针对随机森林(random forest,RF)超参数的选择会对RF的分类结果产生较大影响的问题,提出一种基于麻雀搜索算法(sparrow search algorithm,SSA)的RF超参数寻优方法,利用该方法帮助RF寻找一组优秀的超参数.并针对RF较难准确识别出少数类数据的问题,利用平衡随机森林(balanced random forest,BRF)来提高模型对少数类的召回率.综合SSA和BRF构建SSA-BRF模型,并在CIC-IDS-2017数据集对模型的分类效果进行验证.实验结果表明,SSA-BRF相较于RF在准确率、宏召回率和宏F1分数上分别提升了9.57%、26.62%和0.17,该模型在一定程度上可以提高网络入侵检测系统的性能.
In order to solve the problem that the selection of hyper-parameters of random forest(RF)will have a great impact on the classification results of RF, an optimization method of RF hyper-parameters based on sparrow search algorithm(SSA)is proposed to help RF find a set of excellent hyper-parameters. Balanced random forest(BRF)is used to solve the problem that RF is difficult to accurately identify minority data, so as to improve the recall rate of the model for minority data. Finally, SSA-BRF model is constructed by integrating SSA and BRF, and the classification effect of the model is verified in CIC-IDS-2017 data set. Experimental results show that compared with RF, the accuracy, macro recall and macro F1 score of SSA-BRF are improved by 9.57%, 26.62% and 0.17 respectively. This model can improve the performance of network intrusion detection system to a certain extent.
[1] OSADA G, OMOTE K, NISHIDE T. Network intrusion detection based on semi-supervised variational auto-encoder[C] //Proceedings of the 2017 European Symposium on Research in Computer Security. Berlin: Springer, 2017: 344-361.
[2] 温博文,董文瀚,解武杰,等.基于改进网格搜索算法的随机森林参数优化[J].计算机工程与应用, 2018, 54(10): 154-157.
[3] AMBIKAVATHI C, S. K. S. Tuning random forest parameters using simulated annealing for intrusion detection[J]. International Journal of Innovative Technology and Exploring Engineering(IJITEE), 2020, 9(9): 353-358.
[4] 柯钢.改进粒子群算法优化支持向量机的入侵检测方法[J].合肥工业大学学报(自然科学版), 2019, 42(10): 1341-1345.
[5] ZHANG H P, HUANG L L, WU C Q, et al.An effective convolutional neural network based on SMOTE and gaussian mixture model for intrusion detection in imbalanced dataset[J].Computer Networks, 2020, 177: 107315.
[6] JIANG K Y, WANG W Y, WANG A L, et al.Network intrusion detection combined hybrid sampling with deep hierarchical network[J].IEEE Access, 2020, 8: 32464-32476.
[7] PHYO T T K, HTWE P P W, KHIN N N T.New intrusion detection framework using cost sensitive classifier and features[J].International Journal of Wireless and Microwave Technologies(IJWMT), 2022, 1: 22-29.
[8] MULYANTO M, FAISAL M, PRAKOSA S W, et al.Effectiveness of focal loss for minority classification in network intrusion detection systems[J].Symmetry, 2020, 13(1): 4.DOI:10.3390/sym13020004.
[9] 曹扬晨,朱国胜,祁小云,等.基于随机森林的入侵检测分类研究[J].计算机科学,2021, 48(S1): 459-463.
[10] CHEN C, LIAW A, BREIMAN L. Using random forest to learn imbalanced data[J]. University of California, Berkeley, 2004, 110(24): 1-12.
[11] XUE J K, SHEN B. A novel swarm intelligence optimization approach: sparrow search algorithm[J]. Systems ence & Control Engineering An Open Access Journal, 2020, 8(1): 22-34.
[12] TAVALLAEE M, BAGHERI E, LU W, et al. A detailed analysis of the KDD CUP 99 data set[C] //2009 IEEE Symposium on Computational Intelligence for Security and Defense Applications, IEEE, 2009: 1-6. DOI:10.1109/CISDA.2009.5356528.
[13] MOUSTAFA N, SLAY J. UNSW-NB15: a comprehensive data set for network intrusion detection systems(UNSW-NB15 network data set)[C] //2015 Military Communications and Information Systems Conference(MilCIS), IEEE, 2015: 1-6. DOI:10.1109/MilCIS2015.7348942.
[14] SHARAFALDIN I, LASHKARI A H, GHORBANI A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C] //4th International Conference on Information Systems Security and Privacy, Portugal: ICISSP Press, 2018: 108-116. DOI:10.5220/0006639801080116.
[15] 杨圣哲.面向不平衡数据的网络入侵检测方法研究[D].北京:北京交通大学, 2021.
[16] 孙一恒.基于改进深度森林的入侵检测方法研究[D].武汉:湖北工业大学, 2020.
[17] 陈成.小样本纠错的混合入侵检测分类器研究[D].广州:广东工业大学, 2020.
[18] 冯杰.基于卷积神经网络的网络入侵检测算法研究[D].太原:山西大学, 2020.
[19] 卢琼.基于深度学习的网络攻击检测技术的研究[D].北京:华北电力大学, 2020. (
