论文中文题名: | 基于 LSDBO 的特征选择和 CNN 优化的入侵检测研究 |
姓名: | |
学号: | 22207223078 |
保密级别: | 公开 |
论文语种: | chi |
学科代码: | 085400 |
学科名称: | 工学 - 电子信息 |
学生类型: | 硕士 |
学位级别: | 工程硕士 |
学位年度: | 2025 |
培养单位: | 西安科技大学 |
院系: | |
专业: | |
研究方向: | 入侵检测 |
第一导师姓名: | |
第一导师单位: | |
论文提交日期: | 2025-06-16 |
论文答辩日期: | 2025-06-04 |
论文外文题名: | Research on intrusion detection based on LSDBO feature selection and CNN optimization |
论文中文关键词: | |
论文外文关键词: | Dung Beetle Optimization Algorithm ; Intrusion Detection ; Class Imbalance Processing ; Feature Selection ; CNN Optimization |
论文中文摘要: |
在网络技术快速迭代的背景下,网络安全形势日趋严峻。作为网络防御体系的关键 组成部分,入侵检测技术的研究价值日益凸显。当前研究面临的主要难题在于:针对大 规模网络流量数据,如何有效提升检测精度并控制误报率、漏报率。研究表明,减少特 征维度和调优模型参数是改善检测效能的两个核心要素,二者均可建模为最优化问题。 为此,本文提出了一种融合多策略改进的蜣螂优化算法(LSDBO),并运用于入侵检测系 统的特征选择和 CNN 模型的参数优化中,以全面提升检测系统性能。主要研究工作包 括: (1)针对传统蜣螂优化算法(DBO)在全局搜索能力和收敛速度上的不足,本文提 出了一种融合多策略改进的蜣螂优化算法(LSDBO)。通过引入 Cubic 混沌映射初始化种 群、螺旋搜索策略更新个体位置、对立学习策略(OBL)增强全局搜索能力、高斯柯西变 异扰动策略进一步提升种群多样性,防止算法过早收敛来对算法进行改进,为验证 LSDBO 算法的性能,本文选取了 10 类典型基准测试函数进行测试,包括单峰函数(如 Sphere 函数)、多峰函数(如 Rastrigin 函数)以及固定维度复杂函数(如 Shekel 函 数)。基准测试函数优化结果对比显示,LSDBO 算法的最优值、最差值、平均值和标 准差更接近理论最优,表明其收敛性和全局搜索性能更佳。 (2)由于 CIC-IDS2017 数据集的类别不均衡,使得模型对小类别的攻击样本的辨 识率不高。在此基础上,引入一种将随机欠采样与 SMOTE 过采样相结合的数据均衡算 法。该算法采用随机欠采样方法降低了大多数类别的采样数目,并采用 SMOTE 过采样 方法实现小类别采样。从而有效平衡数据集。通过统计信息分析表明,生成数据在均 值、方差和标准差上与原始数据总体差异不大,表明其能有效留存原始数据关键统计特 征,具备有效性。 (3)为解决网络入侵数据高维特征引发的冗余和计算复杂度呈指数级增长等问 题,本文使用上文提出的 LSDBO算法进行特征选择。通过将特征数目与 F1分数结合作 为适应度函数,在 CIC-IDS2017 和 UNSW-NB15 数据集上分别保留了 8.1 个和 9.8 个特 征,准确率达到了 98.01%和 96.81%。此外,为应对 CNN模型中参数众多且随机取值难 以确定的挑战,本文使用上文所提出的 LSDBO 算法对 CNN 进行超参数优化。在 CIC- IDS2017 数据集上的实验结果表明,优化后的 CNN 模型检测准确率达到了 98.83%。多 数据集(CIC-IDS2017、UNSW-NB15、NSL-KDD)实验结果表明,所提方法在检测准确 率、误报率和漏报率等指标上均表现出一定优势。 综上,本文聚焦于入侵检测系统展开研究。首先,提出了 LSDBO 算法;其次,针对入侵检测数据中存在的样本不平衡问题,引入了类不平衡处理方法;最后,给出了基 于 LSDBO 算法的特征选择以及 CNN 模型参数优化的入侵检测方案。通过上述研究成 果,在入侵检测性能方面取得了较大幅度的提升。 |
论文外文摘要: |
Under the background of rapid iteration of network technology, the situation of network security is becoming more and more serious. As a key component of the network defense system, the research value of intrusion detection technology has become increasingly prominent. The main problem faced by the current research is how to effectively improve the detection accuracy and control the false positive rate and false negative rate for large-scale network traffic data. Studies have shown that reducing feature dimensions and tuning model parameters are two core elements to improve detection performance, both of which can be modeled as optimization problems. Therefore, this thesis proposes a multi-strategy improved dung beetle optimization algorithm(LSDBO), which is applied to the feature selection of intrusion detection system and the parameter optimization of CNN model to comprehensively improve the performance of detection system. The main research work includes : (1)Aiming at the shortcomings of traditional dung beetle optimization algorithm(DBO)in global search ability and convergence speed, this thesis proposes an improved dung beetle optimization algorithm(LSDBO)based on multi-strategy. The algorithm is improved by introducing Cubic chaotic map to initialize the population, spiral search strategy to update the individual position, opposition learning strategy(OBL)to enhance the global search ability, Gaussian Cauchy mutation perturbation strategy to further enhance the population diversity and prevent premature convergence of the algorithm. In order to verify the performance of the LSDBO algorithm, this thesis selects 10 typical benchmark functions for testing, including unimodal functions(such as Sphere function),multimodal functions(such as Rastrigin function)and fixed-dimensional complex functions(such as Shekel function).The comparison of the benchmark test function optimization results shows that the optimal value, the worst value, the average value and the standard deviation of the LSDBO algorithm are closer to the theoretical optimum, indicating that its convergence and global search performance are better. (2)Due to the class imbalance of CIC-IDS2017 data set, the recognition rate of the model for small-class attack samples is not high. On this basis, a data equalization algorithm combining random undersampling and SMOTE oversampling is introduced. The algorithm uses a random undersampling method to reduce the number of samples in most categories, and uses the SMOTE oversampling method to achieve small-category sampling. So as to effectively balance the data set. The statistical information analysis shows that the generated data is not significantly different from the original data in terms of mean, variance and standard deviation, indicating that it can effectively retain the key statistical characteristics of the original data and is effective. (3)In order to solve the problem of high-dimensional features of network intrusion data, this thesis uses the LSDBO algorithm proposed above for feature selection. By combining the number of features with the F1 score as the fitness function, 8.1 and 9.8 features were retained on the CIC-IDS2017 and UNSW-NB15 datasets, respectively, and the accuracy rate reached 98.01 % and 96.81%.In addition, in order to cope with the challenge of many parameters in the CNN model and the difficulty of determining random values, this thesis uses the LSDBO algorithm proposed above to optimize the hyperparameters of CNN.The experimental results on the CICIDS2017 dataset show that the detection accuracy of the optimized CNN model reaches 98.83 %. The experimental results of multiple data sets(CIC-IDS2017, UNSW-NB15, NSL-KDD)show that the proposed method has certain advantages in detection accuracy, false alarm rate and false negative rate. In summary, this thesis focuses on the research of intrusion detection system. Firstly, the LSDBO algorithm is proposed. Secondly, aiming at the problem of sample imbalance in intrusion detection data, a class imbalance processing method is introduced. Finally, an intrusion detection scheme based on feature selection of LSDBO algorithm and parameter optimization of CNN model is given. Through the above research results, the intrusion detection performance has been greatly improved. |
参考文献: |
[1]第55次《中国互联网络发展状况统计报告》发布[J].传媒论,2025,9(02):121. [3]张昊, 张小雨, 张振友, 李伟. 基于深度学习的入侵检测模型综述[J]. 计算机工程与应用, 2022, 58 (06): 17-28. [4]周垌, 周志平, 王利, 等. 基于 AutoEncoder 和 ResNet 的网络入侵检测方法[J]. 计算机 应用研究, 2020, 37 (S2): 224-226. [5]王蓉, 马春光, 武朋. 基于联邦学习和卷积神经网络的入侵检测方法[J]. 信息网络安全, 2020 (4): 47-54. [6]彭庆媛,王晓峰,唐傲,等.基于灰狼算法优化DBN-SVM的入侵检测方法[J].南京大学学报(自然科学),2025,61(02):270-282. [7]李青青,张凯,李晋国,等.基于集成学习的入侵检测系统对抗攻击检测[J].计算机工程与设计,2025,46(03):850-856. [8]史长鑫,宗学军,何戡,等.Transformer融合CNN-SRU的工业控制网络入侵检测方法[J].重庆理工大学学报(自然科学),2025,39(03):85-92. [9]景永俊,王浩,邵堃,等.一种基于图热核扩散卷积的网络入侵检测方法[J].计算机工程与科学,2025,47(03):459-471. [41]党建武, 谭凌. 改进果蝇算法优化加权极限学习机的入侵检测[J]. 系统仿真学报, 2021, 33(2): 331-338. [42]高兵,郑雅,秦静,等.基于麻雀搜索算法和改进粒子群优化算法的网络入侵检测算法[J].计算机应用,2022,42(04):1201-1206. [43]张震,张思源,田鸿朋. 基于改进多因子优化蝙蝠算法的网络入侵检测方法[J]. 郑州大学学报(工学版),2024,45(5):52-60,94. [44]郭慧,刘明艳.基于遗传算法和随机森林的入侵检测方法研究[J].计算机应用与软件,2024,41(01):304-309+314. [45]汪杰,汪祖民.多策略改进的被囊群算法在入侵检测中的应用[J].计算机工程与设计,2024,45(03):684-690. |
中图分类号: | TP393.08 |
开放日期: | 2025-06-16 |