Research On Intrusion Detection Based On Deep Belief Network And Random Forest Algorithm

With the rapid development of Internet technology,the problem of network security has become increasingly prominent.As an effective network security technology,intrusion detection has become an important means to ensure the information security of every citizen and even the whole country.However,due to the increasing scale of the network,a variety of new network attacks emerge one after another,the traditional intrusion detection model has been unable to meet the current network security needs.Deep Belief Network(DBN)and Random Forest(RF)have strong feature learning ability and excellent classification performance,respectively.This paper makes use of their advantages to study intrusion detection.The main work is as follows:1)To solve the problem that traditional intrusion detection models are inadequate in extracting features from high-dimensional and redundant network data,DBN is used for data feature extraction,and the Adam optimizer is used as a gradient descent method for Back Propagation(BP)neural networks in the fine-tuning stage of DBN to accelerate the convergence speed of BP networks as well as to effectively avoid BP networks from falling into local optima in the process of finding the optimal value.2)To solve the problem that RF cannot guarantee to find a good set of hyperparameters and thus affects the classification effect,an RF hyperparameter search method based on the Sparrow Search Algorithm(SSA)is proposed,and the RF model trained with this method has a stronger classification performance.SSA-RF has a 1.78 percentage point improvement in accuracy and a 3.22 percentage point reduction in false negative rate on the NSL-KDD dataset.3)To solve the problem that traditional intrusion detection models are less likely to accurately identify rare attack data,Balanced Random Forest(BRF)is used to improve the classification performance of RF on minority class data by adding a balancing mechanism to the data sampling phase of RF.BRF has a 21.18 percentage point improvement in average minority class recall on the NSL-KDD dataset compared to RF.Further validation on the UNSW-NB15 and CIC-IDS-2017 datasets showed that the average minority class recall improved by 37.66 and 25.44 percentage points respectively.The DBN-SSA-BRF model is constructed by combining the advantages of DBN,SSA and BRF.The model improved the accuracy,macro recall and macro F1 score by5.17,18.90 percentage points and 0.16 respectively on the NSL-KDD dataset compared to RF.In summary,DBN-SSA-BRF significantly improved the intrusion detection performance.Figure 22;Table 24;Reference 45...