基于随机森林与人工免疫的入侵检测算法

doi:10.19678/j.issn.1000-3428.0057085

计算机工程 ›› 2020, Vol. 46 ›› Issue (8): 146-152. doi: 10.19678/j.issn.1000-3428.0057085

基于随机森林与人工免疫的入侵检测算法

张玲, 张建伟, 桑永宣, 王博, 侯泽翔

郑州轻工业大学软件学院, 郑州 450002

收稿日期:2019-12-31 修回日期:2020-02-05 发布日期:2020-02-17
作者简介:张玲(1979-),女,讲师、博士,主研方向为网络安全;张建伟、桑永宣、王博,博士;侯泽翔,本科生。
基金资助:
国家自然科学基金（61502436，61672471）；郑州轻工业大学博士基金（2014BSJJ084）。

Intrusion Detection Algorithm Based on Random Forest and Artificial Immunity

ZHANG Ling, ZHANG Jianwei, SANG Yongxuan, WANG Bo, HOU Zexiang

Software Engineering College, Zhengzhou University of Light Industry, Zhengzhou 450002, China

Received:2019-12-31 Revised:2020-02-05 Published:2020-02-17

摘要/Abstract

摘要： 传统入侵检测方法对Probe、U2R、R2L等网络入侵攻击类型的检测率较低，存在对入侵行为的误检和漏检。为此，提出一种基于随机森林与人工免疫的入侵检测算法。设计随机抗体森林检测策略，针对小样本数据集，采用克隆选择算法保证抗体的优良性，提高攻击的检测率，通过将识别为入侵行为的抗原注入抗体集，以平衡抗原的检测率和误报率。仿真结果表明，该算法的检测率为94.1%，高于Probe的93.79%、U2R的91%与R2L的85%，且具有较低的误报率。

关键词: 入侵检测, 随机森林, 人工免疫, 克隆选择算法, 随机抗体森林

Abstract: Traditional intrusion detection methods have low detection rates for Probe,U2R,R2L and other types of network intrusion attacks,leading to misdetection and missed detection of intrusion behavior.Therefore,this paper proposes an intrusion detection algorithm based on Random Forest(RF) and artificial immunity.A Random Antibody(RF) forest detection strategy is designed,and a Clone Selection Algorithm(CSA) for small sample datasets is adopted to ensure the superiority of antibodies and improve the detection rate of attacks.Then the antigen recognized as intrusive behavior is injected into the antibody set to balance the detection rate and false alarm rate of the antigen.Simulation results show that the detection rate of the proposed algorithm is 94.1%,which is higher than that of Probe (93.79%),U2R (91%) and R2L (85%).The proposed algorithm also has a low false alarm rate.

Key words: intrusion detection, Random Forest(RF), artificial immuneity, Clone Selection Algorithm(CSA), random antibody forest

中图分类号:

TP391.4

张玲, 张建伟, 桑永宣, 王博, 侯泽翔. 基于随机森林与人工免疫的入侵检测算法[J]. 计算机工程, 2020, 46(8): 146-152.

ZHANG Ling, ZHANG Jianwei, SANG Yongxuan, WANG Bo, HOU Zexiang. Intrusion Detection Algorithm Based on Random Forest and Artificial Immunity[J]. Computer Engineering, 2020, 46(8): 146-152.

https://www.ecice06.com/CN/Y2020/V46/I8/146

图/表 8

20200819135233

20200819135236

20200819135239

20200819135242

20200819135246

20200819135249

20200819135252

20200819135256

参考文献

[1] ANDERSON J P.Computer security threat monitoring and surveillance[EB/OL].[2019-11-20].https://www.researchgate.net/publication.
[2] KUMAR G K,KUMAR R R,BASHA M S,et al.Intrusion detection using an ensemble of support vector machines[J].Advances in Engineering,Management and Sciences,2019,3(1):266-275.
[3] ALYASEEN W L,OTHMAN Z A,NAZRI M Z A,et al.Multi-level hybrid support vector machine and extreme learning machine based on modified K-means for intrusion detection system[J].Expert Systems with Applications,2017,67(1):296-303.
[4] YANG Yangqing,ZHENG Kangfeng,WU Chuanhua,et al.Building an effective intrusion detection system using the modified density peak clustering algorithm and deep belief networks[J].Applied Sciences,2019,9(2):238-262.
[5] SONG C Y,PONS A,YEN K.AA-HMM:an anti-adversarial hidden markov model for network-based intrusion detection[J].Applied Sciences,2018,8(12):1-25.
[6] BREIMAN L.Random forests[J].Machine Learning,2001,45(1):5-32.
[7] LEE J,PARK K.AE-CGAN model based high performance network intrusion detection system[J].Applied Science,2019,20(9):1-14.
[8] REN Jiadong,LIU Xinqian,WANG Qian,et al.An multi-level intrusion detection method based on KNN outlier detection and random forests[J].Journal of Computer Research and Development,2019,56(3):566-575.(in Chinese)任家东,刘新倩,王倩,等.基于KNN离群点检测和随机森林的多层入侵检测方法[J].计算机研究与发展,2019,56(3):566-575.
[9] LIU Zhaolu,ZHAO Ying,LIU Shumei.Network traffic classification based on Spark frame[J].Journal on Communications,2018,39(Z1):30-35.(in Chinese)刘兆禄,赵英,刘淑梅.基于Spark的网络流量分类方法研究[J].通信学报,2018,39(Z1):30-35.
[10] BENTLEY K.The artificial immune model for network intrusion detection[C]//Proceedings of EUFIT'99.Aachen,Germany:[s.n.],1999:212-223.
[11] YIN Chunyong,MA Luyu,FENG Lu.Towards accurate intrusion detection based on improved clonal selection algorithm[J].Multimedia Tools and Applications,2017,19(76):19397-19410.
[12] ZHANG Ling.Research on intrusion detection model based on rough set and artificial immunity[D].Beijing:Beijing University of Posts and Telecommnications,2014.(in Chinese)张玲.基于粗糙集与人工免疫的入侵检测模型研究[D].北京:北京邮电大学,2014.
[13] HE Y,MENDIS G J,WEI J.Real-time detection of false data injection attacks in smart grid:a deep learning-based intelligent mechanism[J].IEEE Transactions on Smart Grid,2017,5(8):2505-2516.
[14] IMAMVERDIYEV Y,ABDULLAYEVA F.Deep learning method for denial of service attack detection based on restricted boltzmann machine[J].Big Data,2018,2(6):159-169.
[15] HUANG Wanwei,ZHANG Jianwei,SUN Haiyan,et al.An anomaly detection method based on normalized mutual information feature selection and quantum wavelet neural network[J].Wireless Personal Communications,2017,96(2):2693-2713.
[16] GUO Hui,LIU Zhongbao,LIU Xin.Intrusion detection method based on cloud model and decision tree[J].Computer Engineering,2019,45(4):142-147.(in Chinese)郭慧,刘忠宝,柳欣.基于云模型与决策树的入侵检测方法[J].计算机工程,2019,45(4):142-147.
[17] WANG Xuren,MA Huizhen,FENG Anran,et al.Network intrusion detection method based on information gain and principal components analysis[J].Computer Engineering,2019,45(6):175-180.(in Chinese)王旭仁,马慧珍,冯安然,等.基于信息增益与主成分分析的网络入侵检测方法[J].计算机工程,2019,45(6):175-180.
[18] ZHOU Zhihua.Machine learning[M].1st edition.Beijing:Tsinghua University Press,2016.(in Chinese)周志华.机器学习[M].1版.北京:清华大学出版社,2016.
[19] HETTICH S,BAY S D.KDD cup 1999 data[EB/OL].[2019-11-20].http://kdd.ics.uci.edu/databaseskddcup99/.
[20] ZHANG Ling,BAI Zhongying,LUO Shoushan,et al.Integrated intrusion detection model based on rough set and artificial immune[J].Journal on Communications,2013,34(9):166-176.(in Chinese)张玲,白中英,罗守山,等.基于粗糙集和人工免疫的集成入侵检测模型[J].通信学报,2013,34(9):166-176.

选择文件类型/文献管理软件名称

选择包含的内容

基于随机森林与人工免疫的入侵检测算法

Intrusion Detection Algorithm Based on Random Forest and Artificial Immunity

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献

相关文章 15

编辑推荐

Metrics

本文评价

[1]	余长宏, 许孔豪, 张泽, 高明. 基于分割点改进孤立森林的网络入侵检测方法[J]. 计算机工程, 2024, 50(6): 148-156.
[2]	张慧妍, 梁勇, 兰景宏, 赵强. 基于记忆模块与过滤式生成对抗网络的入侵检测方法[J]. 计算机工程, 2024, 50(6): 197-207.
[3]	陈虹, 王瀚文, 金海波. 融合改进自编码器和残差网络的入侵检测模型[J]. 计算机工程, 2024, 50(2): 188-195.
[4]	杜逸潇, 王红军, 李修和. 基于频谱地图的辐射源指纹定位方法研究[J]. 计算机工程, 2023, 49(9): 183-190, 198.
[5]	余长宏, 陆雅, 王海鑫, 高明. 基于滑动时间窗的物联网设备流量分类算法[J]. 计算机工程, 2023, 49(7): 259-268.
[6]	陈仲磊, 伊鹏, 陈祥, 胡涛. 基于集成学习的系统调用实时异常检测框架[J]. 计算机工程, 2023, 49(6): 162-169,179.
[7]	张凯林, 董红斌. 基于mRMR与基尼重要性的树突状细胞模型[J]. 计算机工程, 2023, 49(5): 129-138.
[8]	张雷, 鲍蓉, 朱永红, 史新国. 基于CSA-ResNet的人员入侵检测方法[J]. 计算机工程, 2023, 49(4): 297-302,311.
[9]	石磊, 张吉涛, 高宇飞, 卫琳, 陶永才. 基于Transformer与BiLSTM的网络流量入侵检测[J]. 计算机工程, 2023, 49(3): 29-36,57.
[10]	刘强, 张颖, 周卫祥, 蒋先涛, 周薇娜, 周谋国. 自适应类增量学习的物联网入侵检测系统[J]. 计算机工程, 2023, 49(2): 169-174.
[11]	陈天宇, 楚程钱, 万思远, 万永菁, 孙静. 基于条件轻量级神经网络的视频入侵检测算法[J]. 计算机工程, 2023, 49(12): 152-160.
[12]	刘金硕, 詹岱依, 邓娟, 王丽娜. 基于深度神经网络和联邦学习的网络入侵检测[J]. 计算机工程, 2023, 49(1): 15-21,30.
[13]	孙扬威, 戚湧. 基于聚类混合采样与PSO-Stacking的车载CAN入侵检测方法[J]. 计算机工程, 2023, 49(1): 138-145.
[14]	董卫宇, 李海涛, 王瑞敏, 任化娟, 孙雪凯. 基于堆叠卷积注意力的网络流量异常检测模型[J]. 计算机工程, 2022, 48(9): 12-19.
[15]	金海波, 赵欣越. 共形预测框架下的高可靠入侵检测算法[J]. 计算机工程, 2022, 48(7): 130-140.

模态框（Modal）标题

选择文件类型/文献管理软件名称

选择包含的内容

基于随机森林与人工免疫的入侵检测算法

Intrusion Detection Algorithm Based on Random Forest and Artificial Immunity

RichHTML

PDF

可视化

被引次数

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献

相关文章 15

编辑推荐

Metrics

本文评价