侵检测网络模型——GRU-RNN模型。针对原始攻击数据具有离散性且分布较广的问题,对数据进行数值化及归一化的预处理操作,并对攻击的时序性进行分析,探讨门控循环单元在递归神经网络中应用于入侵检测的可行性,构建GRU-RNN网络模型,选取最优的损失函数、分类函数,提出了基于时序的不平衡学习入侵检测模型,用于检测具有时序特征的攻击行为。将模型应用在KDD数据集中进行实验测试,表明与其他不平衡学习方法相比,本模型具有更好的识别率与收敛性。
Aiming at the oversampling problem of a few classification use cases in datasets and according to the time-series characteristics of the network intrusion behavior,the gated recurrent unit(GRU)memory module is introduced into a recurrent neural network(RNN).A new intrusion detection network model,i.e.,GRU-RNN model,is proposed in this paper based on memory and time series.The data are numericalized and normalized,which aims to solve the problem on discrete and widely distributed original attack data.The time-series characteristics of attacks are analyzed by the model,and the feasibility of the application of GRU in intrusion detection in RNNs is investigated.The GRU-RNN model is constructed,and the optimal loss function and classification function are selected.An imbalanced learning intrusion detection model is proposed based on the time series to detect attack behaviors with time-series characteristics.The model is applied to the KDD dataset for testing.The results show that the model has a better recognition rate and convergence than other imbalanced learning methods.
作者
李俊
夏松竹
兰海燕
李守政
孙建国
LI Jun;XIA Songzhu;LAN Haiyan;LI Shouzheng;SUN Jianguo(National Industrial Information Security Development Research Center, Beijing 100040, China;College of Computer Science and Technology, Harbin Engineering University, Harbin 150001, China)
出处
《哈尔滨工程大学学报》
EI
CAS
CSCD
北大核心
2021年第6期879-884,共6页
Journal of Harbin Engineering University
基金
黑龙江省自然科学基金项目(F2018006).
关键词
入侵检测
时序神经网络
优化函数
门控循环单元
One-hot编码
拒绝服务攻击
深度学习
intrusion detection
time-series neural network
optimization function
gated recurrent unit(GRU)
one-hot encoding
denial-of-service attack(DOS)
deep learning
作者简介
李俊,男,研究员;通讯作者:兰海燕,女,讲师,博士,E-mail:lanhaiyan@hrbeu.edu.cn.
