Abstract:

Intrusion detection is an important field. The problems such as high false alarm rate, low detection rate, slow processing speed and high feature dimension plague the experts and scholars in this field. For those problems, this paper proposes an intrusion detection model DT-PCA-DNN combining DT (decision tree), PCA (principal com-ponent analysis) and DNN (deep neural networks) to improve the processing speed of the IDS (intrusion detection system) on the basis of a relatively high detection rate and a relatively low false alarm rate. In order to reduce the overall data volume and speed up the processing speed, DT is used to make a preliminary judgment on the data. The data judged as intrusion by DT are stored in a temporary sample set to optimize DT and DNN, and the data judged as normal are processed by PCA to reduce the data dimension and then processed by DNN for secondary judgment. If the DT structure is too deep, too much normal data will be judged as intrusion data. This will cause the subsequent DNN processing cannot effectively improve the overall accuracy, so DT uses a shallow structure. DNN uses the ReLU activation function that simplifies the calculation process of the neural network and the Adam optimization algorithm with faster convergence speed to speed up the data processing speed. According to the binary and multi-class classification experimental results on the NSL-KDD dataset, compared with other intrusion detection methods that use deep learning, this model, which achieves a relatively high detection rate and has a faster detection speed, solves the real-time problem of intrusion detection effectively.

Key words: decision tree (DT), principal component analysis (PCA), deep neural networks (DNN), intrusion detection

摘要：

当今入侵检测领域作为一个重要领域，虚警率高、检测率低、处理速度慢、特征维度高等问题正困扰着从事这一领域的专家学者。为了解决这些问题，提出基于决策树（DT）与深度神经网络（DNN）以及主成分分析（PCA）的入侵检测模型DT-PCA-DNN，在相对高的检测率和相对低的虚警率的基础上提高入侵检测系统（IDS）的处理速度。为缩小整体数据量达到加快处理速度的目的，首先利用DT对数据初步判别。将DT判别为入侵的数据，存入临时训练样本集以再训练优化DT以及DNN，而DT判别为正常的数据，删除所添加正常标签后用PCA降低数据维度并送入DNN进行二次判别以得出最终结果。DT使用浅层结构以防止过多正常数据被判定为入侵数据，导致后续DNN二次处理时不能有效提高整体准确率。DNN采用简化神经网络计算过程的ReLU激活函数以及收敛速度更快的adam优化算法以加快数据处理速度。经过在NSL-KDD数据集上的二分类及五分类实验验证，相比于其他的应用深度学习的入侵检测方法，所提出模型能够在实现相对高的检测率的同时具有更加迅速的检测速度，有效解决了入侵检测的实时性问题。

关键词: 决策树（DT）, 主成分分析（PCA）, 深度神经网络（DNN）, 入侵检测