Research And Application Of Deep Learning For Intrusion Detection

With the development of society and the popularization of the Internet,people are also facing an increasing number of network security problems,such as botnets,such as botnets,web phishing,hosting fraud,and repeated attacks on users’ personal privacy data,only using firewall defense technology cannot solve security risks.As a dynamic defense system,intrusion detection technology can supplement firewall defense technology effectively.With the development of artificial intelligence,machine learning is gradually being applied in the field of intrusion detection,to monitor the abnormalities in the network in real time,and to identify the attack behavior in the network.However,as the scale of network data becomes high-dimensional and large,Intrusion detection methods based on machine learning are faced with problems such as difficulty in processing large-scale data and reduced detection accuracy.In addition,in the field of intrusion detection,there are still problems such as unopened private data and unbalanced distribution of traditional intrusion detection training data sets,which seriously affect the development of intrusion detection technology.As a branch of machine learning,deep learning has the ability to automatically extract data features and the larger the amount of data,the better the performance,with good learning performance.Therefore,deep learning technology is used in this paper to solve the problems of data imbalance,low detection rate and slow training efficiency in intrusion detection.The main research content and experimental results of this paper are as follows1、 Aiming at the problems of unbalanced intrusion detection data and low detection rate of rare attacks,a data unbalanced processing method based on WGAN-GP and K-Means is proposed.The method uses the dynamic game theory of network model to enhance the rare data,so that the generated data has diversity.For most class data,the K-Means algorithm is used for clustering,and then each subset is undersampled according to the sampling proportion The balanced data set and the original data set obtained from the above two steps are respectively trained on the three groups of deep learning intrusion detection classification models.The experimental results show that this method can improve the detection rate of intrusion detection models and address data imbalance issues.2、The intrusion detection model is difficult to process large-scale data and the training efficiency is slow,an intrusion detection method based WK-1DCNN-GRU is proposed.on the spatio and temporal characteristics of network traffic data.The model firstly uses WGAN-GP and K-Means to process the unbalanced data and improve the detection performance.Then,from the perspective that intrusion detection data has space-time characteristics,one-dimensional Convolutional Neural Networks(1DCNN)with batch normalization(BN)algorithm and combined Gate Recurrent Unit(GRU)neural network for comprehensive feature extraction of data.Finally,the model is compared with other methods.The experimental results show that the intrusion detection model based on WK-1DCNN-GRU has the advantages of simple structure,low network complexity,fast convergence,and improves the efficiency and detection rate.Finally,this model is compared with intrusion detection model based machine learning and single network intrusion detection model.The experimental results show that the intrusion detection method based on WK-1DCNN-GRU has good performance.