Research On Network Intrusion Detection Model Based On Deep Learning

Facing the network security problems under the current complex network environment,the intrusion detection related research is particularly important.Aiming at the problem of data imbalance in real network traffic data,as well as the difficulty of feature extraction and inaccurate expression of extracted features in traditional machine learning methods,this thesis aims to improve the detection performance of traffic categories with small number of samples without affecting the detection performance of traffic categories with large number of samples,and the method to solve the imbalance problem and the deep learning method are applied to the intrusion detection model.The main work and innovation of this thesis are as follows:1.In order to solve the problem of data imbalance between categories of traffic and the difficulty and inaccuracy of traditional machine learning feature extraction,this thesis designs and implements the intrusion detection model based on Borderline-SMOTE and dual attention.Firstly,this thesis converts one-dimensional traffic data into twodimensional grayscale images to make full use of the powerful feature extraction ability of two-dimensional convolutional neural network.At the same time,the feature extraction and feature update parts of dual attention network are constructed to extract the traffic features and represent the features accurately.Secondly,the network is trained with the traffic data processed by borderline smote to improve the ability of the model to detect the unbalanced traffic data in the real network environment.Finally,the test results on NSL-KDD data set show that the overall accuracy of the model is as high as 99.24%,and the detection accuracy for R2 L and U2 R attack categories with a small number of samples reaches 83.95% and82.33%,respectively.2.Considering that deep learning has stronger representation ability than traditional machine learning when facing high-dimensional data,this thesis constructs the structure of encoder and decoder in VAE to learn the internal characteristic distribution of certain traffic data,and then generates pseudo samples similar to real samples according to the given distribution of original traffic samples.At the same time,in order to explore the impact of more complex neural network on intrusion detection performance,the dense connection module of Dense Net is introduced to reuse the characteristics of traffic data channel dimension,and effective channel attention is added to the composite function of each dense connection module to capture the interaction characteristics between adjacent channels.By comparing different imbalanced processing methods,it shows that the VAE is advanced in processing imbalanced problems of traffic data.Meanwhile,the test results of this model on NSL-KDD data set show that the detection accuracy of R2 L and U2 R attack categories with a small number of samples reaches 90.69% and 100%,respectively.