Research On Intrusion Detection Model For Imbalanced Dataset

In recent years,with the expansion of the Internet scale,network users are also facing the threat of network attacks while enjoying network services.The high harmfulness of network attacks makes network security issues focused by people.As an important method of maintaining network security,the intrusion detection system can effectively detect abnormal attack traffic in the network by combining with machine learning and deep learning.In intrusion detection,the imbalance of network traffic data is a widespread problem.There is a large quantitative gap between different types of traffic data,and such a gap will cause the classifier to be ineffective in detecting minority attack traffic;In addition,most intrusion detection models do not extract enough features from network traffic data,and the performance of intrusion detection needs to be improved.In the first part,aiming at the problem of imbalanced data in the intrusion detection dataset,the problem is abstracted into the problem of imbalanced data of the general dataset to solve it,and the DC-SMOTE oversampling algorithm based on local density and centrality is proposed.First,the Gaussian kernel function and local gravity are used to calculate the local density and centrality of the minority class samples in the dataset;Then,in order to solve the problem of within imbalance of the dataset,the type-1 oversampling points are synthesized for the parts with low local density;At the same time,in order to strengthen the boundary of minority class samples,according to the difference of centrality,the type-2 oversampling points are synthesized for the distinguished minority class boundary samples;Finally,by adaptively generating new samples,it solves the problem that most oversampling algorithms do not specify the amount of oversampling and pursue the equal of imbalance ratio of samples.The results show that the algorithm has good performance in both low imbalance ratio datasets and high imbalance ratio datasets.It shows that the algorithm can solve the problem of imbalanced data from the data level.In the second part,after obtaining the DC-SMOTE algorithm,it is applied to the data preprocessing part of the intrusion detection model.Meanwhile,to solve the problem of insufficient feature extraction of network traffic data by most intrusion detection models,a triple attention mechanism model is constructed by using selective convolution,channel attention mechanism and spatial attention mechanism.In the process of feature extraction,a large range of receptive field are used for feature extraction by selective convolution,and attention mechanisms are added to allocate different weight of features,which is combined into the triple attention mechanism model.The triple attention model trained by the dataset processed by the DC-SMOTE algorithm achieved 99.31% overall classification accuracy on the NSL-KDD dataset,and the classification precision of U2 R attacks and R2 L attacks with few samples reached 92% and 91.27%respectively.The paper has 33 pictures,22 tables,and 69 references.