Research On Network Intrusion Detection Based On CNN-GRU And ResNet

In the face of various intrusion attacks with increasing frequency,traditional network security systems are not sufficient to deal with them,so intrusion detection technology is getting more and more attention.Commonly used intrusion detection models based on long short-term memory(Long Short-Term Memory,LSTM)have the problem of slow convergence.Considering that the network traffic data has both time and space characteristics,an intrusion detection model based on convolutional neural network(Convolutional Neural Networks,CNN)and gated recurrent unit(Gated Recurrent Unit,GRU)is proposed.CNN is used to extract the spatial features of the traffic data,and multiple small convolution kernels with the same parameters are used to replace the large convolution kernel to deepen the network structure.GRU can learn the timing characteristics of traffic data.It simplifies and improves the structure on the basis of LSTM.Therefore,the GRU model has a simpler structure,lower network complexity,and faster convergence.In order to further improve the performance and effect of the intrusion detection model,and at the same time reduce the overfitting phenomenon that occurs when the number of network layers is deepened,this paper introduces the residual network(Residual Network,ResNet)into the intrusion detection model and proposes an intrusion detection model based on ResNet-GRU.The residual module is used to ensure that the performance will not decrease when training a model with deep layers.The convolution kernel of 1?1 is used to shrink or expand the dimension of the input information to improve the operating efficiency of the model.Both models are validated with the classic dataset KDD99.The model based on CNN-GRU can achieve better results in the classification with sufficient training samples,and the accuracy,precision,recall and F1 value have been improved.When the model based on ResNet-GRU recognizes normal traffic,the accuracy and other indicators are higher than other comparison models.Compared with the traditional deep learning models based on CNN,LSTM,and GRU,the accuracy rate is about 0.5%higher,the accuracy rate and F1 value are about 1% higher,and the recall rate is more than 1% higher than the CNN and LSTM models.At the same time,the program running time is further shortened,and both the single epoch running time and the total running time are better than most comparison models.The model based on ResNet-GRU is a model that is further improved on the CNN part of the model based on CNN-GRU.It solves the problem of overfitting during the training of the model based on CNN-GRU.Compared with the model based on CNN-GRU,the accuracy rate and other indicators are slightly improved,and the running time is significantly reduced.Experimental results show that the intrusion detection model proposed in this paper can effectively detect network traffic data and has good detection results.