Research On Intrusion Detection Method Based On Multi-view Features

With the increasing popularity of the Internet,network security attacks are increasing,and intrusion detection systems have been developed to maintain the normal production order of the network.How to deal with network traffic so that the extracted features can fully describe network behavior is a vital part of intrusion detection system.The traditional intrusion detection system based on deep learning has too single processing of network traffic data,which leads to a bottleneck in the development of intrusion detection technology.Therefore,it is of great significance to design an intrusion detection algorithm that can make full use of the rich information in network data.In this dissertation,the hierarchical extraction and fusion of the features of different levels in the network connection,and combining the attention mechanism and the gating loop unit,propose a new intrusion detection algorithm(Multi-View feature with Attention and GRU,MVAG).First,based on the characteristics of network connection traffic,the deep confidence network is improved.Aiming at the shortcomings of traditional RBM that can only handle binary distributed data,a solution is proposed to use real-valued RBM to process network connection feature values;for the defect of RBM extraction of feature homogeneity,Proposes an improvement measure to introduce the combined sparse distribution penalty term into the loss function to reduce the probability of model overfitting.Secondly,the improved deep belief network is used to independently extract features of different levels of network connections,and multiple independent view features are merged to form a multi-view fusion feature through the fusion of the RBM network.The structured information with different levels of features in the fusion feature can be fully reflected Connection characteristics.Finally,a time-series-based intrusion detection classifier is constructed to reduce the dimensionality of the multi-view fusion features to reduce the computational complexity.The dimensionality-reduced data is divided into time step matrices of the same size in chronological order and input into the gated loop unit.At each time step,the global attention mechanism is used to increase the weight of important samples,thereby improving the accuracy of intrusion detection.In order to verify the effectiveness of the MVAG proposed in this dissertation,experimental tests are carried out on the NSL-KDD and UNSW-NB15 data sets to verify the effectiveness of combined sparse distribution penalty terms and multi-view feature fusion.The MVAG model is compared with traditional intrusion detection algorithms based on machine learning and deep learning.The experimental results show that the comprehensive performance of MVAG on various indicators is better than the control group,which improves the detection rate without increasing too much computational cost,has a certain feasibility.