Research On Intrusion Detection Based On Stacked Denoising Autoencoder And GRU Neural Network

With the rapid development of Internet technology and various electronic products,people’s lifestyles have undergone tremendous changes,and at the same time,they have also promoted social progress.However,the increasingly complex network environment makes the means of network attacks more diversified.This potential crisis will not only pose a serious threat to national security,but also infringe on the personal privacy and legal rights of ordinary users.As an important barrier in the field of information security,network intrusion detection system plays a pivotal role in ensuring the stable operation of computer systems and the security of cyberspace.However,the traditional intrusion detection system based on shallow machine learning algorithms is no longer suitable for the current complex network environment,and problems such as low detection accuracy,high false alarm rate,poor adaptive ability,and greater influence by human factors have gradually emerged.The deep learning algorithm based on deep neural network can automatically establish the mapping relationship between low-level data features and high-level semantic features,avoiding the problem of manual intervention in feature selection in traditional methods.In order to improve the overall performance of the intrusion detection system,this paper uses deep learning technology to construct a new network intrusion detection model.The main work is as follows:(1)Aiming at the problem of massive high-dimensional data in the current network environment,this paper proposes a DCSAE(NS)feature extraction model.As a kind of unsupervised learning,autoencoder can greatly shorten the detection time when processing massive data.In order to enhance the model’s ability to extract feature information,the model proposes two improvement measures based on autoencoder.The first measure is to introduce two constraints into the AE unit to construct the AE(NS)unit.First,noise constraints are introduced to act on the input layer and output layer of AE,which enhances the robustness of the model.Secondly,sparse constraints are introduced to act on the hidden layer of AE to improve the generalization ability and classification accuracy of the model.The second measure is to stack the AE(NS)units in the form of a double-column stack to build a DCSAE(NS)model,so as to further extract the deep feature information in the data.Compared with the traditional single-column stack structure,this structure does not pass the noisy data to the next layer.Under the same experimental conditions,the detection accuracy of the DCSAE(NS)feature extraction model is 12.75% higher than that of the principal component analysis method,and 14.69%higher than that of the information gain method.(2)Aiming at the problems of low accuracy and high false alarm rate of the current intrusion detection system,this paper proposes the DAMBi GRU intrusion detection model.Recurrent neural networks have obvious advantages in learning the nonlinear characteristics of sequences.Through the study of its six related models,Bi GRU is selected as the classifier of the intrusion detection system.In order to improve the detection accuracy of the system,a deep attention mechanism is constructed to strengthen the model’s attention to important data information.The deep attention mechanism can help the model to automatically evaluate the weight relationship between different features of the data,and on this basis,simultaneously consider the influence of traffic data at adjacent moments on the current input information.The deep attention mechanism enables the intrusion detection model to adapt to different network environments by comprehensively analyzing historical input information and current moment information,so as to deal with the problems that are difficult to detect when new intelligent attack behaviors appear in various industries.Compared with the Bi GRU model without attention mechanism,the detection accuracy of DAMBi GRU intrusion detection model is increased by 4.37%,and the false positive rate is reduced by 8.17%.Combining the above two models,this paper proposes the DCSAE(NS)-DAMBi GRU network intrusion detection model.The model was tested on the UNSW-NB15 dataset.While the accuracy rate reached 98.93%,it took only 1.38 seconds and the false positive rate was as low as 1.29%.Compared with traditional learning methods,the method proposed in this paper has obvious advantages in network intrusion detection.Compared with other advanced algorithm models in the same field,the research method performed well on the "receiver operating characteristic" curve and the "precision-recall rate" curve,indicating that the model has certain validity and feasibility.