系统工程与电子技术

• 软件、算法与仿真 • 上一篇    下一篇

面向入侵检测系统的Deep Belief Nets模型

高妮1,2, 高岭1, 贺毅岳1,3     

  1. 1. 西北大学信息科学与技术学院,陕西 西安 710127; 2. 西安财经学院 信息学院,
    陕西 西安 710100; 3. 西北大学经济管理学院,陕西 西安 710127
  • 出版日期:2016-08-25 发布日期:2010-01-03

Deep belief nets model oriented to intrusion detection system

GAO Ni1,2, GAO Ling1, HE Yi-yue1,3   

  1. 1. School of Information Science & Technology, Northwest University, Xi’an 710127, China; 
    2. School of Information, Xi’an University of Finance and Economics, Xi’an 710100, China;
    3. School of Economics and Management, Northwest University, Xi’an 710127, China
  • Online:2016-08-25 Published:2010-01-03

摘要:

连续的网络流量会导致海量数据问题,这为入侵检测提出了新的挑战。为此,提出一种面向入侵检测系统的深度信念网络(deep belief nets oriented to the intrusion detection system, DBN-IDS)模型。首先,通过无监督的、贪婪的算法自底向上逐层训练每一个受限玻尔兹曼机(restricted Boltzmann machine,RBM)网络,使得大量高维、非线性的无标签数据映射为最优的低维表示;然后利用带标签数据被附加到顶层,通过反向传播(back-propagation,BP)算法自顶向下有监督地对RBM网络输出的低维表示进行分类,并同时对RBM网络进行微调;最后,利用NSL-KDD数据集对模型参数和性能进行了深入的分析。实验结果表明,DBN-IDS分类效果优于支持向量机(support vector machine,SVM)和神经网络(neural network,NN),适用于高维、非线性的海量入侵数据的分类处理。

Abstract:

It puts forward a new challenge with intrusion detection, the continuous collection of traffic data by the network leads to the massive data problems. Therefore, a deep belief nets model oriented to the intrusion detection system (DBN-IDS) is proposed. First, an unsupervised, greedy algorithm is employed to train each restricted Boltzmann machine (RBM) at a time by a bottom-up approach, which makes large amounts of nonlinear high-dimensional unlabeled input data can be sampled as optimal low-dimensional feature representations. Second, using the labeled data at the top layer, the supervised back propagation (BP)algorithm is employed in classifying the learned low-dimensional representations and fine-tuning the RBM network simultaneously. The parameters and the performance of the model are deeply analyzed on NSL-KDD dataset. Experimental results demonstrate that the DBN-IDS outperforms the support vector machine (SVM) and neural network (NN), and which is a feasible approach in intrusion classification for the high-dimensional, nonlinear and large-scale data.