摘要：

由于恶意软件、Web攻击等行为频发, 需要避免因网络恶意攻击而导致互联网上存在的大量用户隐私信息外泄, 因此, 网络入侵检测成为研究热点。网络入侵数据中存在大量冗余和不相关的信息, 现有的检测模型很少捕捉网络入侵数据中时间和空间维度上的模式和规律, 导致模型的检测性能受到限制。结合特征选择和特征融合, 建立一种新的网络入侵检测模型BRFE-CBIAT。首先通过随机森林(RF)和递归特征剔除(RFE)来构建BRFE模型, 通过BRFE模型对数据特征进行选择, 剔除部分不重要的特征, 减少冗余信息; 其次, 建立时空特征并行提取的CBIAT模型, 使用卷积神经网络(CNN)的一维卷积层对数据进行初步空间特征提取; 然后, 通过时间特征模块中的双向长短时记忆(BiLSTM)网络对深层序列数据进行建模, 捕获特征之间的时序关系, 并利用改进的空间注意模块关注空间特征; 最后, 通过Softmax分类器处理融合的时空特征以获取分类预测结果。实验结果表明, BRFE-CBIAT模型在NSL-KDD和UNSW-NB15数据集上的多分类检测准确率分别为99.7%和94.0%, 优于目前主流的网络模型, 所提模型对多类别的细分效果也存在明显优势, 在NSL-KDD数据集中, 所有细分性能均达到96%以上, 在UNSW-NB15数据集上对DoS攻击的检测F1值达到89%。

关键词: 网络入侵检测, 特征选择, 深度学习, 时空特征提取, 特征融合

Abstract:

Malware, Web attacks, and other behaviors frequently occur on the Internet. Therefore, the large amount of user privacy information on the Internet must be prevented from leaking because of malicious network attacks. This makes network intrusion detection systems a popular research topic. Network intrusion data includes a large amount of redundant and irrelevant information. However, current detection models seldom capture the patterns and regularities in the temporal and spatial dimensions of network intrusion data. This has led to limitations in the detection performance of the models. This study establishes a new BRFE-CBIAT model for network intrusion detection by combining feature selection and feature fusion. First, a BRFE model is constructed by combining Random Forest (RF) and Recursive Feature Elimination (RFE). The BRFE model selects some features of the data after eliminating some unimportant ones, thereby reducing redundant information. Second, a CBIAT model is built for the parallel extraction of spatio-temporal features. A one-dimensional convolutional layer of a Convolutional Neural Network (CNN) is used for initial spatial feature extraction from the data. Then, a Bi-directional Long and Short-Term Memory (BiLSTM) network in the temporal features module is used to model the deep sequence data, which captures the temporal relationships between features. An improved spatial attention module is used to focus on the spatial features. Finally, a Softmax classifier is used to process the fused spatio-temporal features to obtain the classification prediction results. The BRFE-CBIAT model proposed in this study has multi-classification detection accuracies of 99.7% and 94.0% on the NSL-KDD and UNSW-NB15 datasets, respectively. This is better than the current mainstream network models. The experimental results also indicate the proposed model's effectiveness in the breakdown of multiple categories. The performances of all breakdowns are more than 96% on the NSL-KDD dataset. The F1-score for detecting DoS attacks reaches 89% on the UNSW-NB15 dataset.

Key words: network intrusion detection, feature selection, deep learning, spatio-temporal features extraction, feature fusion