基于深度表征的网络异常检测模型研究

发布时间：2018-08-12 17:47

【摘要】：在入侵检测中,通常的异常检测主要通过建立正常行为网络行为模式,来对网络数据流行为是否符合正常网络行为模式进行对比判定,但如何生成正常网络行为模式是一个比较难以解决的问题。另外,入侵检测研究中存在一个普遍的问题:实际检测系统的训练数据集合不可能涵盖所有的网络数据情况,特别是有标注的网络数据比较缺乏,而无标注的网络数据却没有得到充分利用。再者,网络攻击行为的复杂多变,以及网络数据的高维度特性,决定了对网络数据流的人工分析标注存在困难。本文的入侵异常检测方法的基本设计思想是,对给定的网络数据流使用深度人工神经网络重新学习表征,在计算后的特征表示上进行异常数据流的鉴别。与传统的网络异常检测方法不同的是:可以依靠神经网络的自学习特性学习获取网络数据流中不同类型特征,以及其包含的隐藏特征,然后在此基础上再进行网络异常检测。本文的异常检测方法的主要组成部分分为:深层特征学习模块、特征处理模块、异常检测模块。针对网络异常检测的以上特点,本文的异常检测模型研究主要集中在对深度表征过程以及异常检测方法两个部分。本文主要从以下几个方面进行研究:对人工神经网络算法分析实现,利用其学习的特征深度表示进行网络异常检测,并对特征深度表示在异常检测模型的提升进行实验验证。实验验证如何充分利用无标数据集合对模型训练进行补充改进,研究将无标数据对RBM进行补充训练的效果。对不同的判别算法进行分析,直接采用BP算法进行分类训练所需要的时间很长,本文提出采用DRBM扩展结构构建异常检测模型,并通过设计对比实验对模型的检测结果进行比对分析。通过深度特征与原始特征的结合,提高了模型的准确率以及运行效率。本文实验结果表明:对网络数据流的特征重新学习表达,能够提高分类器的准确率,同时其对于新的未知的网络入侵行为的检测也有帮助。通过采用无监督的特征学习,当可用的训练数据集有限时,采用无标数据进行补充,可以有效的提升异常检测模型的精准度。通过深度特征组合以及无标数据的补充训练,DRBM在检测准确率上略低于BP算法,但是在检测效率上要远胜于BP算法和SVM。
[Abstract]:In intrusion detection, the normal behavior network behavior pattern is established to determine whether the network data flow behavior conforms to the normal network behavior pattern. However, it is difficult to solve the problem of how to generate normal network behavior patterns. In addition, there is a common problem in the research of intrusion detection: the training data set of the actual detection system can not cover all the network data, especially the lack of labeled network data. However, the unmarked network data is not fully utilized. Furthermore, the complexity of network attack behavior and the high dimensional characteristics of network data make it difficult to analyze and label the network data flow manually. The basic design idea of the intrusion anomaly detection method in this paper is to re-study the representation of the given network data stream using the depth artificial neural network, and to identify the abnormal data flow on the calculated feature representation. Different from the traditional network anomaly detection methods, different types of features and hidden features in the network data flow can be obtained by learning from the self-learning characteristics of neural networks, and then the network anomaly detection can be carried out on this basis. The main components of the anomaly detection method are as follows: deep feature learning module, feature processing module and anomaly detection module. In view of the above characteristics of network anomaly detection, the research of anomaly detection model in this paper mainly focuses on the depth representation process and anomaly detection methods. In this paper, the following aspects are studied: the algorithm of artificial neural network is analyzed and implemented, and the feature depth representation is used to detect the anomaly of the network, and the experimental verification of the feature depth representation in the enhancement of anomaly detection model is carried out. The experiment verifies how to make full use of the non-standard data set to supplement and improve the model training, and studies the effect of supplementing the RBM with the non-standard data. After analyzing different discriminant algorithms, it takes a long time to use BP algorithm directly for classification training. In this paper, an outlier detection model based on extended structure of DRBM is proposed. The test results of the model are compared and analyzed through the design and contrast experiment. Through the combination of depth features and original features, the accuracy and efficiency of the model are improved. The experimental results show that the accuracy of the classifier can be improved by relearning the features of the network data stream, and it is also helpful to detect the new unknown network intrusion behavior. By using unsupervised feature learning and when the available training data set is limited, the accuracy of anomaly detection model can be effectively improved by using non-standard data to supplement it. Through depth feature combination and supplementary training without standard data, DRBM is slightly lower than BP algorithm in detection accuracy, but it is much more efficient than BP algorithm and SVM in detection efficiency.
【学位授予单位】：哈尔滨工业大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.08;TP183

【相似文献】