Research On Intrusion Detection System Technology Based On Interpretable Model

With the rapid development of machine learning technology and the increasing complexity of network environment,the security and detection rate of intrusion detection model are more and more strict.Although the current intrusion detection model has some improvements in model performance,model validity and scalability,there are still many areas to be improved.For example,although the hierarchical decision process of decision tree makes it easy to explain,the detection performance of intrusion detection models based on decision tree is generally low due to the defect of decision tree itself.In addition,for the data with large interval values in the intrusion detection dataset,data normalization may lead to the loss of data precision,thus resulting in the decrease of model precision.Aiming at the problem that intrusion detection models based on decision tree may result in low detection accuracy,an intrusion detection method based on Auto-encoder and Additive Tree is proposed.In this method,Auto-Encoder is used to reconstruct the data similar to the original data to reflect the contribution of each feature in the original data in the reconstruction process.Moreover,the reconstruction data can be combined with the original data to realize the feature enhancement process,so that the Additive Tree can identify features more effectively,thus improving the prediction accuracy.A Predictive accuracy,Descriptive accuracy and Relevancy framework and UNSW-NB15 dataset are used to evaluate our proposed model.Experimental results show that our proposed model achieves the detection accuracy of 99.95% in prediction accuracy,which is better than most existing intrusion detection models.And it can provide high description accuracy,effectively solving the problem that intrusion detection models based on decision tree in intrusion detection field have low detection rate.Aiming at the problem that data normalization may degrade model performance,an intrusion detection method based on Logarithmic Auto-Encoder and XGBoost is proposed.In this method,the introduction of logarithmic neurons enables Auto-Encoder to train the original dataset directly,avoiding unnecessary loss of data precision,and thus achieving a good data reconstruction process.The data reconstructed by Logarithmic Auto-Encoder can highlight the contribution of each feature in the original data in the reconstruction process.And the reconstruction data can be combined with the original data to realize the feature enhancement process,enabling XGBoost to identify important features more effectively,thus improving the prediction accuracy.The UNSW-NB15 and CICIDS2017 datasets are used to evaluate our proposed model.Experimental results show that our proposed model achieves the detection accuracy of 95.11% on UNSW-NB15 dataset and 99.92% on CICIDS2017 dataset,which is better than most existing intrusion detection models.Moreover,the running time of our proposed model on UNSW-NB15 dataset is much lower than that of most existing intrusion detection models.In addition,we extract feature importance to illustrate the influence of each feature on the detection model.