计算机应用

• 人工智能与仿真 •    下一篇

基于增量式卷积神经网络的入侵检测方法

肖珂1,刘天一1,孙晓燕2,何云华1,曾凡锋3   

  1. 1. 北方工业大学
    2. 北京飞机维修工程有限公司
    3. 北京,北方工业大学
  • 收稿日期:2020-04-22 修回日期:2020-07-20 发布日期:2020-07-20 出版日期:2020-08-14
  • 通讯作者: 刘天一

Intrusion detection method based on incremental convolution neural network

  • Received:2020-04-22 Revised:2020-07-20 Online:2020-07-20 Published:2020-08-14

摘要: 为使得网络入侵检测模型在不破坏已学样本知识的情况下,具有对新增网络流量数据自适应学习的能力,提出了一种基于增量式多核卷积神经网络的(iMSCNN)入侵检测方法。该方法首先完成多核卷积神经网络(MSCNN)模型的训练,实现对原始网络流量数据局部特征的提取与拼接;然后,对模型进行受控处理,冻结受控单元中参数的更新;接着,为模型中每个卷积层设置线性转化器(LC)作为增量学习过程中的可训练参数,通过线性转化器中较少的参数完成对新增网络流量的学习,实现入侵检测模型的更新;最后,利用所得的增量式入侵检测模型完成对异常网络流量的识别与检测。实验结果验证了此入侵检测方法的有效性,证明此增量式卷积神经网络模型能够保留所学旧知识的同时,提高学习新增知识的效率。

Abstract: In order to make the network intrusion detection model have the ability of self-adaptive learning for new network traffic data without destroying the learned performance, this paper proposes an intrusion detection method based on incremental Multi-Scale Convolution Neural Network (iMSCNN). Firstly, by training the parameters in the Multi-Scale Convolution Neural Network (MSCNN) model, the local features of the original network traffic data are extracted and spliced. Then the model is controlled, and the update of parameters in the controlled element is frozen. Next, the Linear Converter (LC) is set for each convolution layer as the trainable parameter in the incremental learning process, and the new network traffic is learned by the fewer parameters in the LC, so that the intrusion detection model is updated. Finally, the abnormal network traffic is identified and detected by the iMSCNN intrusion detection model. The experimental results verify the effectiveness of this method, and prove that this incremental intrusion detection method can retain the detection performance and improve the efficiency of learning new knowledge.

中图分类号: