作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2022, Vol. 48 ›› Issue (7): 130-140. doi: 10.19678/j.issn.1000-3428.0063144

• 网络空间安全 • 上一篇    下一篇

共形预测框架下的高可靠入侵检测算法

金海波, 赵欣越   

  1. 辽宁工程技术大学 软件学院, 辽宁 葫芦岛 125105
  • 收稿日期:2021-11-05 修回日期:2021-12-21 出版日期:2022-07-15 发布日期:2021-12-27
  • 作者简介:金海波(1983—),男,副教授、博士,主研方向为复杂系统可靠性分析、异常检测、优化维修策略制定;赵欣越,硕士研究生。
  • 基金资助:
    国家自然科学基金(62173171);辽宁省教育厅项目(LJYL050);辽宁工程技术大学创新团队项目(LNTU20TD-31);辽宁工程技术大学博士启动项目(LNTU14-1100)。

High-Reliability Intrusion Detection Algorithm Under Conformal Prediction Framework

JIN Haibo, ZHAO Xinyue   

  1. College of Software, Liaoning Technical University, Huludao, Liaoning 125105, China
  • Received:2021-11-05 Revised:2021-12-21 Online:2022-07-15 Published:2021-12-27

摘要: 入侵检测算法广泛应用于网络安全领域,然而现有基于机器学习的入侵检测算法仅输出数据的预测结果标签,缺少对预测结果置信值的评价机制,难以确保预测结果的可靠性。提出一种基于共形预测的高可靠入侵检测算法。将共形预测融入到传统机器学习算法中,得到数据分类标签和对应的置信值、可信度,提高网络数据分类的可靠性。通过对网络数据进行数字化、标准化和降维预处理,根据传统机器学习算法的特点,设计在共形预测框架下与各算法相对应的不一致得分计算公式,并引入平滑因子改进p-value的计算公式,使其能够以更平滑的方式计算预测结果p-value,提高算法的稳定性。实验结果表明,与单独采用SVM、DT和DT-SVM算法相比,该算法在KDD CUP99数据集上分类准确率分别提高11.1、4.6和3.7个百分点,在AWID数据集上分类准确率分别提高4.0、2.5和1.3个百分点,可保证入侵检测结果的高可靠性。

关键词: 共形预测, 入侵检测, 高可靠性, 机器学习, 置信值, 不一致测量

Abstract: Intrusion detection algorithms are widely used in the field of network security.However, existing intrusion detection algorithms based on machine learning only output prediction result labels for data and lack evaluation mechanisms for the confidence value of prediction results, making it difficult to ensure the reliability of results.This study proposes a high-reliability intrusion detection algorithm based on Conformal Prediction(CP).CP is integrated into a traditional machine learning algorithm to obtain data classification labels and corresponding confidence values to improve the reliability of network data classification.By digitalization, standardization and reducing the dimensionality of network data according to the characteristics of traditional machine learning algorithms, an inconsistent score calculation formula under the CP framework is designed and a smoothing factor is introduced to improve the calculation of p-value.The improved p-value calculation formula can calculate the p-value of prediction results smoothly and improve the overall stability of the algorithm.Experimental results demonstrate that compared to the SVM, DT and DT-SVM algorithms alone, the classification accuracy of the proposed algorithm on the KDD CUP99 dataset is improved by 11.1, 4.6, and 3.7 percentage points, respectively, and that on the AWID dataset is improved by 4.0, 2.5, and 1.3 percentage points, respectively, which ensures the high-reliability of intrusion detection results.

Key words: Conformal Prediction(CP), intrusion detection, high-reliability, machine learning, confidence value, inconsistent measure

中图分类号: