论文标题
基于1D CNN的网络入侵检测与数据不平衡的数据归一化
1D CNN Based Network Intrusion Detection with Normalization on Imbalanced Data
论文作者
论文摘要
入侵检测系统（IDS）在计算机网络中起着至关重要的作用，从而保护计算资源和来自外部攻击的数据。最近的IDS面临着提高ID的灵活性和效率的挑战，以实现意外和不可预测的攻击。深度神经网络（DNN）被普遍认为是复杂的系统，用于抽象功能并将其作为机器学习技术学习。在本文中，我们提出了一种使用一维卷积神经网络（1D-CNN）开发高效且灵活的ID的深度学习方法。二维CNN方法在检测计算机视觉区域的图像对象时表现出了显着的性能。同时，1D-CNN可用于计时数据的监督学习。我们通过在预定时间范围内序列化传输控制协议/Internet协议（TCP/IP）数据包来建立基于1D-CNN的机器学习模型，作为IDS的入侵Internet流量模型，在1D-CNN中对正常和异常的网络运输进行分类和标记以进行监督学习。我们在UNSW \ _NB15 IDS数据集上评估了我们的模型，以显示我们方法的有效性。为了进行性能的比较研究，除了具有各种网络参数和体系结构的1D-CNN之外，还利用了基于机器学习的随机森林（RF）和支持向量机（SVM）模型。在每个实验中，模型的运行率达到200个时期，并在0.0001中以不平衡和平衡的数据为单位。与经典的机器学习分类器相比，1D-CNN及其变体架构的表现优于。这主要是由于CNN具有提取高级特征表示能力的原因，该表征代表了低级特征网络流量连接集的抽象形式。
Intrusion detection system (IDS) plays an essential role in computer networks protecting computing resources and data from outside attacks. Recent IDS faces challenges improving flexibility and efficiency of the IDS for unexpected and unpredictable attacks. Deep neural network (DNN) is considered popularly for complex systems to abstract features and learn as a machine learning technique. In this paper, we propose a deep learning approach for developing the efficient and flexible IDS using one-dimensional Convolutional Neural Network (1D-CNN). Two-dimensional CNN methods have shown remarkable performance in detecting objects of images in computer vision area. Meanwhile, the 1D-CNN can be used for supervised learning on time-series data. We establish a machine learning model based on the 1D-CNN by serializing Transmission Control Protocol/Internet Protocol (TCP/IP) packets in a predetermined time range as an invasion Internet traffic model for the IDS, where normal and abnormal network traffics are categorized and labeled for supervised learning in the 1D-CNN. We evaluated our model on UNSW\_NB15 IDS dataset to show the effectiveness of our method. For comparison study in performance, machine learning-based Random Forest (RF) and Support Vector Machine (SVM) models in addition to the 1D-CNN with various network parameters and architecture are exploited. In each experiment, the models are run up to 200 epochs with a learning rate in 0.0001 on imbalanced and balanced data. 1D-CNN and its variant architectures have outperformed compared to the classical machine learning classifiers. This is mainly due to the reason that CNN has the capability to extract high-level feature representations that represent the abstract form of low-level feature sets of network traffic connections.
