期刊
EXPERT SYSTEMS WITH APPLICATIONS
卷 139, 期 -, 页码 -出版社
PERGAMON-ELSEVIER SCIENCE LTD
DOI: 10.1016/j.eswa.2019.112845
关键词
Intrusion detection system; Gaussian mixture model; Greedy algorithm; Fuzzy rough set; Information gain ratio; Pattern learning
类别
资金
- National Natural Science Foundation of China (NSFC) [61501183, 61771492]
- NSFC [61725306, U1701261]
- Guangdong provincial government [U1701261]
- Hunan Natural Science Fund [2018JJ3349]
- key laboratory of minister of education for image processing and intelligence control (Huazhong University of Science and Technology) [IPIC2017-03]
- postgraduate student research and innovation projects of Hunan Province [CX2018B31]
In this paper, an adaptive network intrusion detection method using fuzzy rough set-based feature selection and GA-GOGMM-based pattern learning is presented. Based on the fuzzy rough set theory, the optimal attribute subset of network connection records is achieved by the information gain ratio criterion in advance. A greedy algorithm-based global optimal Gaussian mixture model (GMM) clustering method, termed GA-GOGMM, is introduced, to extract the intrinsic structure of network instances to achieve highly-discernable and stable normal and intrusion pattern libraries for the subsequent network intrusion detection (NID). GA-GOGMM-based pattern learning can achieve the optimal GMM of network traffic instances for the pattern clustering while avoiding the negative effect of the empirical initialization of clustering numbers and random initialization of clustering centers with a low computational complexity. An adaptive model updating mechanism is further introduced for the online updating of normal and intrusion pattern libraries to ensure the adaptability of the NID model. Extensive validation and comparative experiments, conducted on a benchmark dataset NSL-KDD and a self-built Nidsbench-based network simulation platform, show that the proposed ANID approach leads to a significant improvement in detection accuracies with low false alarms and missing reports on both known and unknown attacks. It can effectively adapt to the dynamic changing network environments with high detection accuracy and low false alarm rate as well as low missing reporting rate, which has significant application prospects. (C) 2019 Elsevier Ltd. All rights reserved.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据