【摘要】 针对传统的入侵检测方法无法有效提取网络流量数据特征的问题,提出了一种基于DSCNN-BiLSTM的入侵检测方法,该方法引入了深度可分离卷积代替标准卷积从而减少了模型参数,降低了计算量,并应用双向长短期记忆网络(BiLSTM)提取长距离依赖信息的特征,充分考虑了前后特征之间的影响。首先,通过主成分分析法(PCA)对网络流量数据进行特征降维,并创新性地将一维网络流量数据转化为三维图像数据;然后,分别运用深度可分离卷积神经网络(DSCNN)和双向长短期记忆网络(BiLSTM)提取网络流量数据的空间特征和时间特征;最后,利用KDDCUP99数据集进行训练、验证和测试。实验结果表明,与其他传统的入侵检测方法相比,该方法具有更高的准确率和更低的漏报率。更多还原

【Abstract】 The traditional intrusion detection method can not extract the characteristics of network traffic data effectively. To deal with the problem, an intrusion detection method based on DSCNN-BiLSTM was proposed. In this method, the depth separable convolution was introduced instead of the standard convolution to reduce the parameters of the model. Meanwhile, the proposed method reduced the calculation amount and used the bidirectional long-term memory network(BiLSTM) to capture the long-distance dependent information feature. It fully considered the influence of feature information before and after the adoption of the new method. Firstly, feature dimension of network traffic data was reduced by PCA, and one-dimensional network traffic data was transformed into three-dimensional image data innovatively. Secondly, the spatial and temporal features of network traffic data were extracted by DSCNN and BiLSTM respectively. Finally, KDDCUP99 data set was used for training, verifying and testing. Experimental results show that compared with other traditional intrusion detection methods, the method has higher accuracy and lower false alarm rate.更多还原