To solve the problem that current intrusion detection model needs large-scale data in formulating the model in real-time use, an intrusion detection system model based on grey theory （GTIDS） is presented. Grey theor...To solve the problem that current intrusion detection model needs large-scale data in formulating the model in real-time use, an intrusion detection system model based on grey theory （GTIDS） is presented. Grey theory has merits of fewer requirements on original data scale, less limitation of the distribution pattern and simpler algorithm in modeling. With these merits GTIDS constructs model according to partial time sequence for rapid detect on intrusive act in secure system. In this detection model rate of false drop and false retrieval are effectively reduced through twice modeling and repeated detect on target data. Furthermore, GTIDS framework and specific process of modeling algorithm are presented. The affectivity of GTIDS is proved through emulated experiments comparing snort and next-generation intrusion detection expert system （NIDES） in SRI international.展开更多
An abstraction and an investigation to the worth of dendritic cells (DCs) ability to collect, process and present antigens are presented. Computationally, this ability is shown to provide a feature reduction mechanism...An abstraction and an investigation to the worth of dendritic cells (DCs) ability to collect, process and present antigens are presented. Computationally, this ability is shown to provide a feature reduction mechanism that could be used to reduce the complexity of a search space, a mechanism for development of highly specialized detector sets as well as a selective mechanism used in directing subsets of detectors to be activated when certain danger signals are present. It is shown that DCs, primed by different danger signals, provide a basis for different anomaly detection pathways. Different antigen-peptides are developed based on different danger signals present, and these peptides are presented to different adaptive layer detectors that correspond to the given danger signal. Experiments are then undertaken that compare current approaches, where a full antigen structure and the whole repertoire of detectors are used, with the proposed approach. Experiment results indicate that such an approach is feasible and can help reduce the complexity of the problem by significant levels. It also improves the efficiency of the system, given that only a subset of detectors are involved during the detection process. Having several different sets of detectors increases the robustness of the resulting system. Detectors developed based on peptides are also highly discriminative, which reduces the false positives rates, making the approach feasible for a real time environment.展开更多
为了提升入侵检测的准确率,鉴于自编码器在学习特征方面的优势以及残差网络在构建深层模型方面的成熟应用,提出一种基于特征降维的改进残差网络入侵检测模型(improved residual network intrusion detection model based on feature dim...为了提升入侵检测的准确率,鉴于自编码器在学习特征方面的优势以及残差网络在构建深层模型方面的成熟应用,提出一种基于特征降维的改进残差网络入侵检测模型(improved residual network intrusion detection model based on feature dimensionality reduction,IRFD),进而缓解传统机器学习入侵检测模型的低准确率问题。IRFD采用堆叠降噪稀疏自编码器策略对数据进行降维,从而提取有效特征。利用卷积注意力机制对残差网络进行改进,构建能提取关键特征的分类网络,并利用两个典型的入侵检测数据集验证IRFD的检测性能。实验结果表明,IRFD在数据集UNSW-NB15和CICIDS 2017上的准确率均达到99%以上,且F1-score分别为99.5%和99.7%。与基线模型相比,提出的IRFD在准确率、精确率和F1-score性能上均有较大提升。展开更多
现有的多数入侵检测模型通过长短期记忆(long short-term memory,LSTM)网络评估数据之间的时间依赖性。然而,LSTM网络处理序列数据增加了训练模型的计算复杂度和存储成本。为此,提出了基于多头注意力机制和时间卷积网络的无监督入侵检...现有的多数入侵检测模型通过长短期记忆(long short-term memory,LSTM)网络评估数据之间的时间依赖性。然而,LSTM网络处理序列数据增加了训练模型的计算复杂度和存储成本。为此,提出了基于多头注意力机制和时间卷积网络的无监督入侵检测模型(unsupervised intrusion detection model based on multihead attention mechanism or temporal convolutional network,UDMT)。UDMT不依赖于LSTM网络,它利用时间卷积网络和多头注意力机制构建生成对抗网络的生成器和决策器,实现计算的并行化,进而降低复杂度。同时,UDMT不依赖于标签的攻击数据,它具有检测已知攻击和未知攻击的能力。此外,UDMT采用不同的隐藏层模式,配置灵活,以满足不同的检测率和检测时延的要求。相比于两个同类的检测模型,提出的UDMT能获取更高的检测率和更低的检测时延。展开更多
文摘To solve the problem that current intrusion detection model needs large-scale data in formulating the model in real-time use, an intrusion detection system model based on grey theory （GTIDS） is presented. Grey theory has merits of fewer requirements on original data scale, less limitation of the distribution pattern and simpler algorithm in modeling. With these merits GTIDS constructs model according to partial time sequence for rapid detect on intrusive act in secure system. In this detection model rate of false drop and false retrieval are effectively reduced through twice modeling and repeated detect on target data. Furthermore, GTIDS framework and specific process of modeling algorithm are presented. The affectivity of GTIDS is proved through emulated experiments comparing snort and next-generation intrusion detection expert system （NIDES） in SRI international.
基金Project(50275150) supported by the National Natural Science Foundation of ChinaProjects(20040533035, 20070533131) supported by the National Research Foundation for the Doctoral Program of Higher Education of China
文摘An abstraction and an investigation to the worth of dendritic cells (DCs) ability to collect, process and present antigens are presented. Computationally, this ability is shown to provide a feature reduction mechanism that could be used to reduce the complexity of a search space, a mechanism for development of highly specialized detector sets as well as a selective mechanism used in directing subsets of detectors to be activated when certain danger signals are present. It is shown that DCs, primed by different danger signals, provide a basis for different anomaly detection pathways. Different antigen-peptides are developed based on different danger signals present, and these peptides are presented to different adaptive layer detectors that correspond to the given danger signal. Experiments are then undertaken that compare current approaches, where a full antigen structure and the whole repertoire of detectors are used, with the proposed approach. Experiment results indicate that such an approach is feasible and can help reduce the complexity of the problem by significant levels. It also improves the efficiency of the system, given that only a subset of detectors are involved during the detection process. Having several different sets of detectors increases the robustness of the resulting system. Detectors developed based on peptides are also highly discriminative, which reduces the false positives rates, making the approach feasible for a real time environment.
文摘为了提升入侵检测的准确率,鉴于自编码器在学习特征方面的优势以及残差网络在构建深层模型方面的成熟应用,提出一种基于特征降维的改进残差网络入侵检测模型(improved residual network intrusion detection model based on feature dimensionality reduction,IRFD),进而缓解传统机器学习入侵检测模型的低准确率问题。IRFD采用堆叠降噪稀疏自编码器策略对数据进行降维,从而提取有效特征。利用卷积注意力机制对残差网络进行改进,构建能提取关键特征的分类网络,并利用两个典型的入侵检测数据集验证IRFD的检测性能。实验结果表明,IRFD在数据集UNSW-NB15和CICIDS 2017上的准确率均达到99%以上,且F1-score分别为99.5%和99.7%。与基线模型相比,提出的IRFD在准确率、精确率和F1-score性能上均有较大提升。
文摘现有的多数入侵检测模型通过长短期记忆(long short-term memory,LSTM)网络评估数据之间的时间依赖性。然而,LSTM网络处理序列数据增加了训练模型的计算复杂度和存储成本。为此,提出了基于多头注意力机制和时间卷积网络的无监督入侵检测模型(unsupervised intrusion detection model based on multihead attention mechanism or temporal convolutional network,UDMT)。UDMT不依赖于LSTM网络,它利用时间卷积网络和多头注意力机制构建生成对抗网络的生成器和决策器,实现计算的并行化,进而降低复杂度。同时,UDMT不依赖于标签的攻击数据,它具有检测已知攻击和未知攻击的能力。此外,UDMT采用不同的隐藏层模式,配置灵活,以满足不同的检测率和检测时延的要求。相比于两个同类的检测模型,提出的UDMT能获取更高的检测率和更低的检测时延。
