Network intrusion detection model based on improved convolutional neural network

doi:10.11772/j.issn.1001-9081.2019020327

Abstract

Abstract:

Aiming at the problems of deep learning based network intrusion detection technology such as low detection efficiency, easy over-fitting and weak generalization ability of model training, an Improved Convolutional Neural Network (ICNN) based Intrusion Detection Model (IBIDM) was proposed. Different from the traditional "convolution-pooling-full connection" cascading network design method, the model adopted the design method of cross-layer aggregation network. Firstly, the pre-processed training set data was forwardly propagated as input data and the network features were extracted, and the merge operation was performed on the output data of the cross-layer aggregation network. Then, the training error was calculated according to the classification result and the model was iteratively optimized to convergence by the back propagation process. Finally, a classification test experiment was performed on the test dataset using the trained classifier. The experimental results show that IBIDM has high intrusion detection accuracy and true positive rate, and its false positive rate is low.

Key words: network intrusion detection, convolutional neural network, forward propagation, cross-layer aggregation, iterative optimization

摘要：

针对基于深度学习的网络入侵检测技术存在检测效率低、模型训练易出现过拟合和泛化能力较弱的问题，提出一种基于改进卷积神经网络（ICNN）的入侵检测模型（IBIDM）。与传统"卷积-池化-全连接"层叠式网络设计方式不同，该模型采用跨层聚合网络的设计方式。首先，将预处理后的训练集数据作为输入数据前向传播并提取网络特征，对跨层聚合网络的输出数据执行合并操作；然后，根据分类结果计算训练误差并通过反向传播过程进行迭代优化至模型收敛；最后，利用训练好的分类器对测试数据集进行分类测试。实验结果表明，IBIDM具有较高的入侵检测准确率和真正率，且误报率较低。

关键词: 网络入侵检测, 卷积神经网络, 前向传播, 跨层聚合, 迭代优化

CLC Number:

YANG Hongyu, WANG Fengyan. Network intrusion detection model based on improved convolutional neural network[J]. Journal of Computer Applications, 2019, 39(9): 2604-2610.

杨宏宇, 王峰岩. 基于改进卷积神经网络的网络入侵检测模型[J]. 计算机应用, 2019, 39(9): 2604-2610.

References

[1] ZHENG K, CAI Z, ZHANG X, et al. Algorithms to speedup pattern matching for network intrusion detection systems[J]. Computer Communications, 2015, 62(C):47-58.
[2] SUNG J S, KANG S M, KWON T G. Pattern matching acceleration for network intrusion detection systems[C]//Proceedings of the 2005 International Conference on Embedded Computer Systems:Architectures, Modeling, and Simulation. Berlin:Springer, 2005:289-298.
[3] 李鹏,周文欢.基于K-means和决策树的混合入侵检测算法[J]. 计算机与现代化, 2017(12):12-16.(LI P, ZHOU W H. Mixed intrusion detection algorithm based on K-means and decision tree[J]. Computer and Modernization, 2017(12):12-16.)
[4] 戚名钰,刘铭,傅彦铭. 基于PCA的SVM网络入侵检测研究[J].信息网络安全, 2015(2):15-18.(QI M Y, LIU M, FU Y M. Research on network intrusion detection using support vector machines based on principal component analysis[J]. Netinfo Security, 2015(2):15-18.)
[5] XU Y, ZHAO H. Intrusion detection alarm filtering technology based on ant colony clustering algorithm[C]//Proceedings of the 2015 6th International Conference on Intelligent Systems Design and Engineering Applications. Washington, DC:IEEE Computer Society, 2016:470-473.
[6] 王秀英. 分布式网络时序关联入侵攻击行为检测系统设计[J]. 现代电子技术, 2018, 41(3):108-114. (WANG X Y. Design of temporal sequence association rule based intrusion detection behavior detection system for distributed network[J]. Modern Electronics Technique, 2018, 41(3):108-114.)
[7] ROY S S, MALLIK A, GULATI R, et al. A deep learning based artificial neural network approach for intrusion detection[C]//Proceedings of the 2017 International Conference on Mathematics and Computing, CCIS 655. Berlin:Springer, 2017:44-53.
[8] 马勇.模糊推理结合Michigan型遗传算法的网络入侵检测方案[J].电子设计工程,2016,24(11):108-111.(MA Y. A network intrusion detection schemer based on fuzzy inference and Michigan genetic algorithm[J]. Electronic Design Engineering, 2016, 24(11):108-111.)
[9] 陈虹,万广雪,肖振久.基于优化数据处理的深度信念网络模型的入侵检测方法[J].计算机应用,2017,37(6):1636-1643.(CHEN H, WAN G X, XIAO Z J. Intrusion detection method of deep belief network model based on optimization of data processing[J]. Journal of Computer Applications, 2017, 37(6):1636-1643.)
[10] QU F, ZHANG J, SHAO Z, et al. An intrusion detection model based on deep belief network[C]//Proceedings of the 2017 VI International Conference on Network, Communication and Computing. New York:ACM, 2017:97-101.
[11] YIN C, ZHU Y, FEI J, et al. A deep learning approach for intrusion detection using recurrent neural networks[J]. IEEE Access, 2017, 5:21954-21961.
[12] SHONE N, NGOC T N, PHAI V D, et al. A deep learning approach to network intrusion detection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence, 2018, 2(1):41-50.
[13] 袁琴琴, 吕林涛. 基于改进蚁群算法与遗传算法组合的网络入侵检测[J]. 重庆邮电大学学报(自然科学版), 2017, 29(1):84-89.(YUAN Q Q, LYU L T. Network intrusion detection method based on combination of improved ant colony optimization and genetic algorithm[J]. Journal of Chongqing University of Posts and Telecommunications (Natural Science Edition), 2017, 29(1):84-89.
[14] 魏明军,王月月,金建国. 一种改进免疫算法的入侵检测设计[J].西安电子科技大学学报(自然科学版),2016,43(2):126-131.(WEI M J, WANG Y Y, JIN J G. Intrusion detection design of the impoved immune algorithm[J]. Journal of Xidian University (Natural Science), 2016, 43(2):126-131.)
[15] 贾凡,孔令智.基于卷积神经网络的入侵检测算法[J].北京理工大学学报,2017,37(12):1271-1275.(JIA F, KONG L Z. Intrusion detection algorithm based on convolutional neural network[J]. Transactions of Beijing Institute of Technology, 2017, 37(12):1271-1275.)
[16] 王明,李剑.基于卷积神经网络的网络入侵检测系统[J]. 信息安全研究,2017,3(11):990-994.(WANG M, LI J. Network intrusion detection model based on convolutional neural network[J]. Journal of Information Securyity Research, 2017, 3(11):990-994.)
[17] KWON D K, NATARAJAN K, SUH S C, et al. An empirical study on network anomaly detection using convolutional neural networks[C]//Proceedings of the IEEE 38th International Conference on Distributed Computing Systems. Piscataway, NJ:IEEE, 2018:1595-1598.
[18] VINAYAKUMAR R, SOMAN K P, POORNACHANDRAN P. Applying convolutional neural network for network intrusion detection[C]//Proceedings of the 2017 International Conference on Advanced Computing, Communications and Informatics. Piscataway, NJ:IEEE, 2017:1222-1228.
[19] DHANABAL L, PERIYASAMY S S. A study on NSL-KDD dataset for intrusion detection system based on classification algorithms[J]. International Journal of Advanced Research in Computer and Communication Engineering, 2015, 4(6):446-452.
[20] NSL-KDD dataset[EB/OL].[2018-07-20]. http://nsl.cs.unb.ca/NSL-KDD/.
[21] TensorFlow-GPU[EB/OL].[2018-07-20]. https://www.tensorflow.org/.
[22] LECUN Y, BOTTOU L, BENGIO Y, et al. Gradient-based learning applied to document recognition[J]. Proceedings of the IEEE, 1998, 86(11):2278-2324.
[23] HINTON G E, OSINDERO S, TEH Y. A fast learning algorithm for deep belief nets[J]. Neural Computation, 2006, 18(7):1527-1554.
[24] CHUNG J, GULCEHRE C, CHO K, et al. Gated feedback recurrent neural networks[C]//Proceedings of the 2015 International Conference on Machine Learning. New York:International Machine Learning Society, 2015:2067-2075.