【摘要】 随着互联网的普及和网络连接设备与访问方式的多样化,网络入侵方式与手段日趋多样化且变异速度快,传统入侵检测方法在有效性、自适应性和实时性方面难以应对日益复杂网络环境的安全监控要求,为此提出一种基于在线自适应极限学习机(online adaption extreme learning machine, OAELM)选择性学习的网络入侵检测方法(SEoOAELM-NID).首先,提出一种能自动设定最优隐含节点个数且具有在线增量学习功能的OAELM构建方法,采用Bagging策略快速训练出多个具有一定独立性的OAELM子学习器;然后,基于边缘距离最小化原则(margin distance minimization,MDM)对OAELM子学习器的集成增益进行计算;通过选择增益度高的部分OAELM进行选择性集成,获得泛化能力强、效率高的选择性集成学习器用于入侵检测.由于SEoOAELM-NID能自动设定ELM子学习器最优隐节点个数且能根据网络环境变化实现检测模型在线顺序更新,因而能有效适应各种复杂网络环境的入侵检测要求;选择部分最优的子学习器进行集成,保证了最终检测结果的准确性和实效性,同时利用在线数据不断更新检测器.在NSL-KDD数据集上的测试结果表明,相比基于单个学习器以及传统集成学习的网络入侵检测方法,SEoOAELM-NID无论对已知入侵类型还是未知入侵类型均能获得更高的检测率,且识别速度快.更多还原

【Abstract】 The popularity of the Internet and network equipment and the diversity of access methods have brought great about convenience as well as huge security challenges. The ways and means of network intrusion are becoming more diversified and faster. Traditional intrusion detection methods are unable to meet the security monitoring requirements of an increasingly complex network environment in terms of effectiveness, adaptability and real-time.This paper proposes a network intrusion detection method based on selective learning of the online sequential Adaption Extreme Learning Machines(OAELMs), termed SEoOAELM-NID. Firstly, an OAELM construction method with online incremental update function is proposed,which can automatically set the optimal number of hidden nodes. Bagging strategy is used to train several OAELM sub-learners with certain independence. Then, based on the Margin Distance Minimization(Margin Distance Minimization) guidelines, the OAELM sublearner is integrated into the gain measure, and ensembled by selecting a partial sublearner with high gain. To get a highly Selective Ensemble of OAELM high generalization ability. SEoOAELM-NID has the advantages of automatic optimal setting of hidden nodes and online sequential update of ELM sub-learners, so it can effectively adapt to the intrusion detection requirements of various complex network environments; and by selecting some optimal sub-learners for integration, the accuracy and effectiveness of the final detection results are guaranteed, and online application is used. The test results on the NSL-KDD data set show that SEoOAELM-NID can achieve higher detection rates and fast recognition speeds for known and unknown intrusion types than single learner and traditional ensemble learning-based network intrusion detection methods.更多还原