School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing 100876, China.
Sensors (Basel). 2021 Dec 22;22(1):25. doi: 10.3390/s22010025.
Preventing network intrusion is the essential requirement of network security. In recent years, people have conducted a lot of research on network intrusion detection systems. However, with the increasing number of advanced threat attacks, traditional intrusion detection mechanisms have defects and it is still indispensable to design a powerful intrusion detection system. This paper researches the NSL-KDD data set and analyzes the latest developments and existing problems in the field of intrusion detection technology. For unbalanced distribution and feature redundancy of the data set used for training, some training samples are under-sampling and feature selection processing. To improve the detection effect, a Deep Stacking Network model is proposed, which combines the classification results of multiple basic classifiers to improve the classification accuracy. In the experiment, we screened and compared the performance of various mainstream classifiers and found that the four models of the decision tree, k-nearest neighbors, deep neural network and random forests have outstanding detection performance and meet the needs of different classification effects. Among them, the classification accuracy of the decision tree reaches 86.1%. The classification effect of the Deeping Stacking Network, a fusion model composed of four classifiers, has been further improved and the accuracy reaches 86.8%. Compared with the intrusion detection system of other research papers, the proposed model effectively improves the detection performance and has made significant improvements in network intrusion detection.
防范网络入侵是网络安全的基本要求。近年来，人们对网络入侵检测系统进行了大量研究。然而，随着高级威胁攻击的日益增多，传统的入侵检测机制存在缺陷，仍然需要设计一个强大的入侵检测系统。本文研究了 NSL-KDD 数据集，并分析了入侵检测技术领域的最新发展和现有问题。针对训练用数据集存在分布不平衡和特征冗余的问题，对部分训练样本进行欠采样和特征选择处理。为了提高检测效果，提出了一种深度堆叠网络模型，该模型结合了多个基本分类器的分类结果，提高了分类精度。在实验中，我们筛选和比较了各种主流分类器的性能，发现决策树、k-最近邻、深度神经网络和随机森林这四种模型具有出色的检测性能，满足不同分类效果的需求。其中，决策树的分类准确率达到 86.1%。由四个分类器组成的融合模型深度堆叠网络的分类效果得到了进一步提高，准确率达到 86.8%。与其他研究论文的入侵检测系统相比，所提出的模型有效地提高了检测性能，在网络入侵检测方面取得了显著的改进。
