基于GRU与特征嵌入的网络入侵检测

doi:10.3969/j.issn.0255-8297.2021.04.004

Abstract

Abstract: The existing intrusion detection methods based on neural network have not taken data classification information into consideration yet, thus, the timing information of network traffic data are not used effectively. In this paper, we propose network intrusion detection models based on gated recurrent unit (GRU) in combination with embedding technique of categorical information. Simulation experiments on the models are carried out with UNSW-NB15, which is a comprehensive network traffic dataset. Experimental results show that the proposed models not only improve the detection rate of intrusion attacks, but also provide a new way for intrusion detection in case of processing large-scale data.

Key words: network intrusion detection, machine learning, gate recurrent unit (GRU), feature embedding

CLC Number:

TP301

YAN Liang, JI Shaopei, LIU Dong, XIE Jianwu. Network Intrusion Detection Based on GRU and Feature Embedding[J]. Journal of Applied Sciences, 2021, 39(4): 559-568.

References

[1] 郭小娟. 基于局部异常因子的信息网络流量异常检测[J]. 信息通信, 2019(11):32-33. Guo X J. Information network traffic anomaly detection based on local anomaly factors[J]. Information and Communication, 2019(11):32-33. (in Chinese)
[2] 曾惟如, 吴佳, 闫飞. 基于层级实时记忆算法的时间序列异常检测算法[J]. 电子学报, 2018, 46(2):325-332. Zeng W R, Wu J, Yan F. Time series anomaly detection algorithm based on hierarchical realtime memory algorithm[J]. Chinese Journal of Electronics, 2018, 46(2):325-332. (in Chinese)
[3] Garcia-Teodoro P, Diaz-Verdejo J, Macia-Fernandez G, et al. Anomaly-based network intrusion detection:techniques, systems and challenges[J]. Computers & Security, 2009, 28(1/2):18-28.
[4] Subbulakshmi T. Detection and classification of DDoS attacks using machine learning algorithms[J]. European Journal of Scientific Research, 2010, 47(3):334-346.
[5] Kaur S, Singh M. Hybrid intrusion detection and signature generation using deep recurrent neural networks[J]. Neural Computing & Applications, 2020, 32(12):129-142.
[6] 孙明轩, 翁丁恩, 张钰. 有限值终态递归神经网络计算[J]. 计算机科学, 2020, 47(1):212-218. Sun M X, Weng D E, Zhang Y. Calculation of finite value final state recurrent neural network[J]. Computer Science, 2020, 47(1):212-218. (in Chinese)
[7] 汤鹏杰, 王瀚漓, 许恺晟. LSTM逐层多目标优化及多层概率融合的图像描述[J]. 自动化学报, 2018, 44(7):1237-1249. Tang P J, Wang H L, Xu K S. LSTM layer-by-layer multi-objective optimization and multilayer probability fusion image description[J]. Acta Automatica Sinica, 2018, 44(7):1237-1249. (in Chinese)
[8] 薛阳, 王琳, 王舒, 等. 一种结合CNN和GRU网络的超短期风电预测模型[J]. 可再生能源, 2019(3):456-462. Xue Y, Wang L, Wang S, et al. An ultra-short-term wind power prediction model combining CNN and GRU networks[J]. Renewable Energy, 2019(3):456-462. (in Chinese)
[9] Pennington J, Socher R, Manning C D. Glove:global vectors for word representation[C]//Proceedings of the 2014 Conference on Empirical Methods in Natural Language Processing, 2014:1532-1543.
[10] Moustafa N, Slay J. UNSW-NB15:a comprehensive data set for network intrusion detection systems (UNSW-NB15 network data set)[C]//2015 Military Communications and Information Systems Conference, 2015:1-6.
[11] Dey R, Salemt F M. Gate-variants of gated recurrent unit (GRU) neural networks[C]//2017 IEEE 60th International Midwest Symposium on Circuits and Systems, 2017:1597-1600.
[12] Greff K, Srivastava R K, Koutník J, et al. LSTM:a search space odyssey[J]. IEEE Transactions on Neural Networks and Learning Systems, 2016, 28(10):2222-2232.
[13] Zhang J S, Xiao X C. Predicting chaotic time series using recurrent neural network[J]. Chinese Physics Letters, 2000, 17(2):88-97.
[14] Russac Y, Caelen O, He-Guelton L. Embeddings of categorical variables for sequential data in fraud context[C]//International Conference on Advanced Machine Learning Technologies and Applications. Cham:Springer, 2018:542-552.
[15] Choi H, Cho K, Bengio Y. Context-dependent word representation for neural machine translation[J]. Computer Speech & Language, 2017, 45(6):149-160.
[16] Shi Y, Zhang W Q, Liu J, et al. RNN language model with word clustering and class-based output layer[J]. EURASIP Journal on Audio, Speech, and Music Processing, 2013(1):1-7.
[17] Ingre B, Yadav A. Performance analysis of NSL-KDD dataset using ANN[C]//2015 International Conference on Signal Processing and Communication Engineering Systems, 2015:92-96.
[18] 何捷舟, 刘金平, 张五霞, 等. 基于在线自适应极限学习机选择性集成的网络入侵检测[J]. 中国科学技术大学学报, 2019, 49(7):544-554. He J Z, Liu J P, Zhang W X, et al. Network intrusion detection based on selective integration of online adaptive extreme learning machine[J]. Journal of University of Science and Technology of China, 2019, 49(7):544-554. (in Chinese)
[19] 谈帅昕. 基于分段核函数的SVM入侵检测方法[J]. 软件导刊, 2019, 18(3):43-46, 52. Tan S X. SVM intrusion detection method based on piecewise kernel function[J]. Software Guide, 2019, 18(3):43-46, 52. (in Chinese)
[20] 连超, 李华, 刘亚, 等. 一种基于DBN-LR集成学习的异常检测模型[J]. 小型微型计算机系统, 2019, 40(12):2637-2643. Lian C, Li H, Liu Y, et al. An anomaly detection model based on DBN-LR integrated learning[J]. Small Microcomputer System, 2019, 40(12):2637-2643. (in Chinese)

Network Intrusion Detection Based on GRU and Feature Embedding

PDF

Knowledge

Abstract

Cite this article

share this article

References

Related Articles 3

Recommended Articles

Metrics

Comments

[1]	ZHENG Hong, YE Cheng, JIN Yonghong, CHENG Yunhui. Customer Churn Prediction Method Based on Stacking Ensemble Learning [J]. Journal of Applied Sciences, 2020, 38(6): 944-954.
[2]	OUYANG Zhiyou, CHEN Chen, WANG Yuqian, CHEN Jingang, YIN Zhao, ZHOU Qingsong. Protein Small Molecule Affinity Prediction Based on Natural Language Processing [J]. Journal of Applied Sciences, 2019, 37(3): 327-335.
[3]	PENG Jian-fen1;2, ZHOU Ya-jian1;2, WANG Cong1;2, YANG Yi-xian1;2, PING Yuan1;2. Early TCP Traffic Classification [J]. Journal of Applied Sciences, 2011, 29(1): 73-77.