Journal of Computer Applications ›› 2020, Vol. 40 ›› Issue (12): 3465-3470.DOI: 10.11772/j.issn.1001-9081.2020060918

• 2020 China Conference on Granular Computing and Knowledge Discovery(CGCKD 2020) • Previous Articles     Next Articles

Intrusion detection method based on variable precision covering rough set

OU Binli1, ZHONG Xiaru1, DAI Jianhua2, YANG Tian2   

  1. 1. School of Logistics and Transportation, Central South University of Forestry and Technology, Changsha Hunan 410004, China;
    2. Hunan Provincial Key Laboratory of Intelligent Computing and Language Information Processing;(Hunan Normal University), Changsha Hunan 410081, China
  • Received:2020-06-12 Revised:2020-08-25 Online:2020-12-10 Published:2020-10-20
  • Supported by:
    This work is partially supported by the National Natural Science Foundation of China (11201490, 61976089), the China Postdoctoral Science Foundation (2017T100795), the Natural Science Foundation of Hunan Province (2017JJ2408), the Key Research and Development Program of Hunan Province (2018SK2129), the Training Program for Excellent Young Innovators of Changsha (kq1905031).

基于变精度覆盖粗糙集的入侵检测方法

欧彬利1, 钟夏汝1, 代建华2, 杨田2   

  1. 1. 中南林业科技大学 物流与交通学院, 长沙 410004;
    2. 智能计算与语言信息处理湖南省重点实验室(湖南师范大学), 长沙 410081
  • 通讯作者: 杨田(1984-),女,湖北荆门人,副教授,博士,CCF会员,主要研究方向:粒计算、人工智能、数据挖掘。math_yangtian@126.com
  • 作者简介:欧彬利(1993-),女,湖南永州人,硕士研究生,主要研究方向:粒计算、人工智能;钟夏汝(1994-),女,湖南常德人,硕士研究生,主要研究方向:粗糙集、数据挖掘;代建华(1977-),男,湖北荆州人,教授,博士,CCF会员,主要研究方向:粒计算、人工智能、数据挖掘
  • 基金资助:
    国家自然科学基金资助项目(11201490,61976089);中国博士后科学基金资助项目(2017T100795);湖南省自然科学基金资助项目(2017JJ2408);湖南省重点研发计划项目(2018SK2129);长沙市杰出创新青年培养计划项目(kq1905031)。

Abstract: It is an important task for an Intrusion Detection System (IDS) to identify abnormal user behaviors accurately and quickly. In order to solve the problems of high dimensionality and large sample size of intrusion detection data, a related family attribute reduction method based on variable precision covering rough set was proposed, and was applied to the intrusion detection data. Firstly, the variable precision related families with condition attributes were generated based on the covering decision table. Then, a heuristic algorithm was used to obtain the attribute reduction of the decision table based on all the variable precision related families with condition attributes. Finally, the intrusion detection data was detected by combining with the classifier on the above basis. Experimental results show that, the proposed method has the low time complexity of calculating attribute reduction, and on large sample datasets, the running time of attribute reduction algorithm named Neighborhood Fuzzy Rough Sets (NFRS) based on fuzzy rough set dependency is 96 times of that of the proposed method. On the NSL-KDD dataset, the proposed method can identify key attributes quickly, eliminate invalid information, and has the overall accuracy reached 90.53% and the accuracy of Normal reached 97%.

Key words: rough set, variable precision covering rough set, attribute reduction, related family, intrusion detection

摘要: 精准且快速地识别异常用户行为是入侵检测系统(IDS)的重要任务。针对入侵检测数据维度高、样本量大的问题,提出了基于变精度覆盖粗糙集的相关族属性约简方法,并将其运用至入侵检测数据中。首先,基于覆盖决策表生成条件属性的变精度相关族;然后,在所有条件属性变精度相关族的基础上利用启发式算法求得决策表的属性约简;最后,在上述的基础上结合分类器对入侵检测数据进行检测。实验结果表明,所提方法具有计算属性约简时间短的优点,在大样本数据集上,基于模糊粗糙集依赖度的属性约简算法NFRS运行所需时长为该算法的96倍。在入侵检测数据集NSL-KDD上,该方法可快速识别关键属性,剔除无效信息,其整体准确率可达到90.53%,且对Normal的识别准确率可达到97%。

关键词: 粗糙集, 变精度覆盖粗糙集, 属性约简, 相关族, 入侵检测

CLC Number: