Research On Multi-channel Intrusion Detection System Based On Deep Learning

In the context of complex and sensitive network traffic,the traffic data used for network security research is usually limited and unevenly distributed.Intrusion detection methods based on traditional machine learning have shortcomings in accuracy and false alarm rates.In response to the above-mentioned research problems,this paper proposes a multi-channel fusion intrusion detection method based on sparse autoencoder network.Firstly,in order to learn the pattern of corresponding attack traffic,use different types of traffic samples to train different sparse autoencoder networks.The coding layer of the sparse autoencoder network is used as the characterization channel of the corresponding type of traffic,use Bi LSTM model to fuse the flow characteristics processed by different channels,and learn the feature associations between different channels.In the binary-classification scenario,the multi-channel solution is simplified to a single-channel solution based on the normal channel.The single-channel solution only uses the normal channel to learn important characterization information of normal traffic,strengthens the model's attention to normal characterization,and reduces the interference of traffic noise.Secondly,facing the imbalance in traffic data,considering that the optimization scheme based on the data level has data waste and the difficulty of generating data.A cost-sensitive learning method based on algorithm level is used to optimize unbalanced training.In order to achieve cost-sensitive learning,the density-based GHMC loss function is analyzed and studied.This strategy does not consider the uneven distribution of the gradient within the interval caused by the imbalance in the number of samples,resulting in unreasonable loss weight calculation.To solve this problem,an optimized gradient interval division strategy based on the unsupervised K-means method is proposed.This strategy uses K-means clustering for each round of gradient information,and uses the cluster boundary as the adaptive interval boundary,so that the distribution number corresponding to the gradient within the interval is similar,and the weight deviation caused by the uneven gradient within the interval is reduced.Finally,based on the research of related algorithms and model structure,this paper designs and develops an intrusion detection prototype system based on C/S architecture.The model and algorithm of this article are embedded in the prototype system.Model training and detection effects are visually displayed.