Research On Network Intrusion Detection Based On Deep Learning

From small mobile devices to large cloud platforms,most of the devices we use in our daily lives are networked and potentially vulnerable to cyber intrusions.With the rapid development of network technology and big data,cyber attacks are becoming more sophisticated and threatening.For largescale networks,it is critical and challenging to be able to catch intrusions in a timely manner.Network intrusion detection systems monitor and analyze anomalous activities in computer networks to determine whether someone is trying to illegally access,modify,or compromise the security of network systems or data.Compared to traditional machine learning algorithms,deep learning is able to handle high-dimensional data and detect network attacks well by automatically learning features.However,traditional intrusion detection methods cannot fully learn the features of the data,resulting in insufficient detection capability,which may significantly reduce the overall effectiveness of the intrusion detection system;in addition,there is an imbalance in the intrusion dataset,resulting in low detection rate of the model for a few classes.Therefore,in order to solve the above problems,this paper investigates a deep learning-based network intrusion detection method after a thorough understanding of intrusion detection and machine learning and other related knowledge.The main research work has the following aspects:1.In this paper,an intrusion detection model for serial networks based on global interactive attention is proposed.To address the problems of long time series data forgetting and low detection rate of intrusion detection,in order to improve the detection rate of the model,the model incorporates the long and short-term memory network and attention mechanism,using the long and short-term memory network can handle the features of time series data well,and introduces the attention mechanism to filter irrelevant information by the output of all time steps of the long and short-term memory network,so that the model can fully learn the features in the data.In addition,to improve the generalization ability of the model and prevent overfitting during model training,a Dropout layer is added,and the Focal loss loss function is applied to focus on samples with fewer data categories.Experiments on the NSL-KDD and UNSW-NB15 datasets show that our proposed model has higher accuracy and F1 values compared to the classical deep learning algorithms CNN,RNN and LSTM for both binary and multi-classification tasks.2.In this paper,a hybrid sampling data balancing method in intrusion detection is proposed.In order to improve the ability of the model to detect minority class samples and fully learn the characteristics of minority class samples,the method uses WGAN for data augmentation of minority class attack samples to expand minority class attack samples,where the WGAN model uses a combination of convolutional neural network and fully connected network;the random undersampling technique is used to randomly select the number of samples we need from the normal stream data.WGAN overcomes the the problems of difficult training and pattern collapse of the original generative adversarial network,and can generate more realistic minority class samples.This data balancing method can effectively improve the detection rate of the model for minority class data.The experimental results show that after balancing the data set with this method,the detection rate of the model for minority class samples is significantly higher,and the performance of this method is better compared with other traditional data enhancement algorithms.