基于半监督学习和信息增益率的入侵检测方案

发布时间：2018-06-29 00:32

本文选题：入侵检测 + 未知攻击　；参考：《计算机研究与发展》2017年10期

【摘要】：针对现有未知攻击检测方法仅定性选取特征而导致检测精度较低的问题,提出一种基于半监督学习和信息增益率的入侵检测方案.利用目标网络在遭受攻击时反应在底层重要网络流量特征各异的特点,在模型训练阶段,为了克服训练数据集规模有限的问题,采用半监督学习算法利用少量标记数据获得大规模的训练数据集;在模型检测阶段,引入信息增益率定量分析不同特征对检测性能的影响程度,最大程度地保留了特征信息,以提高模型对未知攻击的检测性能.实验结果表明:该方案能够利用少量标记数据定量分析目标网络中未知攻击的重要网络流量特征并进行检测,其针对不同目标网络中未知攻击检测的准确率均达到90%以上.
[Abstract]:An intrusion detection scheme based on semi-supervised learning and information gain rate is proposed to solve the problem that the existing unknown attack detection methods only select features qualitatively and lead to low detection accuracy. In order to overcome the problem of limited size of training data set, the target network has different characteristics of traffic response at the bottom of important network when it is attacked, in order to overcome the problem of limited scale of training data set in the training stage of model. The semi-supervised learning algorithm is used to obtain large-scale training data set with a small amount of labeled data. In the stage of model detection, the information gain rate is introduced to quantitatively analyze the influence of different features on the detection performance, and the feature information is retained to the maximum extent. In order to improve the performance of the model to detect unknown attacks. The experimental results show that the proposed scheme can quantitatively analyze and detect the important network traffic characteristics of unknown attacks in target networks using a small amount of tagged data. The accuracy of detecting unknown attacks in different target networks is over 90%.
【作者单位】：西安电子科技大学网络与信息安全学院;
【基金】：国家自然科学基金项目(U170820014,61372075,U1135002,61672408)~~
【分类号】：TP393.08

【相似文献】