基于特征选取与树状Parzen估计的入侵检测

doi:10.12305/j.issn.1001-506X.2021.07.27

摘要/Abstract

摘要：

针对目前网络空间安全形势快速变化带来的新风险和新挑战, 提出一种基于相关性分析的特征选取和树状Parzen估计优化的入侵检测方法。首先, 通过基于相关性分析的数据特征选取方法对数据维度进行压缩。其次, 对原始数据集进行特征筛选, 生成新的特征子集。最终, 使用序列模型优化算法中的树状Parzen估计算法对随机森林算法进行模型优化。实验结果表明, 相比其他应用机器学习算法的入侵检测方法, 所提方法在提升综合性能的同时拥有更高的检测效率, 有效地提升了入侵检测技术的实用性。

关键词: 网络安全, 入侵检测, 特征选取, 树状Parzen估计

Abstract:

In response to the new risks and challenges bring about by the rapid changes in the current cyberspace security situation, an intrusion detection method optimized by feature selection based on correlation analysis and tree Parzen estimation (TPE) is proposed. Fistly, the data dimensions are compressed by the method of data feature selection based on correlation analysis. Secondly, feature filtering is performed on the original data set, and a new feature subset is generated. Finally, the random forest algorithm is optimized using the TPE algorithm based on sequential model-based global optimization. Experimental results show that the proposed method has higher detection efficiency while improving the overall performance compared with other intrusion detection methods using machine learning algorithms, and effectively improves the practicability of intrusion detection technology.

Key words: network security, intrusion detection, feature selection, tree Parzen estimation

中图分类号:

TP391

金志刚, 吴桐. 基于特征选取与树状Parzen估计的入侵检测[J]. 系统工程与电子技术, 2021, 43(7): 1954-1960.

Zhigang JIN, Tong WU. Intrusion detection based on feature selection and tree Parzen estimation[J]. Systems Engineering and Electronics, 2021, 43(7): 1954-1960.

图/表 7

图1

图2

图3

表1

表2

图4

图5

参考文献 30

1	DISTIL N. Bad Bot Report 2020: bad bots strike back[EB/OL]. [2020-10-06]. https://www.imperva.com/resources/resource-library/reports/2020-bad-bot-report/.
2	KHRAISAT A , GONDAL I , VAMPLEW P , et al. Survey of intrusion detection systems: techniques, datasets and challenges[J]. Cybersecurity, 2019, 2 (1): 1- 22. doi: 10.1186/s42400-018-0018-3
3	WANG Y , MENG W Z , LI W J , et al. Adaptive machine learning-based alarm reduction via edge computing for distributed intrusion detection systems[J]. Concurrency and Computation: Practice and Experience, 2019, 31 (19): e5101.
4	ZHANG Q , YANG L T , CHEN Z , et al. A survey on deep learning for big data[J]. Information Fusion, 2018, 42, 146- 157. doi: 10.1016/j.inffus.2017.10.006
5	ATHMAJA S, HANUMANTHAPPA M, KAVITHA V. A survey of machine learning algorithms for big data analytics[C]//Proc. of the IEEE International Conference on Innovations in Information, Embedded and Communication Systems, 2017.
6	LI H . Deep learning for natural language processing: advantages and challenges[J]. National Science Review, 2018, 5 (1): 24- 26. doi: 10.1093/nsr/nwx110
7	IBRAHIM M S, VAHDAT A, RANJBAR M, et al. Semi-supervised semantic image segmentation with self-correcting networks[C]//Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
8	TAN M, PANG R, LE Q V. Efficientdet: scalable and efficient object detection[C]//Proc. of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2020.
9	SHONE N , NGOC T N , PHAI V D , et al. A deep learning approach to network intrusion detection[J]. IEEE Trans.on Emerging Topics in Computational Intelligence, 2018, 2 (1): 41- 50. doi: 10.1109/TETCI.2017.2772792
10	AN X S , LYU X , ZHOU X W , et al. Sample selected extreme learning machine based intrusion detection in fog computing and MEC[J]. Wireless Communications and Mobile Computing, 2018, doi: 10.1155/2018/7472095
11	李元兵, 房鼎益, 吴晓南, 等. 基于神经网络的异常入侵检测系统[J]. 系统工程与电子技术, 2005, 27 (9): 1648- 1651. doi: 10.3321/j.issn:1001-506X.2005.09.042
	LI Y B , FANG D Y , WU X N , et al. Anomaly intrusion detection system based on neural network[J]. Systems Engineering and Electronics, 2005, 27 (9): 1648- 1651. doi: 10.3321/j.issn:1001-506X.2005.09.042
12	KIM J, KIM J, THU H L T, et al. Long short term memory recurrent neural network classifier for intrusion detection[C]//Proc. of the IEEE International Conference on Platform Technology and Service, 2016.
13	PUTCHALA M K. Deep learning approach for intrusion detection system (IDS) in the Internet of things (IoT) network using gated recurrent neural networks(GRU)[D]. Dayton: Wright State University, 2017.
14	高妮, 高岭, 贺毅岳. 面向入侵检测系统的Deep Belief Nets模型[J]. 系统工程与电子技术, 2016, 38 (9): 2201- 2207.
	GAO N , GAO L , HE Y Y . Deep belief nets model oriented to intrusion detection system[J]. Systems Engineering and Electronics, 2016, 38 (9): 2201- 2207.
15	AYGUN R C, YAVUZ A G. Network anomaly detection with stochastically improved auto encoder based models[C]//Proc. of the IEEE 4th International Conference on Cyber Security and Cloud Computing, 2017.
16	饶鲜, 杨绍全, 魏青, 等. 基于熵的入侵检测特征参数选择[J]. 系统工程与电子技术, 2006, 28 (4): 599- 601. doi: 10.3321/j.issn:1001-506X.2006.04.029
	RAO X , YANG S Q , WEI Q , et al. Selection intrusion detection parameters using entropy[J]. Systems Engineering and Electronics, 2006, 28 (4): 599- 601. doi: 10.3321/j.issn:1001-506X.2006.04.029
17	HOOGE L , WAUTERS T , VOLCKAERT B , et al. Inter-dataset generalization strength of supervised machine learning methods for intrusion detection[J]. Journal of Information Security and Applications, 2020, 54, 102564. doi: 10.1016/j.jisa.2020.102564
18	KIM J , KIM J , KIM H , et al. CNN-based network intrusion detection against denial-of-service attacks[J]. Electronics, 2020, 9 (6): 916. doi: 10.3390/electronics9060916
19	LIN P, YE K, XU C Z. Dynamic network anomaly detection system by using deep learning techniques[C]//Proc. of the International Conference on Cloud Computing, 2019.
20	WANG W , SHENG Y Q , WANG J L , et al. HAST-IDS: learning hierarchical spatial-temporal features using deep neural networks to improve intrusion detection[J]. IEEE Access, 2018, 6, 1792- 1806. doi: 10.1109/ACCESS.2017.2780250
21	GOOCH J W . Pearson correlation coefficient[M]. Atlanta: Encyclopedic Dictionary of Polymers, 2011.
22	SHARAFALDIN I, LASHKARI A H, GHORBANI A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]//Proc. of the International Confe-rence on Information Systems Security and Privacy, 2018.
23	Canadian Institute for Cybersecurity. A realistic cyber defense dataset (CSE-CIC-IDS2018)[EB/OL]. [2021-05-06]. https://registry.opendata.aws/cse-cic-ids2018/.
24	GHARIB A, SHARAFALDIN I, LASHKARI A H, et al. An evaluation framework for intrusion detection dataset[C]//Proc. of the IEEE International Conference on Information Scie-nce and Security, 2017.
25	CAI J , LUO J W , WANG S L , et al. Feature selection in machine learning: a new perspective[J]. Neurocomputing, 2018, 300 (26): 70- 79.
26	SAPUTRA F A, MASPUTRA M F, SYARIF I, et al. Botnet detection in network system through hybrid low variance filter, correlation filter and supervised mining process[C]//Proc. of the 13th International Conference on Digital Information Mana-gement, 2018.
27	COHEN-ADDAD V, KANADE V, MALLMANN T F, et al. Hierarchical clustering: objective functions and algorithms[C]//Proc. of the 29th Annual ACM-SIAM Symposium on Discrete Algorithms, 2018.
28	LUJAN-MORENO G A , HOWARD P R , ROJAS O G , et al. Design of experiments and response surface methodology to tune machine learning hyper parameters with a random forest case-study[J]. Expert Systems with Applications, 2018, 109, 195- 205. doi: 10.1016/j.eswa.2018.05.024
29	PROBST P , WRIGHT M N , BOULESTEIX A L . Hyperparameters and tuning strategies for random forest[J]. Wiley Interdiplinary Reviews: Data Mining and Knowledge Discovery, 2019, 9 (3): e1301.
30	BERGSTRA J , BARDENET R , BENGIO Y , et al. Algorithms for hyper-parameter optimization[J]. Advances in Neural Information Processing Systems, 2011, 11, 2546- 2554.

超参数	取值范围	取值
nr_estimators	[20, 200]	120
criterion	[Gini, Entropy]	Gini
max_depth	[10, 100]	16
max_depth_true	[True, False]	True
min_samples_leaf	[1, 10]	1
min_samples_split	[2, 10]	7
max_features	[lg2, sqrt]	sqrt

算法	评价指标
算法	A	P	R	F1
基线	0.83	0.69	0.83	0.76
朴素贝叶斯	0.83	0.90	0.83	0.85
逻辑回归	0.94	0.91	0.87	0.89
自适应提升	0.95	0.94	0.93	0.94
随机森林	0.95	0.95	0.94	0.95
文献[17]	0.96	0.99	0.79	-
文献[18]	0.99	0.82	0.82	0.82
文献[19]	0.96	0.96	0.96	0.93
FSCA-TPE-RF	0.97	0.98	0.97	0.97

[1]	马泽煊, 李进, 路艳丽, 陈晨. 融合WaveNet和BiGRU的网络入侵检测方法[J]. 系统工程与电子技术, 2022, 44(8): 2652-2660.
[2]	蚁佳才, 刘斌, 姚莉, 赵文涛. 基于知识推理的卫星网络态势理解[J]. 系统工程与电子技术, 2022, 44(5): 1562-1571.
[3]	何春蓉, 朱江. 基于注意力机制的GRU神经网络安全态势预测方法[J]. 系统工程与电子技术, 2021, 43(1): 258-266.
[4]	李方伟, 李俊瑶, 聂益芳, 朱江. 基于多代理系统的动态信任态势感知机制[J]. 系统工程与电子技术, 2017, 39(5): 1148-1153.
[5]	高妮, 高岭, 贺毅岳. 面向入侵检测系统的Deep Belief Nets模型[J]. 系统工程与电子技术, 2016, 38(9): 2201-2207.
[6]	佟为明, 梁建权, 卢雷, 金显吉. 基于节点信任值的WSNs入侵检测方案[J]. 系统工程与电子技术, 2015, 37(7): 1644-1649.
[7]	钱玉文，宋华菊，赵邦信，张彤芳，郝劲松. 基于校正熵的网络行为隐蔽信道的检测算法[J]. Journal of Systems Engineering and Electronics, 2013, 35(6): 1312-1217.
[8]	井小沛，汪厚祥，聂凯. 基于修正核函数SVM的网络入侵检测[J]. Journal of Systems Engineering and Electronics, 2012, 34(5): 1036-1040.
[9]	程春玲, 余志虎, 张登银, 徐小龙. 基于SSC-tree流聚类的入侵检测算法[J]. Journal of Systems Engineering and Electronics, 2012, 34(3): 625-630.
[10]	王斌1,2,3，吴钦章1，王春鸿1，孙永泉3，杜中平3. 基于安全控制模块的高可信计算机研究[J]. Journal of Systems Engineering and Electronics, 2010, 32(2): 437-440.
[11]	王杰, 石成辉, 刘亚宾. 基于节点共享计数型Bloom filter高效动态数据包过滤方案[J]. Journal of Systems Engineering and Electronics, 2009, 31(9): 2227-2231.
[12]	杜志强, 沈玉龙, 马建峰, 周利华. 基于AKB-OTS的传感器网络广播认证协议 [J]. Journal of Systems Engineering and Electronics, 2009, 31(8): 2008-2012.
[13]	李志华, 王士同. 基于离群聚类的异常入侵检测研究[J]. Journal of Systems Engineering and Electronics, 2009, 31(5): 1227-1230.
[14]	秦华旺, 戴跃伟, 王执铨. 一种基于Petri net的分布式入侵容忍系统模型研究[J]. Journal of Systems Engineering and Electronics, 2009, 31(1): 208-212.
[15]	秦华旺, 戴跃伟, 王执铨. 一种基于Petri net的分布式入侵容忍系统模型研究[J]. Journal of Systems Engineering and Electronics, 2009, 31(01): 208-212.