可变融合的随机注意力胶囊网络入侵检测模型

doi:10.11959/j.issn.1000-436x.2020220

摘要/Abstract

摘要：

为了增强检测模型的准确率与泛化性，提出了一种可变融合的随机注意力胶囊网络的入侵检测模型，通过特征动态融合，模型能够更好地捕捉数据特征；同时使用随机注意力机制，减少了对训练数据的依赖，使模型更具有泛化能力。所提模型在NSL-KDD和UNSW-NB15数据集上进行验证，实验表明，模型在2种测试集上的准确率分别达到了99.49%和98.60%。

关键词: 深度学习, 入侵检测, 网络空间安全, 胶囊网络, 随机注意力

Abstract:

In order to enhance the accuracy and generalization of the detection model,an intrusion detection model of random attention capsule network with variable fusion was proposed.Through dynamic feature fusion,the model could better capture data features.At the same time,random attention mechanism was used to reduce the dependence on training data and make the model more generalization.The model was validated on NSL-KDD and UNSW-NB15 datasets.The experimental results show that the accuracy of the model on the two test sets is 99.49% and 98.60% respectively.

Key words: deep learning, intrusion detection, cyberspace security, capsule network, random attention

中图分类号:

TP309

张兴兰,尹晟霖. 可变融合的随机注意力胶囊网络入侵检测模型[J]. 通信学报, 2020, 41(11): 160-168.

Xinglan ZHANG,Shenglin YIN. Intrusion detection model of random attention capsule network based on variable fusion[J]. Journal on Communications, 2020, 41(11): 160-168.

图/表 15

图1

图2

图3

图4

表1

表2

图5

表3

图6

图7

表4

表5

图8

表6

图9

参考文献 17

[1]	LIAO H J , LIN C H R , LIN Y C ,et al. Intrusion detection system:a comprehensive review[J]. Journal of Network ＆ Computer Applications, 2013,36(1): 16-24.
[2]	KIM K , AMINANTO M E . Deep learning in intrusion detection perspective:Overview and further challenges[C]// International Workshop on Big Data ＆ Information Security. Piscataway:IEEE Press, 2018: 5-10.
[3]	TANG T A , MHAMDI L , MCLERNON D ,et al. Deep learning approach for network intrusion detection in software defined networking[C]// International Conference on Wireless Networks ＆ Mobile Communications. Piscataway:IEEE Press, 2016,doi:10.1109/WINCOM.2016.7777224.
[4]	GU G X , CHEN C T , BUEHLER M J . De novo composite design based on machine learning algorithm[J]. Extreme Mechanics Letters, 2017,18: 19-28.
[5]	VINAYAKUMAR R , SOMAN K P , POORNACHANDRAN P . Applying convolutional neural network for network intrusion detection[C]// 2017 International Conference on Advances in Computing,Communications and Informatics . Piscataway:IEEE Press, 2017,doi:10.1109/ICACCI.2017.8126009.
[6]	AL-ZEWAIRI M , ALMAJALI S , AWAJAN A . Experimental evaluation of a multi-layer feed-forward artificial neural network classifier for network intrusion detection system[C]// The 2017 International Conference on New Trends in Computing Sciences. Piscataway:IEEE Press, 2018: 167-172.
[7]	VINAYAKUMAR R , ALAZAB M , KP S ,et al. Deep learning approach for intelligent intrusion detection system[J]. IEEE Access, 2019PP(99): 1-1.
[8]	AZIZJON M , JUMABEK A , KIM W . 1D CNN based network intrusion detection with normalization on imbalanced data[C]// 2020 International Conference on Artificial Intelligence in Information and Communication . Piscataway:IEEE Press, 2020,doi:10.1109/ICAIIC48513.2020.9064976.
[9]	KIM J , KIM J , THU H L T ,et al. Long short term memory recurrent neural network classifier for intrusion detection[C]// International Conference on Platform Technology ＆ Service. Piscataway:IEEE Press, 2016,doi:10.1109/PlatCon.2016.7456805.
[10]	CHEN Y , ABRAHAM A , YANG J . Feature selection and intrusion detection using hybrid flexible neural tree[C]// International Symposium on Neural Networks. Berlin:Springer, 2005: 439-444.
[11]	SABOUR S , FROSST N , HINTON G E . Dynamic routing between capsules[C]// Proceeding of the Neural Information Processing Systems. New York:ACM Press, 2017: 3856-3866.
[12]	HINTON G E , SABOUR S , FROSST N . Matrix capsules with EM routing[C]// Sixth International Conference on Learning Representations. 2018: 1-9.
[13]	TAY Y , BAHRI D , METZLER D ,et al. Synthesizer:rethinking self-attention in transformer models[J]. arXiv Preprint,arXiv:2005.00743v1, 2020
[14]	TAVALLAEE M , BAGHERI E , LU W ,et al. A detailed analysis of the KDD CUP 99 data set[C]// 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. Piscataway:IEEE Press, 2009: 1-6.
[15]	DHANABAL L , SHANTHARAJAH S P . A study on NSL-KDD dataset for intrusion detection system based on classification algorithms[J]. International Journal of Advanced Research in Computer and Communication Engineering, 2015,4(6): 446-452.
[16]	MOUSTAFA N , SLAY J . UNSW-NB15:a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)[C]// Military Communications and Information Systems Conference. Piscataway:IEEE Press, 2015:16.
[17]	DONG B , WANG X . Comparison deep learning method to traditional methods using for network intrusion detection[C]// IEEE International Conference on Communication Software ＆ Networks. Piscataway:IEEE Press, 2016: 581-585.

数据集	Normal/条	DoS/条	Probe/条	U2R/条	R2L/条	Total/条
KDDTrain+	67 345	45 926	11 655	52	995	125 973
KDDTest+	9 711	7 458	2421	200	2 754	22 544

数据集	Normal/条	Fuzzers/条	Analysis/条	Backdoors/条	DoS/条	Exploits/条	Generic/条	Reconnaissance/条	Shellcode/条	Worms/条	Total/条
训练集	56 000	18 184	2 000	1 746	12 264	33 393	40 000	10 491	1 133	130	175 341
测试集	37 000	6 062	677	583	4 089	11 132	18 871	3 496	378	44	82 332

模型	验证集				测试集
模型	AC	P	R	F1-score	AC	P	R	F1-score
KPCA + SVM	98.96%	99.19%	99.22%	99.20%	95.89%	96.23%	96.06%	96.14%
KPCA + KNN	99.33%	99.34%	99.36%	99.35%	97.81%	97.38%	97.89%	97.63%
GBT	99.40%	99.46%	99.47%	99.47%	99.29%	99.23%	99.25%	99.24%
CNN	97.80%	97.82%	97.82%	97.82%	94.69%	94.70%	94.72%	94.71%
CNN+ LSTM	97.88%	97.99%	98.03%	98.01%	95.01%	95.98%	95.99%	95.98%
Vanilla Capsule	99.18%	98.89%	99.19%	99.04%	97.29%	97.30%	97.31%	97.30%
本文模型	99.80%	99.82%	99.82%	99.82%	99.49%	99.47%	99.46%	99.46%

模型	验证集	测试集
Capsule+Self-Attention	99.31%	97.13%
本文模型	99.80%	99.49%

模型	验证集				测试集
模型	AC	P	R	F1-score	AC	P	R	F1-score
KPCA + SVM	98.42%	90.32%	96.33%	93.23%	95.37%	94.99%	95.02%	95.00%
KPCA + KNN	98.79%	98.77%	98.79%	98.78%	96.22%	96.19%	96.17%	96.18%
GBT	99.21%	99.11%	99.10%	99.10%	97.99%	97.98%	97.79%	97.88%
CNN	96.89%	96.90%	96.89%	96.89%	94.20%	94.31%	94.33%	94.32%
CNN + LSTM	97.73%	97.70%	97.71%	97.70%	95.65%	95.34%	95.34%	95.34%
Vanilla Capsule	97.89%	97.83%	97.86%	97.84%	97.47%	97.43%	97.45%	97.44%
本文模型	99.24%	99.21%	99.19%	99.20%	98.60%	98.59%	98.61%	98.60%