通信学报 ›› 2024, Vol. 45 ›› Issue (2): 54-67.doi: 10.11959/j.issn.1000-436x.2024013

• 学术论文 • 上一篇    

基于VAE-CWGAN和特征统计重要性融合的网络入侵检测方法

刘涛涛1, 付钰1, 王坤1,2, 段雪源1,3   

  1. 1 海军工程大学信息安全系,湖北 武汉 430033
    2 信阳职业技术学院数学与信息工程学院,河南 信阳 464000
    3 信阳师范大学计算机与信息技术学院,河南 信阳 464000
  • 修回日期:2023-11-07 出版日期:2024-02-01 发布日期:2024-02-01
  • 作者简介:刘涛涛(1996− ),男,江西吉安人,海军工程大学博士生,主要研究方向为人工智能、信息处理、网络安全
    付钰(1982− ),女,湖北武汉人,博士,海军工程大学教授、博士生导师,主要研究方向为信息安全、人工智能
    王坤(1981− ),女,河南信阳人,海军工程大学博士生,主要研究方向为信息安全、人工智能
    段雪源(1981− ),男,河南开封人,海军工程大学博士生,主要研究方向为人工智能、信息处理、网络安全
  • 基金资助:
    国家重点研发计划基金资助项目(2018YFB0804104)

Network intrusion detection method based on VAE-CWGAN and fusion of statistical importance of feature

Taotao LIU1, Yu FU1, Kun WANG1,2, Xueyuan DUAN1,3   

  1. 1 Department of Information Security, Naval University of Engineering, Wuhan 430033, China
    2 School of Mathematics and Information Engineering, Xinyang Vocational and Technical College, Xinyang 464000, China
    3 College of Computer and Information Technology, Xinyang Normal University, Xinyang 464000, China
  • Revised:2023-11-07 Online:2024-02-01 Published:2024-02-01
  • Supported by:
    The National Key Research and Development Program of China(2018YFB0804104)

摘要:

针对传统入侵检测方法受限于数据集类不平衡以及所选特征代表性不强等问题,提出一种基于VAE-CWGAN 和特征统计重要性融合的检测方法。首先,为提升数据质量对数据集进行预处理;其次,搭建VAE-CWGAN模型生成新样本以解决数据集类不平衡问题,使分类模型不再偏向于多数类;再次,使用标准差、中值均值差对特征进行排序,并融合其统计重要性来进行特征选择旨在获得代表性更强的特征,从而使模型更好地学习数据信息;最后,通过一维卷积神经网络对特征选择后的混合数据集进行分类。实验结果表明,所提方法在NSL-KDD、UNSW-NB15和CIC-IDS-2017数据集上都表现出较好的性能优势,准确率分别为98.95%、96.24%和99.92%,有效提升了入侵检测性能。

关键词: 入侵检测, 网络流量, 类不平衡, 特征选择, 统计重要性融合

Abstract:

Considering the problems of traditional intrusion detection methods limited by the class imbalance of datasets and the poor representation of selected features, a detection method based on VAE-CWGAN and fusion of statistical importance of features was proposed.Firstly, data preprocessing was conducted to enhance data quality.Secondly, a VAE-CWGAN model was constructed to generate new samples, addressing the problem of imbalanced datasets, ensuring that the classification model no longer biased towards the majority class.Next, standard deviation, difference of median and mean were used to rank the features and fusion their statistical importance for feature selection, aiming to obtain more representative features, which made the model can better learn data information.Finally, the mixed data set after feature selection was classified through a one-dimensional convolutional neural network.Experimental results show that the proposed method demonstrates good performance advantages on three datasets, namely NSL-KDD, UNSW-NB15, and CIC-IDS-2017.The accuracy rates are 98.95%, 96.24%, and 99.92%, respectively, effectively improving the performance of intrusion detection.

Key words: intrusion detection, network traffic, class imbalance, feature selection, fusion of statistical importance

中图分类号: 

No Suggested Reading articles found!