特征选择辅助的基于集成学习的入侵检测模型研究

发布时间：2019-01-05 19:42

【摘要】：随着网络安全环境的日益复杂,传统的入侵检测系统的劣势也愈加凸显。针对这种情况,机器学习方法与入侵检测相结合的研究应运而生。但是我们通过梳理这些研究文献发现,并不是所有研究方法的应用效果都那么完美。一些基础性的分类器如贝叶斯、决策树等对大样本攻击类别的识别率并不是很高。而其他相对复杂一些的模型如基于神经网络、深度学习的研究方法虽然提升了多数类样本分类的正确率,但在少数类样本中却表现得不尽如人意。那么能不能找到一种模型即顾全大样本攻击类的性能,又可以提升小样本类的分类正确率呢。本文提出了用集成学习的方法来构建入侵检测模型,并通过特征选择方法来辅助提升模型性能的设想。首先为满足既保证对大样本类分类较高正确率又能提升小样本分类正确率的要求,结合集成学习的相关知识,选择Stacking算法作为整体学习框架。然后通过各分类模型对本实验所用数据集的处理,本文最终选择随机树和贝叶斯置信网络作为个体学习器。把随机树分类器用Random Committee算法进行初次集成,将初次集成后的模型作为Stacking集成学习框架的初级学习器,贝叶斯置信网络作为次级学习器进行第二次集成。结合特征选择相关知识使用合适的特征约简算法对经过预处理的数据集进行特征约简,并将特征约简后的数据集送入集成学习框架进行训练。我们通过实验仿真对本文提出的入侵检测模型的相应性能进行了验证。首先用该模型及该模型的各级基分类器对本文所用实验数据集进行了处理,通过实验结果的对比,发现集成学习能够在基本不损失大样本攻击类分类效果的前提下,有效提升小样本类分类的正确率。然后使用所选特征选择算法对数据集进行了特征约简,通过我们的集成学习模型对其进行处理,通过实验结果的对比,我们发现该特征选择算法能够帮助模型提升对小样本攻击类的分类准确率。通过两步验证,本文提出的模型是可行的。
[Abstract]:With the increasing complexity of the network security environment, the disadvantages of the traditional intrusion detection system become more and more prominent. In view of this situation, the research of the combination of machine learning and intrusion detection came into being. But by combing through the research literature, we find that not all research methods are so effective. Some basic classifiers, such as Bayes and decision trees, do not have a high recognition rate for large sample attack classes. Other more complex models, such as neural networks, in-depth learning methods, although improve the accuracy of most categories of samples classification, but in a small number of samples are not satisfactory. Can we find a model, that is, consider the performance of large sample attack class, and improve the classification accuracy of small sample class. In this paper, an integrated learning approach is proposed to construct an intrusion detection model and to improve the performance of the model by means of feature selection. Firstly, in order to meet the requirements of high accuracy for large sample classification and improving the accuracy of small sample classification, Stacking algorithm is selected as the overall learning framework combined with the relevant knowledge of integrated learning. Then the random tree and Bayesian confidence network are selected as individual learning devices through the processing of the data sets used in this experiment by each classification model. The random tree classifier is first integrated with Random Committee algorithm, the model after initial integration is used as the primary learner of the Stacking integrated learning framework, and the Bayesian confidence network is used as the secondary learner for the second integration. Based on the knowledge of feature selection, the preprocessed data set is reduced using the appropriate feature reduction algorithm, and the data set after feature reduction is put into the integrated learning framework for training. The corresponding performance of the proposed intrusion detection model is verified by experimental simulation. Firstly, the experimental data set used in this paper is processed by using the model and its base classifier. By comparing the experimental results, it is found that the ensemble learning can not lose the effect of large sample attack class classification. The accuracy of small sample classification is improved effectively. Then we use the selected feature selection algorithm to reduce the feature of the data set and process it through our integrated learning model and compare the experimental results. We find that the feature selection algorithm can help the model to improve the classification accuracy of small sample attack classes. Through two-step verification, the proposed model is feasible.
【学位授予单位】：兰州大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】