基于空时特征融合和注意力机制的网络入侵检测模型

摘要/Abstract

摘要： 针对网络入侵检测性能不高的问题，提出一种基于空时特征融合和注意力机制的深度学习入侵检测模型CTA-net。该模型通过集成卷积神经网络(CNN)和长短时记忆网络(LSTM)获取空时融合特征，然后使用注意力模块(Attention)对输入的空时融合特征进行重要性加权计算，最后通过softmax函数进行分类。使用NSL-KDD数据集的实验结果表明，相比具有相似结构的CNN模型和空时融合的CNN-LSTM模型，在训练集的收敛性具有显著的提升，在测试集上使用的分类评价指标准确率分别提升10.9120个百分点和11.8740个百分点，精确率分别提升9.1950个百分点和9.6130个百分点，召回率分别提升9.1780个百分点和9.9340个百分点，F1-SCORE分别提升10.7830个百分点和11.7500个百分点。仿真结果表明，所提出的CTA-net模型在网络入侵检测方面具有较好的应用潜力。

关键词: 网络入侵检测, 卷积神经网络, 长短期记忆网络, 注意力机制, NSL-KDD

Abstract: Aiming at the problem of low network intrusion detection performance, a deep learning intrusion detection model CTA-net based on space-time feature fusion and attention mechanism is proposed. The model obtains space-time fusion features by integrating convolutional neural network (CNN) and long-short-term memory network (LSTM), and then uses the attention module (Attention) to calculate the importance of the input space-time fusion features, and finally passes the softmax function sort. Using the NSL-KDD data set, the experimental results show that compared with the CNN model with similar structure and the space-time fusion CNN-LSTM model, the convergence of the training set is significantly improved, and the accurate of classification evaluation index used on the test set has increased by 10.9120 percentage points and 11.8740 percentage points, the precision has increased by 9.1950 percentage points and 9.6130 percentage points, the recall has increased by 9.1780 percentage points and9.9340 percentage points, and F1-SCORE has increased by 10.7830 percentage points and 11.750 percentage points . The simulation results show that the proposed CTA-net model has good application potential in network intrusion detection.

Key words: network intrusion detection, convolution neural network, long-short-term memory network, attention mechanism, NSL-KDD

饶海兵, 朱苏磊, 杨春夏. 基于空时特征融合和注意力机制的网络入侵检测模型[J]. 计算机与现代化, 2022, 0(06): 116-121.

RAO Hai-bing, ZHU Su-lei, YANG Chun-xia. Network Intrusion Detection Model Based on Space-time Feature Fusion and Attention Mechanism[J]. Computer and Modernization, 2022, 0(06): 116-121.

参考文献［25］

［1］	SANTORO D, ESCUDERO-ANDREU G, KYRIAKOPOULOS K G, et al. A hybrid intrusion detection system for virtual jamming attacks on wireless networks［J］. Measurement, 2017,109:79-87.
［2］	吴德鹏,柳毅. 基于可变网络结构自组织映射的入侵检测模型［J］. 计算机工程与应用, 2020,56(12):81-86.
［3］	王伟. 基于深度学习的网络流量分类及异常检测方法研究［D］. 合肥:中国科学技术大学, 2018.
［4］	GOODFELLOW I, BENGIO Y, COURVILLE A. Deep Learning［M］. MIT Press, 2016.
［5］	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition［C］// 2016 IEEE Conference on Computer Vision and Pattern Recognition(CVPR). 2016:770-778.
［6］	TRAN D, BOURDEV L, FERGUS R, et al. Learning spatiotemporal features with 3D convolutional networks［C］// Proceedings of the 2015 IEEE International Conference on Computer Vision (ICCV). 2015:4489-4497.
［7］	EIGEN D, FERGUS R. Predicting depth, surface normals and semantic labels with a common multi-scale convolutional architecture［C］// Proceedings of the 2015 IEEE International Conference on Computer Vision (ICCV). 2015:2650-2658.
［8］	LIU F Y, SHEN C H, LIN G S. Deep convolutional neural fields for depth estimation from a single image［C］// Proceedings of the 2015 IEEE Conference on Computer Vision and Pattern Recognition (CVPR). 2015:5162-5170.
［9］	VASWANI A, SHAZEER N, PARMAR N, et al. Attention is all you need［C］// Proceedings of the 31st International Conference on Neural Information Processing Systems. 2017:6000-6010.
［10］	TAVALLAEE M, BAGHERI E, LU W, et al. A detailed analysis of the KDD CUP 99 data set［C］// 2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications. 2009. DOI: 10.1109/CISDA.2009.5356528.
［11］	IOFFE S, SZEGEDY C. Batch normalization: Accelerating deep network training by reducing internal covariate shift［C］// Proceedings of the 32nd International Conference on Machine Learning. 2015:448-456.
［12］	GRAVES A. Long short-term memory［M］// Supervised Sequence Labelling with Recurrent Neural Networks, 2012:37-45.
［13］	CORBETTA M, SHULMAN G L. Control of goal-directed and stimulus-driven attention in the brain［J］. Nature Reviews Neuroscience, 2002:3(3):201-215.
［14］	HE K M, ZHANG X X, REN S Q, et al. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification［C］// Proceedings of the 2015 IEEE International Conference on Computer Vision(ICCV). 2015:1026-1034.
［15］	SAXE A M, MCCLELLAND J L, GANGULI S. Exact solutions to the nonlinear dynamics of learning in deep linear neural networks［J］. arXiv preprint arXiv:1312.6120,2014.
［16］	KINGMA D P, BA J. Adam: A method for stochastic optimization［J］. arXiv preprint arXiv:1412.6980, 2014.
［17］	LUO Y, CHENG Y, UZUNER, et al. Segment convolutional neural networks (Seg-CNNs) for classifying relations in clinical notes［J］. Journal of the American Medical Informatics Association, 2018,25(1):93-98.
［18］	JIANG B, HUANG W, HUANG Y, et al. MPNet: A multiprocess convolutional neural network for animal classification［C］// 2020 CCF Conference on Computer Supported Cooperative Work and Social Computing. 2020:583-593.
［19］	XIANG S, LIANG Q K, HU Y C, et al. AMC-Net: Asymmetric and multi-scale convolutional neural network for multi-label HPA classification［J］. Computer Methods and Programs in Biomedicine, 2019,178:275-287.
［20］	KIM J, PARK B, HONG C. Multi-scale label relation learning for multi-label classification using 1-dimensional convolutional neural networks［J］. arXiv preprint arXiv: 2107.05941, 2021.
［21］	YAO Q H, WANG R X, FAN X M, et al. Multi-class arrhythmia detection from 12-lead varied-length ECG using attention-based time-incremental convolutional neural network［J］. Information Fusion, 2020,53:174-182.
［22］	ZHANG R L, ZONG Q, DOU L Q, et al. A novel hybrid deep learning scheme for four-class motor imagery classification［J］. Journal of Neural Engineering, 2019,16(6):066004.1-066004.11.
［23］	THASEEN I S, KUMAR C A. Intrusion detection model using fusion of PCA and optimized SVM［C］// 2014 International Conference on Contemporary Computing and Informatics (IC3I). 2014:879-884.
［24］	FAN J J, BI S B, WANG G J, et al. Sensor fusion basketball shooting posture recognition system based on CNN［J］. Journal of Sensors, 2021. DOI: 10.1155/2021/6664776.
［25］	LI X Y, YI X H, LIU Z H, et al. Application of novel hybrid deep leaning model for cleaner production in a paper industrial wastewater treatment system［J］. Journal of Cleaner Production, 2021,294.DOI:10.1016/j.jclepro.2021.126343.

[1]	王秋忆, 周浩, 郑婷婷. 改进RetinaNet的电力设备目标检测方法[J]. 计算机与现代化, 2024, 0(01): 47-52.
[2]	林启钊, 彭志平, 郭棉, 崔得龙. 基于双向多步预测的炉管温度场重构方法[J]. 计算机与现代化, 2024, 0(01): 53-58.
[3]	李亚平, 王军防, 余红梅, 窦一民, 肖媛, 田继林. Regformer：基于稀疏注意力的输油管道水力压降预测方法[J]. 计算机与现代化, 2024, 0(01): 59-66.
[4]	郑立瑞, 肖晓霞, 邹北骥, 刘彬, 周展. 基于BERT的电子病历命名实体识别[J]. 计算机与现代化, 2024, 0(01): 87-91.
[5]	周成诚, 曾庆军, 杨康, 胡家铭, 韩春伟. 基于高效通道注意力模块的运动想象脑电识别[J]. 计算机与现代化, 2023, 0(12): 19-23.
[6]	邱凯星, 冯广. 基于双重特征注意力的多标签图像分类模型[J]. 计算机与现代化, 2023, 0(12): 41-47.
[7]	张浩洋, 尹梓名, 乐珺怡, 沈达聪, 束翌俊, 杨自逸, 孔祥勇, 龚伟. 3D-SPRNet: 一种基于并行解码器和双注意力机制的胆囊癌分割模型[J]. 计算机与现代化, 2023, 0(12): 59-66.
[8]	张伯泉, 麦海鹏, 陈嘉敏, 逄锦聚. 基于高灰度值注意力机制的脑白质高信号分割[J]. 计算机与现代化, 2023, 0(12): 67-75.
[9]	宁娟, 周庆华, 曾小为. 改进YOLOv7算法在西林瓶轧盖缺陷检测中的应用[J]. 计算机与现代化, 2023, 0(12): 82-86.
[10]	王宇航, 董宝良, 公超, 尚真真, 姚康宁. 基于意图识别的空中群目标动态威胁评估[J]. 计算机与现代化, 2023, 0(12): 100-104.
[11]	罗明杰, 冯开平. 基于沙漏结构与注意力机制的轻量级人脸表情识别方法[J]. 计算机与现代化, 2023, 0(11): 89-94.
[12]	张嘉琪, 徐啟蕾. 基于NAM-YOLO网络的苹果缺陷检测算法[J]. 计算机与现代化, 2023, 0(10): 53-58.
[13]	叶思佳, 魏延, 杜韩宇, 邓金枝. 结合注意力机制的HRNet图像语义分割算法[J]. 计算机与现代化, 2023, 0(10): 65-69.
[14]	刘付琪, 张达, 宋建华, 王海东. 基于CNN-BiLSTM的液压系统故障诊断[J]. 计算机与现代化, 2023, 0(09): 10-19.
[15]	吴甜, 刘海华, 童顺延. 基于深度反馈的卷积神经网络的图像分类[J]. 计算机与现代化, 2023, 0(09): 82-86.