基于不平衡数据的网络攻击检测模型优化研究

Research on Optimization of Network Attack Detection Model Based on Imbalanced Data

摘要: 入侵检测系统(IDS)在应对复杂网络攻击时面临数据类别不平衡的问题，传统分类算法难以有效识别少数类攻击。为解决这一挑战，本研究提出了一种基于SMOTE和随机森林的网络攻击检测方法。首先，对IDS2017数据集进行预处理，通过SMOTE技术平衡数据集中少数类样本，解决类别不平衡问题。然后，使用随机搜索(Randomized Search)对随机森林模型进行超参数优化，以提升模型的分类性能。实验结果显示，经过SMOTE处理的模型在少数类攻击检测中的准确率显著提升，同时整体分类效果得到改善。与未平衡数据集相比，优化后的模型在检测少数类攻击时表现出色，有效提升了网络攻击检测的可靠性。

Abstract: Intrusion detection systems (IDS) face the problem of data category imbalance when responding to complex network attacks. Traditional classification algorithms are difficult to effectively identify minority attacks. To address this challenge, this study proposes a network attack detection method based on SMOTE and random forest. First, the IDS 2017 data set is pre-processed, and SMOTE technology is used to balance the minority class samples in the data set to solve the problem of class imbalance. Then, use Randomized Search to optimize the hyperparameters of the random forest model to improve the classification performance of the model. Experimental results show that the accuracy of the SMOTE-processed model in minority attack detection is significantly improved, and the overall classification effect is improved. Compared with unbalanced data sets, the optimized model performs well in detecting minority attacks, effectively improving the reliability of network attack detection.