ISSN 1000-1239 CN 11-1777/TP

计算机研究与发展 ›› 2022, Vol. 59 ›› Issue (2): 418-429.doi: 10.7544/issn1000-1239.20200825

• 信息安全 • 上一篇    下一篇

双重路由深层胶囊网络的入侵检测系统

尹晟霖,张兴兰,左利宇   

  1. (北京工业大学信息学部 北京 100124) (yinsl@emails.bjut.edu.cn)
  • 出版日期: 2022-02-01
  • 基金资助: 
    国家自然科学基金项目(61801008)

Intrusion Detection System for Dual Route Deep Capsule Network

Yin Shenglin, Zhang Xinglan, Zuo Liyu   

  1. (Faculty of Information Technology, Beijing University of Technology, Beijing 100124)
  • Online: 2022-02-01
  • Supported by: 
    This work was supported by the National Natural Science Foundation of China (61801008).

摘要: 深度学习与入侵检测相结合已成为当今网络空间安全的热点话题,面临不稳定的网络安全局势,如何能够准确检测出异常流量是入侵检测的重要任务.入侵数据中的每一条样本包含着多个特征,但并不是每一个特征都会决定样本的最终性质,并且某些特征反而会影响模型的判断能力.为了解决这个问题,提出了一种基于残差的双重路由深层胶囊网络的入侵检测模型.该模型使用深层胶囊网络,增强对特征的识别提取,可提取出更高维度的数据特征;使用混合注意力机制对原始数据进行处理,使模型着重关注影响因素大的特征;通过双重路由算法多方位捕捉基于向量表示的特征,并将特征进行聚类;采取残差连接和设置噪音胶囊2个策略来稳定动态路由的过程,以减轻噪音特征的干扰.最后在NSL-KDD数据集和CICIDS2017数据集上进行实验,结果表明准确率最高可达90.31%和99.23%.

关键词: 入侵检测, 混合注意力, 动态路由, 网络空间安全, 胶囊网络

Abstract: The combination of deep learning and intrusion detection has become a hot topic in cyberspace security. In unstable network security situation, how to accurately detect abnormal traffic is an important task for intrusion detection. Each sample in the intrusion data contains multiple features, but not every feature can determine the final nature of the sample. Some features will even affect the judgment ability of the model. To solve this problem, an intrusion detection model based on residuals of a double routing deep capsule network is proposed. The model uses a deep capsule network to enhance the identification and extraction of features, which can extract higher dimensional data features. A hybrid attention mechanism is used to process the raw data so that the model focuses on features with high impact factors. The model captures the features based on vector representation and clusters the features in multiple directions by a dual routing algorithm. It adopts two strategies, namely residual connectivity and noise capsules, to stabilize the dynamic routing process to mitigate the interference of noisy features. Finally, experiments are conducted on the NSL-KDD dataset and CICIDS2017 dataset, and the results show that the accuracy is up to 90.31% and 99.23%, respectively.

Key words: intrusion detection, mixed attention, dynamic routing, security in cyberspace, capsule network

中图分类号: