Research On Intrusion Detection Based On Deep Kernel Extreme Learning

Intrusion detection system is an important part of network security protection.Its performance is directly related to the normal operation of the network.With the development of Internet technology,the network topology is becoming more and more complex,the resulting network attacks are changing each passing day and the characteristics of intrusion data are more and more complicated as well,which brings huge challenges to the intrusion detection system.Therefore,it is important to study intrusion detection methods that efficiently process massive amounts of intrusion data and adapt to complex and variable network environments.The deep learning theory has made up for the shortcomings of traditional intrusion detection methods in high-dimensional feature processing.Its powerful feature learning ability is more suitable for processing massive multi-source heterogeneous intrusion data than traditional methods.However,the existing deep learning intrusion detection methods still have defects in low recognition rate of small sample attack categories,low training efficiency and inability to update parameters online according to the real-time network environment.Starting from these three questions,this paper has carried out the following research,the main work are as follows:(1)Firstly,the kernel extreme learning is used to improve the BP network of DBN,and proposes a hybrid deep learning intrusion detection method based on DBN-KELM.This method takes DBN as feature extractor and KELM as classifier.It combines the advantages of DBN in abstract feature extraction and KELM in fast learning and good classification performance.In the experiment,part of data sets NSL-KDD are used to validate,DBN-KELM algorithm is compared with DBN and DBN-ELM.In this section,accuracy,precision,recall,F-score and false alarm rate are used to evaluate comprehensively,the results show that DBN-KELM algorithm has better detection performance.(2)Aiming at the problem that the unbalanced distribution of training data in DBN-KELM causes KELM tend to attack sample categories with more content in training data,and the detection rate of small sample attack categories is not high,the DBN-KELM algorithm is improved by using the sample-weighted extreme learning machine WKELM,and a hybrid depth learning intrusion detection method based on DBN-WKELM is proposed.This method weights each training sample in the process of training samples,and reduces the weight of the sample with more content appropriately.In the experiment,Gmean was introduced to evaluate the balance of detection based on the first five evaluation indicators.The experimental results show that DBN-WKELM can improve the detection rate of smallsample classes at the lowest possible sacrifice of the detection rate of large sample attack classes and showing advantages with six indicators.(3)In view of the complex situation of the network environment,there is an defect that the DBN-WKELM intrusion detection method can not update the weight parameters according to the real-time network data.Thus,an intrusion detection method based on DBN-WOS-KELM classifier is proposed.This method can update the output weight of the classifier according to the new training data and the data which have participated in the training history do not need to participate in the training again.With the increase of training batches,the detection effect becomes better and better.The experimental results show that the training efficiency of DBN-WOS-KELM is higher with the same size of training data.