Research And Application Of Intrusion Detection Based On Hierarchical Features And Deep Learning

With the rapid development of the Internet,the highly heterogeneous data and the generation of massive data make traditional intrusion detection systems face huge challenges.Because most network data lack tags,intrusion detection methods based on classic machine learning cannot meet the requirements of high accuracy.Artificially constructed features cannot be adapted to new types of attacks,which cannot satisfy the requirements of flexibility and adaptability of intrusion detection systems in practical applications.Traditional intrusion detection methods contribute a high false alarm rate and low accuracy rate when dealing with large and high-dimensional data,this paper proposes an intrusion detection model based on hierarchical features after seriously studying intrusion detection methods and deep learning models.The main methods and innovations of the paper are as follows:First,facing high-dimensional heterogeneous network data,it is a research focus to quickly select effective features as the basis for intrusion detection,and map to low-dimensional space to reduce computational complexity.In this paper,deep learning algorithm is introduced into intrusion detection feature extraction,and a feature learning algorithm based on autoencoder is proposed.This method maps high-dimensional and nonlinear features to a low-dimensional space,which reduces the dimensionality and obtains the optimal low-dimensional representation.Second,Classic machine learning is difficult to learn good feature representations,so that high false alarm rate and low accuracy rate are obtained.This paper proposes a one-dimensional convolutional network to learn byte-level features in traffic data.Because one-dimensional convolutional neural networks are suitable for processing sequential data,they are used to learn the features of sequential network data.The improved network structure is used and the excellent feature representation can be learned.Third,Network intrusion usually lasts for a period of time,and there is correlation between data.It is difficult for traditional intrusion detection systems to obtain the characteristics of correlation between data,so it is impossible to accurately detect and classify the data.This paper proposes a hybrid intrusion detection model based on 1D-CNN?LSTM.It can further use LSTM to learn the correlation features between the data and the data session level based on the byte-level features 1D-CNN learned.Then this hierarchical feature is classified by classifier.In this paper,the feature extraction method based on auto-encoder is used to replace the traditional feature extraction method.Experiments show that the feature extraction method is10% higher than the traditional method.On the basis of feature extraction,the improved one-dimensional convolutional neural network structure is used to learn byte-level features,and the accuracy rate and false alarm rate are better than common intrusion detection algorithms such as RNN and DBN.Considering the correlation between intrusion data,LSTM is further used to learn the correlation features between session-level data,the highest accuracy rate can reach 99.80%,which is higher than the ID-CNN-based intrusion detection model.This paper proposes that the model can learn excellent features.