Abstract:

To address the issues of low multi-class classification accuracy and lengthy model training time in the field of intrusion detection, this paper proposed a novel and effective preprocessing method based on the characteristics of the existing benchmark dataset NSL-KDD. Firstly, the dataset was numerically encoded and normalized based on character features, and then transformed into an RGB image dataset. Secondly, the Canny edge detection algorithm was employed to extract edge features of various attack types in the image dataset. Based on the edge features of the images, convex hulls were constructed using the convex hull algorithm, and the average convex hull area, average convex hull perimeter, and average number of vertices for each attack class were calculated. These three metrics were used as the RGB’s three channels to generate convex hull feature maps for various attack types. Thirdly, the laplacian pyramid image feature fusion algorithm was used to fuse the original image dataset with convex hull feature maps, creating an image dataset containing convex hull features. Majority class samples in the training set were randomly under-sampled, while minority class samples were subjected to affine transformations to generate a balanced training set. Finally, multi-class experiments were conducted based on the CBAM-CNN model. The accuracy and F1 score of this model on the NSL-KDD dataset reach 96.20% and 86.71%, respectively, outperforming traditional network intrusion detection methods and exhibiting better performance than other deep learning models.

Key words: intrusion detection, edge features, convex hull features, feature fusion