一种轻量级网络入侵检测系统模型与算法

A Lightweight Network Intrusion Detection System Model and Algorithm

摘要: 为了解决网络入侵检测中检测精度低、检测速度慢的难题，提出了一种轻量级网络入侵检测模型，并通过设计特征选择算法、检测模型建立算法、入侵检测算法实现了系统模型。在Kddcup99数据集上的实验表明，系统的入侵检测性能比较好，检测包含72,788条连接记录的测试集，检测时间不到1 s，检测率达到91.03%，误警率控制在3.47%，检测精度和检测速度均优于对比模型，然而实验也发现，系统存在建模时间较长、对样本占比极少的U2R和R2L两种入侵类型检测率偏低的局限性。

Abstract: In order to solve the problems of low detection precision and slow detection speed in network intrusion detection, this paper puts forward a lightweight network intrusion detection system model, and implements the system model by designing feature selection algorithm, detection model building algorithm and intrusion detection algorithm. The experiment results carried out on Kddcup99 datasets verify that the proposed system model has a good detection performance. The detection of the test set containing 72,788 connection records takes less than 1 second, achieving a detection rate of 91.03% and a false alarm rate of 3.47%. Both detection precision and detection speed are superior to those of the comparison model. However, the experiments also reveal that the system has limitations such as relatively long modeling time and low detection rates for the two intrusion types U2R and R2L, which account for extremely small proportions of the samples.