基于深度学习和半监督聚类的入侵防御技术研究
发布时间：2018-08-31 08:36
【摘要】：网络安全问题一直是网络健康发展所关心的重点。传统的网络安全防护技术的有防火墙、入侵检测等技术,然而在目前复杂的网络环境下,传统的网络安全防护技术无法满足网络安全的需要。入侵防御系统以入侵检测作为核心技术,兼具防火墙技术和入侵检测技术的优点,不仅能够检测出入侵行为,也能及时采取保护措施,具有主动防御功能,能够有效的提高网络的安全保障。入侵检测算法通常以距离和概率为基础进行检测,能够发现简单的入侵行为,但难以找出特征元素之间的关联,对于攻击手段更加隐蔽的入侵行为无法进行有效的防御。深度学习(Deep Learning)模拟了人脑的思维模式,逐步提取出抽象特征,并且将得到的抽象特征用于分类处理。深度学习算法的核心在于多层次的学习,通过多层次的特征提取,发现数据间内在的联系。将深度学习用于入侵检测,可以发现入侵数据中的隐含攻击行为,进而提高其检测准确率。半监督学习使用少量标记数据和大量未标记数据进行训练,降低了对样本的要求。本文将半监督学习引入入侵检测算法,提出了一种基于深度学习和半监督聚类的入侵检测算法。本算法是对基于浅层学习(Shallow Learning)的入侵检测算法的改进。基于浅层学习的入侵检测算法,以反向传播算法进行训练,需要大量的标记数据和多次的实验来调整参数,而且在隐含层较多的情况下容易产生梯度弥散,并且难以确定隐含单元的数量。本算法使用稀疏自编码器对隐含层进行训练,使用逐层贪心算法调整参数,可以解决梯度弥散的问题。稀疏性能够对隐含层单元是否激活形成限制,可以有效处理基于自编码的深度学习算法对隐含层单元难以确定问题。该算法将基于稀疏自编码器的深度学习和半监督聚类进行结合,可以在使用一定量的标记数据的基础上进行训练出高效的算法参数,具有在使用少量带标记数据的情况下提高检测率的优点。基于网络的实际状况,本文选取了一些具有代表性的数据进行测试,测试结果同基于K均值,C均值,浅层学习等入侵检测算法进行比较。实验结果表明,基于深度学习和半监督聚类的入侵检测算法能够有效提高检测效率,并且克服了传统基于聚类的入侵检测算法对于初始化聚类数据敏感、噪声影响严重等问题。最后研究了基于深度学习和半监督聚类的入侵防御系统,介绍了该系统的工作原理,并给出了该系统的部署方式。
[Abstract]:Network security has always been the focus of the healthy development of the network. Traditional network security protection technologies include firewall, intrusion detection and so on. However, in the current complex network environment, the traditional network security protection technology can not meet the needs of network security. With the advantages of firewall technology and intrusion detection technology, it can not only detect intrusion, but also take timely protective measures. It has active defense function and can effectively improve the security of the network. Deep Learning simulates the thinking pattern of human brain, extracts abstract features gradually, and uses the abstract features to classify. The core of the depth learning algorithm is multi-level learning, through multi-level learning. Semi-supervised learning uses a small number of labeled data and a large number of unlabeled data to train, which reduces the requirement for samples. Semi-supervised learning is introduced in this paper. An intrusion detection algorithm based on depth learning and semi-supervised clustering is proposed. This algorithm is an improvement on the Shallow Learning based intrusion detection algorithm. The algorithm uses sparse self-encoder to train the hidden layer and adjusts the parameters by layer-by-layer greedy algorithm to solve the problem of gradient dispersion. This algorithm combines depth learning based on sparse self-encoder with semi-supervised clustering, and can train high-efficient algorithm parameters on the basis of a certain amount of labeled data, with a small amount of labeled data. Based on the actual situation of the network, this paper selects some representative data to test, and the test results are compared with the intrusion detection algorithm based on K-means, C-means, shallow learning and so on. The experimental results show that the intrusion detection algorithm based on depth learning and semi-supervised clustering can be effectively improved. At last, the intrusion prevention system based on depth learning and semi-supervised clustering is studied. The principle of the system is introduced, and the deployment of the system is given.
【学位授予单位】：江苏科技大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08
，
本文编号：2214466
[Abstract]:Network security has always been the focus of the healthy development of the network. Traditional network security protection technologies include firewall, intrusion detection and so on. However, in the current complex network environment, the traditional network security protection technology can not meet the needs of network security. With the advantages of firewall technology and intrusion detection technology, it can not only detect intrusion, but also take timely protective measures. It has active defense function and can effectively improve the security of the network. Deep Learning simulates the thinking pattern of human brain, extracts abstract features gradually, and uses the abstract features to classify. The core of the depth learning algorithm is multi-level learning, through multi-level learning. Semi-supervised learning uses a small number of labeled data and a large number of unlabeled data to train, which reduces the requirement for samples. Semi-supervised learning is introduced in this paper. An intrusion detection algorithm based on depth learning and semi-supervised clustering is proposed. This algorithm is an improvement on the Shallow Learning based intrusion detection algorithm. The algorithm uses sparse self-encoder to train the hidden layer and adjusts the parameters by layer-by-layer greedy algorithm to solve the problem of gradient dispersion. This algorithm combines depth learning based on sparse self-encoder with semi-supervised clustering, and can train high-efficient algorithm parameters on the basis of a certain amount of labeled data, with a small amount of labeled data. Based on the actual situation of the network, this paper selects some representative data to test, and the test results are compared with the intrusion detection algorithm based on K-means, C-means, shallow learning and so on. The experimental results show that the intrusion detection algorithm based on depth learning and semi-supervised clustering can be effectively improved. At last, the intrusion prevention system based on depth learning and semi-supervised clustering is studied. The principle of the system is introduced, and the deployment of the system is given.
【学位授予单位】：江苏科技大学
【学位级别】：硕士
【学位授予年份】：2016
【分类号】：TP393.08
，
本文编号：2214466
本文链接：https://www.wllwen.com/guanlilunwen/ydhl/2214466.html
