Intrusion detection model based on semi-supervised learning and three-way decision

doi:10.11772/j.issn.1001-9081.2020111883

Journal of Computer Applications ›› 2021, Vol. 41 ›› Issue (9): 2602-2608.DOI: 10.11772/j.issn.1001-9081.2020111883

Special Issue: 网络空间安全

• Cyber security • Previous Articles Next Articles

Intrusion detection model based on semi-supervised learning and three-way decision

ZHANG Shipeng, LI Yongzhong, DU Xiangtong

School of Computer Science and Technology, Jiangsu University of Science and Technology, Zhenjiang Jiangsu 212100, China

Received:2020-12-02 Revised:2021-01-21 Online:2021-09-10 Published:2021-05-12
Supported by:
This work is partially supported by the Postgraduate Research and Practice Innovation Program of Jiangsu Province (KYCX20_3163).

基于半监督学习和三支决策的入侵检测模型

张师鹏, 李永忠, 杜祥通

江苏科技大学计算机学院, 江苏镇江 212100

通讯作者: 李永忠
作者简介:张师鹏(1994-),男,安徽宿州人,硕士研究生,CCF学生会员,主要研究方向:网络信息安全;李永忠(1961-),男,甘肃兰州人,教授,硕士,CCF会员,主要研究方向:网络信息安全、智能信息处理;杜祥通(1996-),男,江苏徐州人,硕士研究生,主要研究方向:网络信息安全。
基金资助:
江苏省研究生科研与实践创新计划项目（KYCX20_3163）。

Abstract

Abstract: Aiming at the situation that the existing intrusion detection models perform poorly on unknown attacks and have extremely limited labeled data, an intrusion detection model named SSL-3WD based on Semi-Supervised Learning (SSL) and Three-Way Decision (3WD) was proposed. In SSL-3WD model, the excellent performance of 3WD in the case of insufficient information was used to meet the assumption of sufficient redundancy of data information in SSL. Firstly, the 3WD theory was used to classify network behavior data, then some appropriate "pseudo-labeled" samples were selected according to the classification results to form a new training set to expand the original dataset. Finally, the classification process was repeated to obtain all the classifications of network behavior data. On the NSL-KDD dataset, the detection rate of the proposed model was 97.7%, which was 5.8 percentage points higher than that of the adaptive integrated learning intrusion detection model Multi-Tree, which has the highest detection rate in the comparison methods. On the UNSW-NB15 dataset, the accuracy of the proposed model reached 94.7% and the detection rate reached 96.3%, which were increased by 3.5 percentage points and 6.2 percentage points respectively compared with those of the best performing one in the comparison methods, the intrusion detection model based on Stack Nonsymmetric Deep Autoencoder (SNDAE). The experimental results show that the proposed SSL-3WD model improves the accuracy and detection rate of network behavior detection.

Key words: intrusion detection, Semi-Supervised Learning (SSL), Three-Way Decision (3WD), unknown attack, sufficient redundancy

摘要： 针对现有的入侵检测模型在未知攻击上表现不佳，且标注数据极其有限的情况，提出一种基于半监督学习（SSL）和三支决策（3WD）的入侵检测模型——SSL-3WD。SSL-3WD模型通过3WD在信息不足情况下的优秀表现来满足SSL在数据信息的充分冗余性上的假设。首先利用3WD理论对网络行为数据进行分类，而后根据分类结果选择适当的“伪标记”样本组成新的训练集以扩充原有数据集，最后重复分类过程，以得到所有对于网络行为数据的分类。在NSL-KDD数据集上，所提模型的检出率达到了97.7%，相较于对比方法中检出率最高的自适应的集成学习入侵检测模型Multi-Tree，提升了5.8个百分点；在UNSW-NB15数据集上，所提模型的准确率达到了94.7%，检出率达到了96.3%，相较于对比方法中表现最好的基于深度堆叠非对称自编码器（SNDAE）的入侵检测模型，分别提升了3.5个百分点和6.2个百分点。实验结果表明，所提SSL-3WD模型提升了对网络行为进行检测的准确率和检出率。

关键词: 入侵检测, 半监督学习, 三支决策, 未知攻击, 充分冗余

CLC Number:

TP309

ZHANG Shipeng, LI Yongzhong, DU Xiangtong. Intrusion detection model based on semi-supervised learning and three-way decision[J]. Journal of Computer Applications, 2021, 41(9): 2602-2608.

张师鹏, 李永忠, 杜祥通. 基于半监督学习和三支决策的入侵检测模型[J]. 计算机应用, 2021, 41(9): 2602-2608.

References

[1] PAPAMARTZIVANOS D,GÓMEZ MÁRMOL F,KAMBOURAKIS G. Introducing deep learning self-adaptive misuse network intrusion detection systems[J]. IEEE Access,2019,7:13546-13560.
[2] 杨宏宇, 王峰岩. 基于改进卷积神经网络的网络入侵检测模型[J]. 计算机应用,2019,39(9):2604-2610.(YANG H Y, WANG F Y. Network intrusion detection model based on improved convolutional neural network[J]. Journal of Computer Applications,2019,39(9):2604-2610.)
[3] 丁红卫, 万良, 邓烜堃. 改进的HS算法优化BP神经网络的入侵检测研究[J]. 计算机工程与科学,2019,41(1):65-72.(DING H W,WAN L,DENG X K. Optimizing intrusion detection of BP neural networks by a modified harmony search algorithm[J]. Computer Engineering and Science,2019,41(1):65-72.)
[4] ZEGEYE W K,DEAN R A,MOAZZAMI F. Multi-layer hidden Markov model based intrusion detection system[J]. Machine Learning and Knowledge Extraction,2019,1(1):265-286.
[5] XIAO Y H,XING C,ZHANG T N,et al. An intrusion detection model based on feature reduction and convolutional neural networks[J]. IEEE Access,2019,7:42210-42219.
[6] 曹卫东, 许志香. 高效的半监督多层次入侵检测算法[J]. 计算机应用,2019,39(7):1979-1984.(CAO W D,XU Z X. Efficient semi-supervised multi-level intrusion detection algorithm[J]. Journal of Computer Applications,2019,39(7):1979-1984.)
[7] 曹卫东, 许志香, 王静. 基于深度生成模型的半监督入侵检测算法[J]. 计算机科学,2019,46(3):197-201.(CAO W D,XU Z X,WANG J. Intrusion detection based on semi-supervised learning with deep generative models[J]. Computer Science,2019,46(3):197-201.)
[8] ZHU X J,GOLDBERG A B. Introduction to Semi-Supervised Learning[M]. San Rafael,CA:Morgan & Claypool Publishers, 2009:31-32.
[9] 周志华. 基于分歧的半监督学习[J]. 自动化学报,2013,39(11):1871-1878. (ZHOU Z H. Disagreement-based semisupervised learning[J]. Acta Automatica Sinica,2013,39(11):1871-1878.)
[10] BLUM A,MITCHELL T. Combining labeled and unlabeled data with co-training[C]//Proceedings of the 11th Annual Conference on Computational Learning Theory. New York:ACM,1998:92-100.
[11] YAO Y Y. An outline of a theory of three-way decisions[C]//Proceedings of the 2012 International Conference on Rough Sets and Current Trends in Computing,LNCS 7413. Berlin:Springer, 2012:1-17.
[12] MALDONADO S,PETERS G,WEBER R. Credit scoring using three-way decisions with probabilistic rough sets[J]. Information Sciences,2020,507:700-714.
[13] YAO Y Y. Three-way decisions with probabilistic rough sets[J]. Information Sciences,2010,180(3):341-353.
[14] 刘盾, 梁德翠. 广义三支决策与狭义三支决策[J]. 计算机科学与探索,2017,11(3):502-510. (LIU D,LIANG D C. Generalized three-way decisions and special three-way decisions[J]. Journal of Frontiers of Computer Science and Technology, 2017,11(3):502-510.)
[15] 陈刚, 刘秉权, 吴岩. 求三支决策最优阈值的新算法[J]. 计算机应用,2012,32(8):2212-2215.(CHEN G,LIU B Q,WU Y. New algorithm to get optimal threshold for three-decision-making[J]. Journal of Computer Applications,2012,32(8):2212-2215.)
[16] VINCENT P,LAROCHELLE H,BENGIO Y,et al. Extracting and composing robust features with denoising autoencoders[C]//Proceedings of the 25th International Conference on Machine Learning. New York:ACM,2008:1096-1103.
[17] 张全龙, 王怀彬. 基于膨胀卷积和门控循环单元组合的入侵检测模型[J]. 计算机应用,2021,41(5):1372-1377.(ZHANG J L, WANG H B. Intrusion detection model based on dilated convolution and gated recurrent unit[J]. Journal of Computer Applications,2021,41(5):1372-1377.)
[18] SHONE N,NGOC T N,PHAI V D,et al. A deep learning approach to network intrusion detection[J]. IEEE Transactions on Emerging Topics in Computational Intelligence,2018,2(1):41-50.
[19] LI Y Z,ZHANG S P,LI Y,et al. Research on intrusion detection algorithm based on deep learning and semi-supervised clustering[J]. International Journal of Cyber Research and Education, 2020,2(2):38-60.
[20] 高妮, 高岭, 贺毅岳, 等. 基于自编码网络特征降维的轻量级入侵检测模型[J]. 电子学报,2017,45(3):730-739.(GAO N, GAO L,HE Y Y,et al. A lightweight intrusion detection model based on autoencoder network with feature reduction[J]. Acta Electronica Sinica,2017,45(3):730-739.)
[21] GAO X W,SHAN C,HU C Z,et al. An adaptive ensemble machine learning model for intrusion detection[J]. IEEE Access, 2019,7:82512-82521.

Intrusion detection model based on semi-supervised learning and three-way decision

基于半监督学习和三支决策的入侵检测模型

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 15

Recommended Articles

Metrics

[1]	WANG Yue, JIANG Yiming, LAN Julong. Intrusion detection based on improved triplet network and K-nearest neighbor algorithm [J]. Journal of Computer Applications, 2021, 41(7): 1996-2002.
[2]	WANG Yao, SUN Guozi. Oversampling method for intrusion detection based on clustering and instance hardness [J]. Journal of Computer Applications, 2021, 41(6): 1709-1714.
[3]	ZHANG Quanlong, WANG Huaibin. Intrusion detection model based on combination of dilated convolution and gated recurrent unit [J]. Journal of Computer Applications, 2021, 41(5): 1372-1377.
[4]	REN Xiaokui, LIU Pengfei, TAO Zhiyong, LIU Ying, BAI Lichun. Indoor intrusion detection based on direction-of-arrival estimation algorithm for single snapshot [J]. Journal of Computer Applications, 2021, 41(4): 1153-1159.
[5]	CHENG Xiaohui, NIU Tong, WANG Yanjun. Wireless sensor network intrusion detection system based on sequence model [J]. Journal of Computer Applications, 2020, 40(6): 1680-1684.
[6]	OU Binli, ZHONG Xiaru, DAI Jianhua, YANG Tian. Intrusion detection method based on variable precision covering rough set [J]. Journal of Computer Applications, 2020, 40(12): 3465-3470.
[7]	LI Zhongwei, TAN Kai, GUAN Yadong, JIANG Wenqi, YE Lin. In-vehicle CAN bus-off attack and its intrusion detection algorithm [J]. Journal of Computer Applications, 2020, 40(11): 3224-3228.
[8]	CHI Yaping, MO Chongwei, YANG Yintan, CHEN Chunxia. Design and implementation of intrusion detection model for software defined network architecture [J]. Journal of Computer Applications, 2020, 40(1): 116-122.
[9]	REN Jie, MIN Fan, WANG Min. Cost-sensitive active learning through farthest distance sum sampling [J]. Journal of Computer Applications, 2019, 39(9): 2499-2504.
[10]	YANG Hongyu, WANG Fengyan. Network intrusion detection model based on improved convolutional neural network [J]. Journal of Computer Applications, 2019, 39(9): 2604-2610.
[11]	CAO Weidong, XU Zhixiang. Efficient semi-supervised multi-level intrusion detection algorithm [J]. Journal of Computer Applications, 2019, 39(7): 1979-1984.
[12]	PAN Jianguo, LI Hao. Intrusion detection approach for IoT based on practical Byzantine fault tolerance [J]. Journal of Computer Applications, 2019, 39(6): 1742-1746.
[13]	GUO Xudong, LI Xiaomin, JING Ruxue, GAO Yuzhuo. Intrusion detection based on improved sparse denoising autoencoder [J]. Journal of Computer Applications, 2019, 39(3): 769-773.
[14]	HU Jian, SU Yongdong, HUANG Wenzai, XIAO Peng, LIU Yuting, YANG Benfu. Intrusion detection method based on ensemble transfer learning via weighted mutual information [J]. Journal of Computer Applications, 2019, 39(11): 3310-3315.
[15]	SHEN Xueli, QIN Shujuan. Anomaly detection based on synthetic minority oversampling technique and deep belief network [J]. Journal of Computer Applications, 2018, 38(7): 1941-1945.