基于GSA与DE优化混合核ELM的网络异常检测模型

doi:10.19678/j.issn.1000-3428.0061509

计算机工程 ›› 2022, Vol. 48 ›› Issue (6): 146-153. doi: 10.19678/j.issn.1000-3428.0061509

基于GSA与DE优化混合核ELM的网络异常检测模型

生龙^1,2, 袁丽娜^1,2, 武南南³, 姬少培⁴

1. 河北工程大学信息与电气工程学院, 河北邯郸 056038;
2. 河北工程大学河北省安防信息感知与处理重点实验室, 河北邯郸 056038;
3. 天津大学智能与计算学部, 天津 300072;
4. 中国电子科技集团公司第三十研究所, 成都 610041

收稿日期:2021-04-29 修回日期:2021-07-09 发布日期:2021-07-27
作者简介:生龙(1982—),男,副教授、博士,主研方向为人工神经网络、图像处理、机器学习、数据挖掘;袁丽娜,硕士;武南南,讲师、博士;姬少培,工程师、硕士。
基金资助:
国家重点研发计划（2018YFF0301004）；四川省重大科技项目（2017GZDZX0002）。

Network Anomaly Detection Model Based on GSA and DE Optimizing Hybrid Kernel ELM

SHENG Long^1,2, YUAN Lina^1,2, WU Nannan³, JI Shaopei⁴

1. College of Information and Electronic Engineering, Hebei University of Engineering, Handan, Hebei 056038, China;
2. Hebei Key Laboratory of Security & Protection Information Sensing and Processing, Hebei University of Engineering, Handan, Hebei 056038, China;
3. College of Intelligence and Computing, Tianjin University, Tianjin 300072, China;
4. The 30th Research Institute of China Electronics Technology Group Corporation, Chengdu 610041, China

Received:2021-04-29 Revised:2021-07-09 Published:2021-07-27

摘要/Abstract

摘要： 为了增强网络入侵检测模型的准确率与泛化性，提出一种基于引力搜索算法（GSA）与差分进化（DE）算法优化混合核极限学习机（ELM）的网络入侵检测模型。该模型针对采用单个核函数的ELM模型存在的泛化能力弱、学习能力差的问题，结合多项式核函数和径向基函数的优点，构建混合核ELM模型（HKELM），将GSA和DE相结合优化HKELM模型参数，从而提高其在异常检测过程中的全局和局部优化能力，在此基础上利用核主成分分析算法进行入侵检测数据的数据降维和特征抽取，构建网络入侵检测模型KPCA-GSADE-HKELM。在KDD99数据集上的实验结果表明，与KDDwinner、CSVAC、CPSO-SVM、Dendron等模型进行对比，KPCA-GSADE-HKELM模型具有更高的检测精度和更快的检测速度。

关键词: 网络入侵检测, 异常检测, 引力搜索算法, 差分进化算法, 混合核极限学习机, 检测精度

Abstract: To enhance the accuracy and generalization of the network intrusion detection model, this study proposes a network intrusion detection model based on the Gravitational Search Algorithm(GSA) and Differential Evolution(DE) algorithm to optimize the hybrid kernel Extreme Learning Machine (ELM).Aiming to improve the weak generalization and poor learning capabilities of ELM models with single kernel function, this model combines the advantages of a polynomial kernel function and radial basis function to construct the so-called Hybrid Kernel ELM(HKELM) model.Furthermore, GSA and DE are combined to optimize the parameters of HKELM, which improves its global and local optimization ability in anomaly detection.Then, the Kernel Principal Component Analysis(KPCA) algorithm is used for data dimensionality reduction and feature extraction from intrusion detection data.Finally, the proposed approach constructs a network intrusion detection model based on GSA and DE optimized hybrid kernel ELM (KPCA-GSADE-HKELM).Experimental results on the KDD99 dataset demonstrate that KPCA-GSADE-HKELM model achievesa higher detection accuracy and faster detection speed compared with KDDwinner, CSVAC, CPSO-SVM, and Dendron models.

Key words: network intrusion detection, anomaly detection, Gravitational Search Algorithm(GSA), Differential Evolution(DE) algorithm, Hybrid Kernel Extreme Learning Machine(HKELM), accuracy of detection

中图分类号:

TP309

生龙, 袁丽娜, 武南南, 姬少培. 基于GSA与DE优化混合核ELM的网络异常检测模型[J]. 计算机工程, 2022, 48(6): 146-153.

SHENG Long, YUAN Lina, WU Nannan, JI Shaopei. Network Anomaly Detection Model Based on GSA and DE Optimizing Hybrid Kernel ELM[J]. Computer Engineering, 2022, 48(6): 146-153.

http://www.ecice06.com/CN/Y2022/V48/I6/146

图/表 9

20220625175147

20220625175150

20220625175154

20220625175158

20220625175202

20220625175206

20220625175209

20220625175213

20220625175217

参考文献

[1] 熊钢, 葛雨玮, 褚衍杰, 等.基于跨域协同的网络空间威胁预警模式[J].网络与信息安全学报, 2020, 6(6):88-96. XIONG G, GE Y W, CHU Y J, et al.Model of cyberspace threat earlywarningbased on cross-domain and collaboration[J].Chinese Journal of Network and Information Security, 2020, 6(6):88-96.(in Chinese)
[2] YAHALOM R, STEREN A, NAMERI Y, et al.Improving the effectiveness of intrusion detection systems for hierarchical data[J].Knowledge-Based Systems, 2019, 168:59-69.
[3] PAPAMARTZIVANOS D, GÓMEZ MÁRMOL F, KAMBOURAKIS G.Dendron:genetic trees driven rule induction for network intrusion detection systems[J].Future Generation Computer Systems, 2018, 79:558-574.
[4] TSANGC H, KWONG S, WANG H L.Genetic-fuzzy rule mining approach and evaluation of feature selection techniques for anomaly intrusion detection[J].Pattern Recognition, 2007, 40(9):2373-2391.
[5] SALO F, NASSIF A B, ESSEX A.Dimensionality reduction with IG-PCA and ensemble classifier for network intrusion detection[J].Computer Networks, 2019, 148:164-175.
[6] TSAI C F, LIN C Y.A triangle area based nearest neighbors approach to intrusion detection[J].Pattern Recognition, 2010, 43(1):222-229.
[7] LI Y, GUO L.An active learning based TCM-KNN algorithm for supervised network intrusion detection[J].Computers & Security, 2007, 26(7/8):459-467.
[8] XIANG C, YONG P C, MENG L S.Design of multiple-level hybrid classifier for intrusion detection system using Bayesian clustering and decision trees[J].Pattern Recognition Letters, 2008, 29(7):918-924.
[9] CHAN G Y, LEE C S, HENG S H.Policy-enhanced ANFIS model to counter SOAP-related attacks[J].Knowledge-Based Systems, 2012, 35:64-76.
[10] AL-YASEEN W L, OTHMAN Z A, NAZRI M Z A.Real-time multi-agent system for an adaptive intrusion detection system[J].Pattern Recognition Letters, 2017, 85:56-64.
[11] TAO P Y, SUN Z, SUN Z X.An improved intrusion detection algorithm based on GA and SVM[J].IEEE Access, 2018, 6:13624-13631.
[12] ABUROMMAN A A, IBNE REAZ M B.A novel SVM-kNN-PSO ensemble method for intrusion detection system[J].Applied Soft Computing, 2016, 38:360-372.
[13] ABUROMMAN A A, IBNE REAZ M B.A novel weighted support vector machines multiclass classifier based on differential evolution for intrusion detection systems[J].Information Sciences, 2017, 414:225-246.
[14] WANG C R, XU R F, LEE S J, et al.Network intrusion detection using equality constrained-optimization-based extreme learning machines[J].Knowledge-Based Systems, 2018, 147:68-80.
[15] KU J H, ZHENG B, YUN D W.Intrusion detection based on self-adaptive differential evolutionary extreme learning machine[C]//Proceedings of 2017 International Conference on Computer Network, Electronic and Automation.Xi'an, China:[s.n.], 2017:94-100.
[16] LIU X D, CHEN Y S, YANG J L.A novel fault diagnosis method for rolling bearing based on EEMD-PE and multiclass relevance vector machine[C]//Proceedings of 2017 IEEE International Instrumentation and Measurement Technology Conference.Washington D.C., USA:IEEE Press, 2017:1-6.
[17] QIU X, TAN K C, XU J X.Multiple exponential recombination for differential evolution[J].IEEE Transactions on Cybernetics, 2017, 47(4):995-1006.
[18] HUANG G B, ZHU Q Y, SIEW C K.Extreme learning machine:a new learning scheme of feedforward neural networks[C]//Proceedings of 2004 IEEE International Joint Conference on Neural Networks.Washington D.C., USA:IEEE Press, 2004:985-990.
[19] HUANG G B, ZHOU H M, DING X J, et al.Extreme learning machine for regression and multiclass classification[J].IEEE Transactions on Systems, Man, and Cybernetics Part B, Cybernetics:a Publication of the IEEE Systems, Man, and Cybernetics Society, 2012, 42(2):513-529.
[20] SMITS G F, JORDAAN E M.Improved SVM regression using mixtures of kernels[C]//Proceedings of 2002 International Joint Conference on Neural Networks.Washington D.C., USA:IEEE Press, 2002:2785-2790.
[21] TIAN Z D, LI S J, WANG Y H, et al.Wind power prediction method based on hybrid kernel function support vector machine[J].Wind Engineering, 2018, 42(3):252-264.
[22] 蒋鹏程, 汤占军, 刘萍兰.基于引力搜索算法的局部遮阴下光伏系统最大功率点跟踪算法研究[J].化工自动化及仪表, 2020, 47(3):226-230, 283. JIANG P C, TANG Z J, LIU P L.Simulation research of photovoltaic MPPT based on GSAalgorithm[J].Control and Instruments in Chemical Industry, 2020, 47(3):226-230, 283.(in Chinese)
[23] 张涛, 朱瑞金, 扎西顿珠.基于改进骨干差分进化算法优化LSSVM的短期光伏发电功率预测[J].热力发电, 2021, 50(5):102-107. ZHANG T, ZHU R J, ZHAXIDUNZHU.Short-term photovoltaic power prediction based on IBBDE-LSSVM[J].Thermal Power Generation, 2021, 50(5):102-107.(in Chinese)
[24] SEYEDMAHMOUDIAN M, RAHMANI R, MEKHILEF S, et al.Simulation and hardware implementation of new maximum power point tracking technique for partially shaded PV system using hybrid DEPSO method[J].IEEE Transactions on Sustainable Energy, 2015, 6(3):850-862.
[25] 张泽龙, 钱勇, 刘华兵.基于主成分分析与遗传优化BP神经网络的风电场短期功率预测研究[J].宁夏电力, 2019(6):1-6, 34. ZHANG Z L, QIAN Y, LIU H B.Research on short-term power forecasting of wind farm based on principal component analysis and genetic optimization of BP neural network[J].Ningxia Electric Power, 2019(6):1-6, 34.(in Chinese)
[26] 李丽敏, 程少康, 温宗周, 等.基于改进KPCA与混合核函数LSSVR的泥石流预测[J].信息与控制, 2019, 48(5):536-544. LI L M, CHENG S K, WEN Z Z, et al.A debris flow prediction model based on the improved KPCA and mixed kernel function LSSVR[J].Information and Control, 2019, 48(5):536-544.(in Chinese)
[27] LEE W K, STOLFO S J.A framework for constructing features and models for intrusion detection systems[J].ACM Transactions on Information and System Security, 2000, 3(4):227-261.
[28] ELKAN C.Results of the KDD'99 classifier learning[J].ACM SIGKDD Explorations Newsletter, 2000, 1(2):63-64.
[29] FENG W Y, ZHANG Q L, HU G Z, et al.Mining network data for intrusion detection through combining SVMs with ant colony networks[J].Future Generation Computer Systems, 2014, 37:127-140.
[30] KUANG F J, ZHANG S Y, JIN Z, et al.A novel SVM by combining kernel principal component analysis and improved chaotic particle swarm optimization for intrusion detection[J].Soft Computing, 2015, 19(5):1187-1199.
[31] 生龙, 马建飞, 杨瑞欣, 等.基于特征交换的CNN图像分类算法研究[J].计算机工程, 2020, 46(9):268-273. SHENG L, MA J F, YANG R X, et al.Research on CNN image classification algorithm based on feature exchange[J].Computer Engineering, 2020, 46(9):268-273.(in Chinese)

选择文件类型/文献管理软件名称

选择包含的内容

基于GSA与DE优化混合核ELM的网络异常检测模型

Network Anomaly Detection Model Based on GSA and DE Optimizing Hybrid Kernel ELM

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	陈仲磊, 伊鹏, 陈祥, 胡涛. 基于集成学习的系统调用实时异常检测框架[J]. 计算机工程, 2023, 49(6): 162-169,179.
[2]	王爱玲, 马文臻, 邹自明, 钟佳. 基于领域自适应的卫星工程参数异常检测[J]. 计算机工程, 2023, 49(5): 29-37,47.
[3]	张子宣, 宗学军, 何戡, 连莲. 基于CVAE-CatBoost的工业控制网络异常流量检测研究[J]. 计算机工程, 2023, 49(5): 173-180.
[4]	王禹博, 陈利锋, 许卫霞. 结合多解码器与两阶段通道选择的异常检测方法[J]. 计算机工程, 2023, 49(3): 37-48.
[5]	刘金硕, 詹岱依, 邓娟, 王丽娜. 基于深度神经网络和联邦学习的网络入侵检测[J]. 计算机工程, 2023, 49(1): 15-21,30.
[6]	董卫宇, 李海涛, 王瑞敏, 任化娟, 孙雪凯. 基于堆叠卷积注意力的网络流量异常检测模型[J]. 计算机工程, 2022, 48(9): 12-19.
[7]	孙嘉, 张建辉, 卜佑军, 陈博, 胡楠, 王方玉. 基于CNN-BiLSTM模型的日志异常检测方法[J]. 计算机工程, 2022, 48(7): 151-158,167.
[8]	张伟成, 卫红权, 刘树新, 王庚润. 面向5G MEC基于行为的用户异常检测方案[J]. 计算机工程, 2022, 48(5): 27-34.
[9]	李贝贝, 彭力, 戴菲菲. 结合马氏距离与自编码器的网络流量异常检测方法[J]. 计算机工程, 2022, 48(4): 133-142.
[10]	于成龙, 付国霞, 孙超利, 张国晨. 全局与局部模型交替辅助的差分进化算法[J]. 计算机工程, 2022, 48(3): 115-123.
[11]	崔景洋, 陈振国, 田立勤, 张光华. 基于机器学习的用户与实体行为分析技术综述[J]. 计算机工程, 2022, 48(2): 10-24.
[12]	建澜涛, 任秀江, 张祯, 石嵩, 黄益明, 张春林. E级高性能计算机的维护故障诊断系统研究[J]. 计算机工程, 2022, 48(12): 24-37.
[13]	黄涛, 邬开俊, 王迪聪, 白晨帅, 陶小苗. 基于改进型时间分段网络的视频异常检测[J]. 计算机工程, 2022, 48(11): 137-144.
[14]	张攀, 高丰, 周逸, 饶涵宇, 毛冬, 李静. 一种在线实时微服务调用链异常检测方法[J]. 计算机工程, 2022, 48(11): 161-169.
[15]	古平, 邱嘉涛, 罗长江, 张志鹏. 基于目标时空上下文融合的视频异常检测算法[J]. 计算机工程, 2022, 48(10): 169-175.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于GSA与DE优化混合核ELM的网络异常检测模型

Network Anomaly Detection Model Based on GSA and DE Optimizing Hybrid Kernel ELM

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献

相关文章 15

编辑推荐

Metrics

本文评价