Research On Intrusion Detection Based On Deep Belief Network

Aiming at the two problems of low detection capability of unknown type attacks and low detection rate caused by improper data-processing in the intrusion detection technology at present,and using better learning ability and generalization ability of Deep Learning,a kind of Deep Belief Network(DBN)intrusion detection algorithm is proposed,and integrates the data optimization processing technology.This method improves the data processing and method on the base of not destroying the knowledge that the model has learned and not seriously affecting the real-time performance of the detection.Firstly,the datasets are cleaned,encoded by Probability Mass Function(PMF)and normalized by MaxMin normalization,and several comparative experimental datasets are obtained.Secondly,by only changing one of the parameters,such as the connection weights,learning rate and iteration number in the DBN model,and controling the invariant of other parameters and 10 percent cross-validation of the model,the DBN model with depth of 4 and the number of nodes of each layer being 41-20-20-5 respectively are established;Thirdly,several comparative experimental datasets are applied to the above DBN model respectively,then the data optimization processing method which can improve the DBN model detection result is obtained,and the detection of unknown type attacks is realized by using this model.Finally,based on the classical dataset NSL-KDD of intrusion detection,the experiment uses the correct detection rate and time as the evaluation criterion and selects the classical intrusion detection algorithm,like Support Vector Machine(SVM)and the Back Propagation(BP)neural network to realize comparison experiment.The experimental results show that the optimized data processing can improve the correct detection rate of the DBN model,and the correct detection rate of DBN model intrusion detection algorithm to unknown type attacks is higher than the SVM algorithm and BP neural network algorithm without affecting the correct detection rate of the known types of attacks,which can solve the problem of low detection ability to unknown type attacks more efficiently,in real-time detection,the algorithm is equivalent to SVM algorithm and BP network algorithm.