一种基于半监督GHSOM的入侵检测方法

发布时间：2019-03-06 15:34

【摘要】：基于神经网络的入侵检测方法是入侵检测技术的一个重要发展方向.在已有无监督生长型分层自组织映射(growing hierarchical self-organizing maps,GHSOM)神经网络算法的基础上,提出了一种半监督GHSOM算法.该算法利用少量有标签的数据指导大规模无标签数据的聚类过程.一方面借鉴cop-kmeans半监督机制,解决了原始算法中返回空划分的问题,并将其应用到GHSOM算法中.另一方面提出了神经元信息熵的概念作为子网生长的判断条件,提高了GHSOM网络子网划分的精度.此外还利用有标签的数据自动确定聚类结果的入侵类型.对KDD Cup 1999数据集和LAN环境下模拟产生的数据集进行的入侵检测实验表明:相比于无监督的GHSOM算法,半监督的GHSOM算法对各种类型的攻击具有较高的检测率.
[Abstract]:Intrusion detection method based on neural network is an important development direction of intrusion detection technology. Based on the existing algorithms of unsupervised growth-type hierarchical self-organizing mapping (growing hierarchical self-organizing maps,GHSOM) neural network, a semi-supervised GHSOM algorithm is proposed. The algorithm uses a small amount of tagged data to guide the large-scale untagged data clustering process. On the one hand, we use the semi-supervised mechanism of cop-kmeans for reference to solve the problem of returning null partition in the original algorithm, and apply it to the GHSOM algorithm. On the other hand, the concept of neuron information entropy is proposed to judge the growth of subnets, which improves the accuracy of subnetting in GHSOM networks. In addition, the labeled data is used to automatically determine the intrusion type of clustering results. Compared with the unsupervised GHSOM algorithm, the semi-supervised GHSOM algorithm has a higher detection rate against all kinds of attacks compared with the KDD Cup 1999 dataset and the simulated dataset under the LAN environment. The intrusion detection experiment shows that the semi-supervised GHSOM algorithm has a higher detection rate than the unsupervised GHSOM algorithm.
【作者单位】：北京大学软件与微电子学院;
【基金】：国家自然科学基金项目(61070237,61232005,61073156)
【分类号】：TP393.08

【参考文献】