Research On High-Performance Intrusion Detection Based On Deep Learning Interpretability

Deep learning has made significant research progress in the field of intrusion detection,but there are still many challenges and problems,such as the quality and quantity of training datasets,the interpretability and adaptability of models,etc.Most existing intrusion detection datasets are extremely unbalanced,which has a huge impact on the performance of intrusion detection algorithms.At the same time,the interpretability problem of deep learning algorithms makes the model classification results unreliable and unable to track and trace attacks.To address the problem of severe data imbalance in existing datasets,a multi-expert learning algorithm is proposed in this thesis.Through differentiated training by multiple experts and distribution awareness,the algorithm can fully learn from minority class samples while ensuring that the performance of majority class samples is not lost.In the multi-expert learning framework,a prediction probability adjustment strategy is proposed to ensure the algorithm can achieve the optimal solution of Fisher consistency in this thesis.The simulation results show that the overall accuracy of this algorithm can be improved by at least 3.22%on the UNSW-NB15 dataset and has obvious advantages over existing algorithms in terms of minority class performance.To address the problem of data redundancy in intrusion detection datasets,an optimized prototype learning algorithm for MMD is proposed to extract representative data and outlier samples in this thesis.The output prototypes are used to construct a prototype dataset for intrusion detection training.The classification performance of the prototype set is comparable to that of the original dataset in terms of accuracy and precision indicators,and only decreases by 3%in terms of comprehensive indicators,indicating that the prototype set is effective.At the same time,training time can be improved by at least 11 times,effectively improving training efficiency.To address the problem of uninterpretability of deep learning,a model interpretability algorithm based on TabNet is proposed in this thesis.This algorithm can output the importance of each feature in each layer’s decision-making process and derive global interpretability through a combination of stepwise importance.According to decision-making information,TabNet network is combined with multi-expert learning network proposed in Chapter 3 to prune expert network,reduce computational complexity and improve model interpretability.The simulation results show that the global feature importance output by TabNet algorithm is mostly consistent with important features obtained by other algorithms using feature engineering.Compared with existing algorithms,the multi-expert learning algorithm based on TabNet has superiority in terms of accuracy,precision,recall,and F1 score in multiclassification.The highest accuracy achieved is 99.91%.