多通道自编码器深度学习的入侵检测方法

doi:10.3778/j.issn.1673-9418.2007023

摘要/Abstract

摘要：

针对现有的入侵检测方法在检测准确率和误报率方面存在的不足，提出了一种多通道自编码器深度学习的入侵检测方法。该方法分为无监督学习和有监督学习两个阶段：首先分别采用正常流量和攻击流量训练两个独立的自编码器，其重构的两个新特征向量与原始样本共同组成多通道特征向量表示；然后利用一维卷积神经网络（CNN）对多通道特征向量表示进行处理，学习通道之间可能的依赖关系，用于更好地区分正常流量和攻击流量之间的差异。该方法将无监督的多通道特征学习和有监督的跨通道特征依赖学习有机地结合起来，用于训练灵活有效的入侵检测模型，达到极大地提高模型检测准确率的目的。同时，为了优化CNN的超参数并提高网络对通道间依赖关系的辨识效果，利用遗传算法自动寻找CNN模型的最优拓扑集合。实验结果表明，该方法在多个数据集中获得了良好的结果，比其他入侵检测算法具有更好的预测准确性。

关键词: 入侵检测, 自编码器, 深度学习, 多通道, 遗传算法（GA）

Abstract:

Aiming at the shortcomings of the existing intrusion detection methods in detection accuracy and false alarm rate, an intrusion detection method of multi-channel autoencoder deep learning is proposed. The method is divided into two stages: unsupervised learning and supervised learning. Firstly, two independent autoencoders are trained by normal traffic and attack traffic respectively, and the two new feature vectors reconstructed and the original samples form a multi-channel eigenvector representation. Then, the 1-D convolutional neural network (CNN) is used to process the multi-channel eigenvector representation, and the possible dependence between channels is learned to better distinguish the difference between normal traffic and attack traffic. The proposed method combines unsupervised multi-channel feature learning and supervised cross-channel feature dependence learning to train a flexible and effective intrusion detection model, which greatly improves the accuracy of model detection. At the same time, in order to optimize the parameters of CNN and improve the identification effect of network on channel dependence, genetic algorithm is used to automatically find the optimal topology set of CNN model. The experimental results show that the proposed method achieves good results in multiple data sets and has better prediction accuracy than other intrusion detection algorithms.

Key words: intrusion detection, autoencoder, deep learning, multi-channel, genetic algorithm (GA)

杨杰，唐亚纯，谭道军，刘小兵. 多通道自编码器深度学习的入侵检测方法[J]. 计算机科学与探索, 2020, 14(12): 2050-2060.

YANG Jie, TANG Yachun, TAN Daojun, LIU Xiaobing. Intrusion Detection Method of Multi-channel Autoencoder Deep Learning[J]. Journal of Frontiers of Computer Science and Technology, 2020, 14(12): 2050-2060.

参考文献

[1] Vinayakumar R, Alazab M, Soman K P, et al. Deep learning approach for intelligent intrusion detection system[J]. IEEE Access, 2019, 7: 41525-41550.
[2] Naseer S, Saleem Y, Khalid S, et al. Enhanced network anomaly detection based on deep neural networks[J]. IEEE Access, 2018, 6: 48231-48246.
[3] Hassan M M, Gumaei A, Alsanad A, et al. A hybrid deep learning model for efficient intrusion detection in big data environment[J]. Information Sciences, 2020, 513: 386-396.
[4] Wang Y, Feng X N, Qian T Y, et al. Disguised user intrusion detection based on CNN and LSTM deep network[J]. Journal of Frontiers of Computer Science and Technology, 2018, 12(4): 575-585.王毅, 冯小年, 钱铁云, 等. 基于CNN和LSTM深度网络的伪装用户入侵检测[J]. 计算机科学与探索, 2018, 12(4): 575-585.
[5] Vijayanand R, Devaraj D. A novel feature selection method using whale optimization algorithm and genetic operators for intrusion detection system in wireless mesh network[J]. IEEE Access, 2020, 8: 56847-56854.
[6] Labonne M, Olivereau A, Polve B, et al. A cascade-structured meta-specialists approach for neural network-based intrusion detection[C]//Proceedings of the 16th IEEE Consumer Comm-unications & Networking Conference. Piscataway: IEEE, 2019: 1-6.
[7] Lin W H, Lin H C, Wang P, et al. Using convolutional neural networks to network intrusion detection for cyber threats[C]//Proceedings of the 2018 IEEE International Conference on Applied System Innovation. Piscataway: IEEE, 2018: 1107-1110.
[8] Almiani M, Abughazleh A, Alrahayfeh A, et al. Deep recurrent neural network for IoT intrusion detection system[J]. Sim-ulation Modelling Practice and Theory, 2020, 101: 1-20.
[9] Zhang S C, Xie X Y, Xu Y. Intrusion detection method based on dCNN[J]. Journal of Tsinghua University (Natural Science Edition), 2019, 59(1): 46-54.张思聪, 谢晓尧, 徐洋. 基于dCNN的入侵检测方法[J]. 清华大学学报(自然科学版), 2019, 59(1): 46-54.
[10] Alqatf M, Lasheng Y, Alhabib M, et al. Deep learning app-roach combining sparse autoencoder with SVM for network intrusion detection[J]. IEEE Access, 2018, 6: 52843-52856.
[11] Andresini G, Appice A, Mauro N D, et al. Exploiting the auto-encoder residual error for intrusion detection[C]//Proc-eedings of the 2019 IEEE European Symposium on Security and Privacy Workshops. Piscataway: IEEE, 2019: 281-290.
[12] Mirza A H, Cosan S. Computer network intrusion detection using sequential LSTM neural networks autoencoders[C]// Proceedings of the 26th Signal Processing and Communications Applications Conference. Piscataway: IEEE, 2018: 1-4.
[13] Kim T, Suh S C, Kim H J, et al. An encoding technique for CNN-based network anomaly detection[C]//Proceedings of the 2018 International Conference on Big Data. Piscataway: IEEE, 2018: 2960-2965.
[14] Lopez-Martin M, Carro B, Sanchez-Esguevillas A, et al. Shallow neural network with kernel approximation for pred-iction problems in highly demanding data networks[J]. Expert Systems with Applications, 2019, 124: 196-208.
[15] Yan J Q, Jin D, Lee C W, et al. A comparative study of off-line deep learning based network intrusion detection[C]// Proceedings of the 10th International Conference on Ubiquitous and Future Networks. Piscataway: IEEE, 2018: 299-304.
[16] Yang Y Q, Zheng K F, Wu C H, et al. Building an effective intrusion detection system using the modified density peak clustering algorithm and deep belief networks[J]. Applied Sciences, 2019, 9(2): 1-25.
[17] Zhang L, Qian F, Zhao S, et al. Using variational auto-encoders for network representation learning[J]. Journal of Frontiers of Computer Science and Technology, 2019, 13(10): 1733-1744.张蕾, 钱峰, 赵姝, 等. 利用变分自编码器进行网络表示学习[J]. 计算机科学与探索, 2019, 13(10): 1733-1744.
[18] Harbola S, Coors V. One dimensional convolutional neural network architectures for wind prediction[J]. Energy Conversion and Management, 2019, 195: 70-75.