多尺度对比嵌入增强的自适应入侵检测模型

    Multi-Scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model

    • 摘要: 在入侵检测中,一些无监督模型虽然能够利用阈值发现未知的攻击类型,但这类模型未能很好地利用已归纳出的流量模式来捕捉流量间的相似性和差异性,进而导致模型将未知的攻击流量视为正常流量。针对该问题,本文提出了一个多尺度对比嵌入增强的自适应入侵检测模型(Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model,MCE-IDM),基于层次对比学习将已有的攻击类型与其相关数据特征结合产生一个嵌入,再将嵌入与原始数据结合用于训练一个无监督模型。同时,使用轻量级梯度提升机来完成特征选取,有效降低了过往模型在特征选取阶段的时间复杂度。经过数据集验证,不仅模型性能稳定,而且其中一个数据类型极不平衡的数据集子集中的马修斯相关系数(Matthews Correlation Coefficient,MCC) 相比基准模型提高了15.78个百分点,同时在其他子集中也取得了较好的效果。

       

      Abstract: In intrusion detection, while certain unsupervised models can detect unknown attack types using thresholds, they usually fall short to effectively utilize the identified traffic patterns to capture the similarities and differences across traffic flows. As a result, unknown attack traffics are frequently misclassified as normal traffic. To address this issue, this paper proposes a Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model (MCE-IDM). It employs hierarchical contrastive learning to integrate known attack types with their associated data features, generating embeddings that are subsequently combined with the original data to train an unsupervised model.Furthermore, a lightweight gradient boosting machine is used for feature selection, which significantly reduces the time complexity during this phase compared to previous models. Experimental results on multiple datasets demonstrates that the proposed model not only exhibits stable performance but also improve the Matthews Correlation Coefficient (MCC) by 15.78 percentage point over baseline models on a highly imbalanced subset of data.The proposed method also consistently achieves competitive results across other subsets.

       

    /

    返回文章
    返回