基于改进非广延熵特征提取的双随机森林实时入侵检测方法

发布时间：2018-05-11 23:05

本文选题：网络流量 + 入侵检测　；参考：《计算机科学》2013年12期

【摘要】：在网络骨干链路的高速、大数据量环境下,相对于正常数据,攻击及异常数据相对较少,进行实时入侵检测难度大。针对此问题,提出了一种基于改进非广延熵特征提取和双随机森林的实时入侵检测方法。利用非广延熵,提取出流量属性取值分布的多维特征,通过对非广延熵的改进来降低特征间的相关性。使用完整的特征样本集建立第一个随机森林检测模型,使用包含攻击数据的特征样本子集建立第二个随机森林检测模型,通过双随机森林检测算法实现对少量异常的有效检测。实验结果表明,该方法能够在有限流量信息的基础上获得较高的检测精确率和召回率,其时间和空间复杂度适当,适合于对骨干链路的实时入侵检测。
[Abstract]:In the network backbone link environment of high speed and large amount of data, compared with the normal data, the attack and abnormal data are relatively less, so it is difficult to carry out real-time intrusion detection. To solve this problem, a real-time intrusion detection method based on improved nonextended entropy feature extraction and dual random forest is proposed. The multi-dimensional feature of the value distribution of the flow attribute is extracted by using the non-extended entropy, and the correlation between the features is reduced by the improvement of the non-extensive entropy. The first random forest detection model is established by using the complete feature sample set and the second random forest detection model is established by using the subset of feature samples containing attack data. The dual random forest detection algorithm is used to effectively detect a small number of anomalies. Experimental results show that the proposed method can obtain high detection accuracy and recall rate on the basis of limited traffic information, and its time and space complexity is suitable for real-time intrusion detection of backbone links.
【作者单位】：解放军信息工程大学;数学工程与先进计算国家重点实验室;信息保障技术重点实验室;
【基金】：信息保障技术重点实验室开放基金(KJ-12-04)资助
【分类号】：TP393.08

【参考文献】