基于数据特征学习的网络安全数据分类方法研究

doi:10.3969/j.issn.1671-1122.2019.10.007

信息网络安全 ›› 2019, Vol. 19 ›› Issue (10): 50-56.doi: 10.3969/j.issn.1671-1122.2019.10.007

基于数据特征学习的网络安全数据分类方法研究

刘延华^1,², 高晓玲^1,²(), 朱敏琛^1,², 苏培煌^1,²

1.福州大学数学与计算机科学学院,福建福州 350108
2.福建省网络计算与智能信息处理重点实验室,福建福州 350108

收稿日期:2019-06-03 出版日期:2019-10-10 发布日期:2020-05-11
通讯作者: 高晓玲 E-mail:214833246@qq.com
作者简介:
作者简介：刘延华（1972—）,男,山东,副教授,博士,主要研究方向为网络信息安全及网络内容分析;高晓玲（1995—）,女,福建,硕士研究生,主要研究方向为网络信息安全;朱敏琛（1961—）,女,上海,教授,主要研究方向为模式识别和智能计算;苏培煌（1993—）,男,福建,硕士研究生,主要研究方向为网络信息安全。
基金资助:
国家自然科学基金[61772136];福建省科技厅重点项目[2014H0024];福建省科技创新平台建设项目[2014H2005];福州大学科技项目[XRC-18007]

Research on Classification Method of Network Security Data Based on Data Feature Learning

Yanhua LIU^1,², Xiaoling GAO^1,²(), Minchen ZHU^1,², Peihuang SU^1,²

1. College of Mathematics and Computer Science, Fuzhou University, Fuzhou Fujian 350108, China
2. Fujian Provincial Key Laboratory of Network Computing and Intelligent Information Processing, Fuzhou Fujian 350108, China

Received:2019-06-03 Online:2019-10-10 Published:2020-05-11
Contact: Xiaoling GAO E-mail:214833246@qq.com

摘要/Abstract

摘要：

数据分类在网络安全防护与监测预警中发挥着重要作用。随着网络系统规模的扩大、网络速度的提高以及网络安全事件的增多,安全数据的数量急剧增加,极大影响了数据分类的准确性,从而给入侵检测、安全评估、攻击意图识别等安全应用带来极大挑战。文章提出一种结合SMOTE-SVM算法和XGBoost算法的数据分类模型。首先,针对数据不平衡的情况,采用过采样和下采样相结合的方法,设计一种基于SMOTE-SVM算法的数据特征平衡方法,提高了训练数据分布的合理性和训练精度。然后,针对多源异构的安全数据的多样性特点,采用独热编码技术实现数据的规范化。最后,基于XGBoost算法对数据集进行特征提取和分类。实验结果表明,该方法在数据分类查准率、召回率和综合有效性方面具有明显优势,能有效提高网络安全大数据的分析能力,对网络安全态势感知具有重要的应用意义。

关键词: 网络空间安全, 不平衡数据, SMOTE, XGBoost

Abstract:

Data classification plays an important role in cyberspace security situational awareness applications. However, with the expansion of network system scale, the increase of network speed, and the increase of network security incidents, the number of security data increases dramatically, which greatly affects the accuracy of data classification, thus bringing great challenges to security applications such as intrusion detection, security assessment and attack intention recognition. This paper proposes a data classification model integrating SMOTE-SVM algorithm and XGBoost algorithm. Firstly, in view of the data imbalance situation, by combining with up-sampling and down-sampling, a data feature balance method based on SMOTE-SVM algorithm is designed to improve the rationality of training data distribution and training accuracy. Then, in view of the diversity of multi-source heterogeneous security data, single-hot coding technology is used to standardize the data. Finally, based on XGBoost algorithm, feature extraction and classification of data sets are carried out. Experimental results show that the proposed method has obvious advantages in data classification accuracy, recall rate and comprehensive effectiveness. It can effectively improve the analysis ability of large data of network security, and has important application significance for network security situational awareness.

Key words: cyberspace security, imbalanced data, SMOTE, XGBoost

中图分类号:

TP309

刘延华, 高晓玲, 朱敏琛, 苏培煌. 基于数据特征学习的网络安全数据分类方法研究[J]. 信息网络安全, 2019, 19(10): 50-56.

Yanhua LIU, Xiaoling GAO, Minchen ZHU, Peihuang SU. Research on Classification Method of Network Security Data Based on Data Feature Learning[J]. Netinfo Security, 2019, 19(10): 50-56.

图/表 10

图1

图2

图3

表1

表2

表3

图4

图5

表4

表5

参考文献 15

[1]	SUN Yanmin, WONG A K C, KAMEL M S. Classification of Imbalanced Data: A Review[J]. International Journal of Pattern Recognition & Artificial Intelligence, 2009, 23(4): 687-719.
[2]	HE Haibo, GARCIA E A, Learning from Imbalanced Data[J]. IEEE Transactions on Knowledge and Data Engineering, 2009, 21(9): 1263-1284.
[3]	FU Zhongliang.Research on Continuous AdaBoost Algorithm for Unbalanced Multiple Classification Problems[J]. Journal of Computer Research and Development, 2011, 48(12): 2326-2333.
	付忠良. 不平衡多分类问题的连续AdaBoost算法研究[J]. 计算机研究与发展,2011,48(12):2326-2333.
[4]	LI Xiongfei, LI Jun, DONG Yuanfang, et al.A New Unbalanced Data Learning Algorithm PCBoost[J]. Chinese Journal of Computers, 2012, 35(2): 202-209.
	李雄飞,李军,董元方,等. 一种新的不平衡数据学习算法PCBoost[J]. 计算机学报,2012,35(2):202-209.
[5]	LI Jia, LI Hui, YU Junling.Application of Random-SMOTE on Imbalanced Data Mining[C]//IEEE. Fourth International Conference on Business Intelligence & Financial Engineering, October 17-18, 2011, Wuhan, China. NJ: IEEE, 2012: 130-133.
[6]	LI Longjie, YU Yang, BAI Shenshen, et al.Towards Effective Network Intrusion Detection: A Hybrid Model Integrating Gini Index and GBDT with PSO[J]. Journal of Sensors, 2018, 18(6): 1-9.
[7]	DONG S K, PARK J S.Network-based Intrusion Detection with Support Vector Machines[C]//Springer. International Conference on Information Networking, February 12-14, 2003, Cheju Island, Korea. Heidelberg: Springer, 2003: 747-756.
[8]	CHAWLA N V, BOWYER K W, HALL L O, et al.SMOTE: Synthetic Minority Over-sampling Technique[J]. Journal of Artificial Intelligence Research, 2002, 16(1): 321-357.
[9]	MATHEW J, LUO Ming, PANG C K, et al.Kernel-based SMOTE for SVM Classification of Imbalanced Datasets[C]// IEEE. IECON 2015 - 41st Annual Conference of the IEEE Industrial Electronics Society, November 9-12, 2015, Yokohama, Japan. NJ: IEEE, 2015: 1127-1132.
[10]	ZHANG Dahai, QIAN Liyang, MAO Baijin, et al.A Data-Driven Design for Fault Detection of Wind Turbines Using Random Forests and XGBoost[J]. IEEE Access, 2018(6): 21020-21031.
[11]	HOMOL D K, KLEMMER N, JACOUTOT A. One-hot Decoded Phase Shift Prescaler: U.S. 6570946[P].2003-5-27.
[12]	RICE J.Mathematical Statistics and Data Analysis, International Edition(with CD Data Sets)[J]. Mathematical Gazette, 2006, 72(72): 390-391.
[13]	RUAN Xiaohong, HUANG Xiaomeng, YUAN Dingrong, et al.A Classifier Algorithm Based on Heterogeneous Cost Sensitive Decision Tree[J]. Computer Science, 2013, 40(11a): 140-142.
	阮晓宏,黄小猛,袁鼎荣,等. 基于异构代价敏感决策树的分类器算法[J]. 计算机科学,2013,40(11a):140-142.
[14]	CHEN Tianqi, GUESTRIN C.Xgboost: A Scalable Tree Boosting System[C]//ACM. Proceedings of The 22nd Acm Sigkdd International Conference on Knowledge Discovery and Data Mining, August 13-17, 2016, San Francisco, California, USA. New York: ACM, 2016: 785-794.
[15]	FRIEDMAN J H.Greedy Function Approximation: A Gradient Boosting Machine[J]. Annals of Statistics, 2001, 29(5): 1189-1232.

原始数据	独热编码后的数据
ICMP	(1, 0, 0, 0)
TCP	(0, 1, 0, 0)
UDP	(0, 0, 1, 0)
HTTP	(0, 0, 0, 1)

类型	原始数据集		去冗余后的数据集
类型	记录数/条	比例	记录数/条	比例
Normal	97277	19.688%	87831	60.232%
DoS	391458	79.226%	54598	37.442%
U2R	135	0.027%	135	0.0926%
R2L	1124	0.227%	1124	0.771%
Probe	4107	0.831%	2133	2.816%

算法	平均查准率/%	平均召回率/%	平均F-Score/%
GBDT	72.3	48.2	57.8
GBDT?SMOTE	74.6	54.6	64.8
XGBoost?SMOTE-SVM	78.4	94.6	85.7

基于数据特征学习的网络安全数据分类方法研究

Research on Classification Method of Network Security Data Based on Data Feature Learning

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 10

参考文献 15

相关文章 8

编辑推荐

Metrics

本文评价

[1]	侯留洋, 罗森林, 潘丽敏, 张笈. 融合多特征的Android恶意软件检测方法[J]. 信息网络安全, 2020, 20(1): 67-74.
[2]	陈虹, 肖越, 肖成龙, 陈建虎. 融合最大相异系数密度的SMOTE算法的入侵检测方法[J]. 信息网络安全, 2019, 19(3): 61-71.
[3]	张阳, 姚原岗. 基于Xgboost算法的网络入侵检测研究[J]. 信息网络安全, 2018, 18(9): 102-105.
[4]	王绍节, 龙春, 万巍, 赵静. 基于网络空间安全实时数据的HDFS小文件问题研究[J]. 信息网络安全, 2017, 17(10): 81-85.
[5]	赵艳玲. 美国改变网络空间安全游戏规则的新理念与新技术[J]. 信息网络安全, 2015, 15(9): 50-53.
[6]	陈华山, 皮兰, 刘峰, 林东岱. 网络空间安全科学基础的研究前沿及发展趋势[J]. 信息网络安全, 2015, 15(3): 1-5.
[7]	李战宝，张文贵. 网络抗压能力是网络空间安全发展的新理念[J]. 信息网络安全, 2014, 14(9): 76-79.
[8]	蔡翠红. 美国国家信息安全战略的演变与评价[J]. , 2010, (1): 0-0.