KR20230086976A - Improved network intrusion detection method and system through hybrid feature selection and data balancing - Google Patents

Abstract

According to the present invention, a network intrusion detection method relates to a network intrusion detection method performed by a network intrusion detection system, which includes the steps of: constructing a deep neural network-based network intrusion detection model through feature selection and data balancing; receiving an input of test data for network intrusion detection into the configured network intrusion detection model; and detecting network intrusion on the test data for detecting the network intrusion using the network intrusion detection model.

Description

Efficient network detection method and system through hybrid feature selection and data balancing

The present invention relates to a network intrusion detection technology, and relates to an efficient network detection method and system through hybrid feature selection and data balancing capable of performing network intrusion detection using a machine learning-based network detection model.

Network-Based Intrusion Detection (NIDS) is a system that restricts intrusion by unauthorized users, and monitors traffic to determine whether or not there is an attack.

A network intrusion detection system that is currently widely used uses a signature-based analysis method. This is a method in which an expert analyzes and patterns the characteristics of an attack, and then matches and detects incoming network packets in real time.

However, recently, rapidly changing attacks such as APT (Advance Persistent Threat) attacks frequently occur, and accordingly, problems of cost and time arise in the process of analyzing traffic and logs for new attacks that occur every time.

Since signature patterns do not guarantee generalized performance against similar types of rapidly changing attacks, the limitations of existing signature-based systems are becoming clear. Recently, research on machine learning-based detection systems is active to solve these problems.

Since the machine learning model learns the rules for making judgments about intrusions from data, if an automated intrusion detection system can be built through this, the aforementioned problems of time and cost can be solved.

In addition, generalized performance can be guaranteed for new attack patterns. However, using all available attributes as inputs can lead to degradation of machine learning model performance and waste of training time.

Therefore, it is important to select features related to learning among many attributes available for real-time detection.

In addition, most of the data collected in the real world is in an environment where the balance between classes is not perfect. In particular, in the problem of intrusion detection, intrusion data is known to account for about 1% of the total data.

In machine learning, it is very difficult to perform normal learning with such a small amount of intrusive data, and oversampling and undersampling techniques can be used as a way to overcome this.

Korean Patent Registration No. 10-2083028 (Publication date: 2020. 02. 28.) Korean Patent Publication No. 10-2019-0083458 (Publication date: 2019. 07. 12.)

The present invention proposes a hybrid feature selection (HFS) technique to remove unnecessary and overlapping attributes from a machine learning model, and HFS-DNN (Deep Neural Network) using the hybrid feature selection technique for a deep neural network I would like to propose a model.

The present invention uses SMOTE (SMOTE) to ensure a learning effect using only a small amount of input through a hybrid feature selection technique and to improve the poor detection rate of minor classes due to the imbalance problem of the NSL-KDD data set used for learning. Synthetic Minority Over sampling Technique) and RUS (Random Under Sampling) techniques are used to solve the imbalance problem.

According to one aspect, the present invention provides a network intrusion detection method performed by a network intrusion detection system, comprising: configuring a deep neural network-based network intrusion detection model through feature selection and data balance; receiving test data for network intrusion detection into the configured network intrusion detection model; and detecting network intrusion for the test data for network intrusion detection using the network intrusion detection model.

In the configuring step of the present invention, training data is input to a network intrusion detection model based on a deep neural network through feature selection and data balancing, and unnecessary attributes are removed through feature selection and data balancing of the input training data. and learning a network intrusion detection model based on a deep neural network through the feature selection and the data balance to eliminate.

The receiving step of the present invention may include changing attribute values to values between 0 and 1 through a normalization process to prevent the test data from being excluded from the local optimum. can

The normalization process of the present invention proceeds differently depending on the type of data including nominal, numeric, and binary, and the nominal data type is a categorical character Data is encoded into integer data, the encoded integer data is converted into a one-hot vector, and the numeric data format determines the difference between the range of attribute values for the numeric data. Min-max normalization is performed to change to a common scale without distortion, and normalization is not performed on binary data in the binary data format.

The detecting step of the present invention uses a Hybrid Feature Selection (HFS) method that uses the intersection of each sub-property set, which is the output result of single feature selection algorithms, to determine irrelevant features and learning. A step of removing redundant features may be included.

In the detecting step of the present invention, features irrelevant to learning are removed using the Pearson Based Feature Selection method, and features based on feature importance based feature selection method and attribute ratio. A step of removing overlapping features using an Attribute Ratio Based Feature Selection method may be included.

The detecting step of the present invention includes the step of considering two features having a Pearson's correlation coefficient equal to or higher than a predetermined criterion as an overlapping relationship, and selecting one of the two features considered as an overlapping relationship, , The Pearson correlation coefficient is defined by the equation and appears as a value between -1 and 1,

[mathematical expression]

In the above equation, cov is the covariance, is the standard deviation of population X, and is the standard deviation of population Y. The closer to 1, the positive correlation between the two features, and the closer to -1, the more the two features This means that it is close to a negative correlation.

The detecting step of the present invention includes learning a decision tree model and then determining the importance of each feature used for learning based on an information gain, and the decision tree Nodes can be preferentially divided based on characteristics that maximize the amount of information acquisition.

The detecting step of the present invention may include extracting feature importance through a random forest learning model, aligning the extracted feature importance with a preset criterion, and selecting a feature having a threshold value or higher.

The detecting step of the present invention may include selecting a feature whose feature importance calculated through the frequency count and average value of the feature is greater than or equal to a threshold value.

In the detecting step of the present invention, data are detected through a Random Under Sampling (RUS) technique for a plurality of classes corresponding to half of the input test data through an over sampling technique and an under sampling technique. It may include reducing the number of samples of and increasing the number of samples through a synthetic minority over sampling technique (SMOTE) technique for probe, U2R, and R2L corresponding to the minority class.

According to another aspect, the present invention is a computer readable recording medium storing a computer program, which, when executed by a processor, constructs a network intrusion detection model based on a deep neural network through feature selection and data balance. doing; receiving test data for network intrusion detection into the configured network intrusion detection model; and detecting a network intrusion for the test data for detecting the network intrusion using the network intrusion detection model.

The present invention, according to another aspect, is a computer program stored in a computer readable recording medium, wherein the computer program, when executed by a processor, generates a network intrusion detection model based on a deep neural network through feature selection and data balance. constructing; receiving test data for network intrusion detection into the configured network intrusion detection model; and detecting a network intrusion on the test data for the network intrusion detection using the network intrusion detection model.

According to another aspect, the present invention provides a network intrusion detection system, comprising: a model configuration unit configuring a network intrusion detection model based on a deep neural network through feature selection and data balance; a data input unit that receives test data for network intrusion detection into the configured network intrusion detection model; It is possible to provide a network intrusion detection system including an intrusion detection unit that detects network intrusion with respect to the test data for network intrusion detection using the network intrusion detection model.

According to an embodiment of the present invention, the performance of network intrusion detection can be improved without distorting the performance of the learning model of the present invention.

According to an embodiment of the present invention, the input dimension can be reduced while maintaining performance through hybrid feature selection, and the detection rate of a minority class can be improved through an oversampling technique.

1 is a diagram for explaining a data set according to an embodiment of the present invention.
2 is a diagram for explaining the model structure of a network intrusion detection system according to an embodiment of the present invention.
3 is a table showing characteristics having a Pearson correlation of 0.9 or more in an embodiment of the present invention.
4 is a table showing feature sets selected through HF in an embodiment of the present invention.
5 is a table showing the percentage and number of samples of NSL-KDD training data in an embodiment of the present invention.
6 is a table showing an example of a neural network configuration in an embodiment of the present invention.
7 is a block diagram for explaining the configuration of a network intrusion detection system according to an embodiment of the present invention.
8 is a flowchart illustrating a network intrusion detection method in a network intrusion detection system according to an embodiment of the present invention.

In an embodiment of the present invention, a hybrid feature selection technique is proposed to improve the performance of network intrusion detection, and network intrusion detection is performed through the HFS-DNN (Deep Neural Network) model using the hybrid feature selection technique in a deep neural network. The operation to perform is described.

1 is a diagram for explaining a data set according to an embodiment of the present invention.

Referring to FIG. 1, the network intrusion detection system uses a training data set to receive training data to a deep neural network-based network intrusion detection model (HFS-DNN model) through feature selection and data balance, and to the input training data A deep neural network-based network intrusion detection model (HFS-DNN model) can be learned through feature selection and data balancing to remove unnecessary attributes through feature selection and data balancing.

The network intrusion detection system receives test data for network intrusion detection from a deep neural network-based network intrusion detection model through learned feature selection and data balance, and uses the network intrusion detection model to test data for network intrusion detection. Detect network intrusions.

In this embodiment, the NSL-KDD data set may be used. The NSL-KDD data set of the HFS-DNN (Deep Neural Network) model is an improvement from the KDD CUP 99 data set created through the DARPA intrusion detection evaluation program in 1999. created through simulation.

The size of the KDD CUP 99 data set is too large and has problems including many duplicate records, which means that the data is very biased towards attacks with a high frequency of occurrence. In the NSL-KDD data set that solves this problem, the imbalance problem between classes still exists.

The NSL-KDD data set consists of 42 attributes, including the correct answer (label), and the attack is not actually classified as all 38 individual attacks, but with the 4 attack types and 1 normal state presented in FIG. 2, a total You can aim to classify 5 classes.

In addition, a training data set and a test data set may be separately provided. The training data set contains only 24 attack types. It can be said that the gap between the two data sets is large.

2 is a diagram for explaining the model structure of a network intrusion detection system according to an embodiment of the present invention.

2 shows the HFS-DNN model structure, which includes a data preprocessing unit 110, a hybrid feature selection unit 120, and a data balancing unit ( 130) and a deep neural network (DNN) 140.

The data pre-processing unit 110 may include different data normalization processes according to data formats. Normalization of input data in deep neural networks is known to encourage learning rates and prevent exclusion from local optima.

The NSL-KDD data set also undergoes a normalization process before learning, and all attribute values can be changed to values between 0 and 1. The normalization process can be performed differently depending on the data format, and the data format of the NSL-KDD data set can be divided into three types of data including nominal, numeric, and binary.

Data of nominal type are categorical character data and cannot be used as inputs of neural networks. Therefore, all of them can be encoded as integers and converted into one-hot vectors.

Min-max normalization can be performed for data of numeric type to change to a common scale without distorting the difference in the range of attribute values, and in the case of binary type data Since they are all composed of 0 and 1, no special preprocessing process is performed. Through this, it can be converted from 41 input dimensions to 122 input dimensions, and the input dimensions can be increased according to the one-hot representation of normal data.

Afterwards, as a result of observing the data, the num_outbound_cmds feature can be removed in advance as it is determined that it is unnecessary for learning because the standard deviation is 0 and the value of all data is the same. Through this, the data can be finally converted into a total of 121 input dimensions.

The hybrid feature selection unit 120 may ensemble three single feature selection techniques used in the Hybrid Feature Selection (HFS) technique and all feature selection techniques.

In order to detect large-volume network traffic in real time, it is necessary to find a smaller set of sub-attributes while guaranteeing learning performance.

In this embodiment, we propose a hybrid feature selection technique and show that the accuracy of the learning model can be maintained with a smaller set of sub-properties compared to single feature selection algorithms. The hybrid feature selection technique can increase efficiency in a relatively simple way by obtaining each sub-property set, which is the output result of single feature selection algorithms, and then using the intersection of these sets.

The hybrid feature selection technique uses three feature selection algorithms (Pearson Based Feature Selection, Feature Importance Based Feature Selection, and Attribute Ratio Based Feature) according to the two purposes of removing irrelevant features and redundant features. Selection) can be classified.

Referring to FIG. 2 , it is an example showing that three feature selection algorithms are classified in the hybrid feature selection unit 120 .

a) Pearson Based Feature Selection Pearson

In the feature selection method using the correlation coefficient, two features having a high correlation coefficient are regarded as an overlapping relationship and only one of them is used. The Pearson correlation coefficient is defined by Equation 1 below, and is represented by a value between -1 and 1.

[Equation 1]

는 모집단 X의 표준편차를 나타내고,

는 모집단 Y의 표준편차를 나타낸다. 1에 가까울수록 양의 상관관계에 있다고 할 수 있으며, -1에 가까울수록 음의 상관관계에 가까움을 의미한다. 0에 근접할 경우는 상관관계가 없음을 의미한다.In Equation 1, cov means covariance,

represents the standard deviation of the population X,

represents the standard deviation of the population Y. The closer it is to 1, the more positive the correlation is, and the closer it is to -1, the closer it is to the negative correlation. If it is close to 0, it means that there is no correlation.

As Pearson's correlation coefficient represents the correlation between continuous data sets, feature selection can proceed only for numeric attributes in the NSL-KDD data set. The relationship between the features was analyzed using a critical value (eg, 0.9), and the relationship between them can be expressed as an undirected graph data structure. In this case, the threshold may be set by a user or a computer.

In the case of selecting the minimum number of sub-feature sets within the represented graph, the size of the input feature set can be minimized, which can result in a minimum dominating set problem.

The minimum dominant set problem corresponds to the NP-Hard problem, but in the embodiment, 4 pairs of complete graph results can be obtained as shown in FIG. there is.

In this embodiment, only the first four attributes of each row in FIG. 3 are used, and the remaining overlapping features can be removed. This allows 113 features to be selected. Referring to FIG. 3 , a table showing features having a Pearson's correlation of 0.9 or more.

b) Feature Importance Based Feature Selection

In the feature selection method using feature importance, after learning a decision tree model, the importance of each feature used for learning can be grasped based on information gain.

The decision tree first divides the nodes based on the feature that maximizes the amount of information obtained. This means that as the importance value of a node increases, the impurity at the corresponding node decreases significantly.

In this embodiment, a plurality of features may be selected through a threshold value (eg, 0.0001) by extracting and sorting these feature importances through a random forest learning model. In this case, the threshold may be set by a user or a computer. For example, the top 55 features may be selected. Referring to FIG. 4, an example of a feature set selected through hybrid feature selection is shown.

c) Attribute Ratio Based Feature Selection

The AR (Attribute Ratio)-based feature selection method is a new approach that is different from the above two methods (Pierce-based feature and feature importance-based feature selection). In the learning process of the KDD data set, learning works well even with a very small number of features.

In an embodiment, a plurality of features may be selected through a threshold value (eg, 0.1). In this case, the threshold may be set by a user or a computer. For example, the top 50 features may be selected.

3 shows features having a Pearson correlation coefficient of 0.9 or more.

Next to each feature, the ranking of feature importance selected through the random forest learning model is displayed. Referring to this, it can be seen that features with high correlation all have similar ranks, and all features are selected based on feature importance. It can be seen that it is included in the top 55 selected through This means that such overlapping features cannot be considered when feature selection is performed only through feature importance.

Therefore, it can be seen that 8 features can be additionally removed from the 55 feature sets. It can be seen that this is the intersection of subsets corresponding to the results of these feature selection techniques.

The hybrid feature selection presented in this embodiment can filter out features from both perspectives. In this way, through the intersection of the three feature selection techniques presented above, it is possible to obtain an input feature set that is smaller than single feature selection and does not hinder learning performance. Finally, the 39 features presented in FIG. 4 are used. This has a size of 32% compared to the existing 121 input dimensions.

The data balance unit 130 may solve the imbalance problem of the NSL-KDD data set used for learning. The imbalanced data means that the number of data in the minor class is significantly smaller than the number of data included in the major class.

The performance of a machine learning model is dependent on data, and when applied to a learning model without resolving it, classification performance may deteriorate. In particular, the detection rate of the minority class is greatly reduced because the category of the minority class is invaded by the majority class.

In the NSL-KDD data set used for learning in this embodiment, the difference in the number of samples between classes is also very large, as shown in FIG. In order to solve this problem, the imbalance problem can be solved through an over-sampling technique and an under-sampling technique in the present embodiment.

The normal class, which corresponds to half of the data, is a majority class, and the number of data samples is reduced through RUS (Random Under Sampling) technique, and the probe, U2R, and R2L, which are relatively minor classes, Sampling Technique) technique can increase the number of samples to a similar level.

SMOTE is a technique for resolving imbalanced data. It synthesizes a plurality of samples (e.g., k, where k is a natural number) by using a KNN algorithm based on a random sample of minority classes, and creates new processed data between k samples. how to create Referring to FIG. 5, it is possible to check the number and ratio of samples in the data set in which the imbalance is resolved, and an improvement in the detection rate of minority classes of the classification model can be expected.

A deep neural network 140 may be used as a network intrusion detection classification model. Referring to FIG. 6 , it is a table showing an example of a neural network configuration. The structure of the proposed deep neural network can be confirmed through FIG. 6, and relu can be used as an activation function of a hidden layer.

Initial weight setting plays a very important role in neural network training, as it can lead to problems such as gradient vanishing. Xavier Initializer, which is widely used and mentioned, has a problem that the output value gets closer to 0 as the depth of the layer increases when used with the relu function.

Therefore, set the initial value of the neural network using He Initializer, which solves this problem. In addition, L2 regularization is used to prevent overfitting the training data.

7 is a block diagram illustrating a configuration of a network intrusion detection system according to an embodiment, and FIG. 8 is a flowchart illustrating a network intrusion detection method in the network intrusion detection system according to an embodiment.

The processor of the network intrusion detection system 100 may include a model construction unit 710 , a data input unit 720 and an intrusion detection unit 730 .

Components of the processor may represent different functions performed by the processor according to control instructions provided by program codes stored in the network intrusion detection system.

The processor and components of the processor may control the network intrusion detection system to perform steps 810 to 830 included in the network intrusion detection method of FIG. 8 . In this case, the processor and components of the processor may be implemented to execute instructions according to the code of an operating system included in the memory and the code of at least one program.

The processor may load a program code stored in a file of a program for a network intrusion detection method into a memory. For example, when a program is executed in the network intrusion detection system, the processor may control the network intrusion detection system to load a program code from a file of the program into a memory under the control of an operating system. At this time, each of the processor and the model configuration unit 710, the data input unit 720, and the intrusion detection unit 730 included in the processor executes a command of a corresponding part of the program code loaded into the memory to perform subsequent steps (810 to 810 to 810). 830) may be different functional representations of the processor.

In step 810, the model construction unit 710 may construct a network intrusion detection model based on a deep neural network through feature selection and data balance. The model configuration unit 710 receives training data for a network intrusion detection model based on a deep neural network through feature selection and data balancing, and features selection and data balancing to remove unnecessary attributes through feature selection and data balancing on the input training data. A deep neural network-based network intrusion detection model can be learned through data balancing.

In step 820, the data input unit 720 may receive test data for network intrusion detection from the configured network intrusion detection model. The data input unit 720 may change attribute values to values between 0 and 1 through a normalization process to prevent the input test data for network intrusion detection from being excluded from the local optimum. .

At this time, the normalization process proceeds differently depending on the type of data including nominal, numeric, and binary data, and the nominal data type corresponds to categorical character data. encoding into integer data, converting the encoded integer data into a one-hot vector, and converting the numeric data format into a common scale without distorting the difference in the range of attribute values for the numeric data. In order to change to , Min-max Normalization is performed, and the binary data format does not perform normalization on binary data.

In step 830, the intrusion detection unit 730 may detect network intrusion with respect to test data for network intrusion detection using the network intrusion detection model.

The intrusion detection unit 730 uses a Hybrid Feature Selection (HFS) method that uses the intersection of each sub-property set, which is an output result of single feature selection algorithms, to determine an irrelevant feature and a feature irrelevant to learning ( redundant feature) can be removed.

The intrusion detection unit 730 uses the Pearson Based Feature Selection method to remove features irrelevant to learning, and the feature importance based feature selection method and attribute ratio based feature selection ( Overlapping features can be removed using the Attribute Ratio Based Feature Selection) method.

The intrusion detection unit 730 may consider two features having a Pearson's correlation coefficient equal to or higher than a preset standard as an overlapping relationship, and may select one of the two features considered as an overlapping relationship. At this time, the Pearson correlation coefficient is defined by the above-mentioned Equation 1, and is represented by a value between -1 and 1, in Equation 1, cov is the covariance, is the standard deviation of the population X, represents the standard deviation of the population Y, The closer to 1, the more the two features are positively correlated, and the closer to -1, the closer the two features are to the negative correlation.

After learning the decision tree model, the intrusion detection unit 730 may determine the importance of each feature used for learning based on the information gain. At this time, the decision tree may preferentially divide nodes based on characteristics that maximize the amount of information acquisition.

The intrusion detection unit 730 may extract feature importance through a random forest learning model, align the extracted feature importance with a preset criterion, and select a feature having a threshold value or higher.

The intrusion detection unit 730 may select a feature whose feature importance calculated through the feature frequency and average value is greater than or equal to a threshold value. The intrusion detection unit 730 uses the RUS (Random Under Sampling) technique for the number of samples of data corresponding to half of the test data received through the over sampling technique and the under sampling technique. can be reduced, and the number of samples can be increased through the Synthetic Minority Over Sampling Technique (SMOTE) technique for Probe, U2R, and R2L corresponding to the minority class.

The devices described above may be implemented as hardware components, software components, and/or a combination of hardware components and software components. For example, devices and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , a programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions.

A processing device may run an operating system (OS) and one or more software applications running on the operating system. A processing device may also access, store, manipulate, process, and generate data in response to execution of software. For convenience of understanding, there are cases in which one processing device is used, but those skilled in the art will understand that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that it can include. For example, a processing device may include a plurality of processors or a processor and a controller. Other processing configurations are also possible, such as parallel processors.

Software may include a computer program, code, instructions, or a combination of one or more of the foregoing, which configures a processing device to operate as desired or processes independently or collectively. You can command the device. Software and/or data may be any tangible machine, component, physical device, virtual equipment, computer storage medium or device, intended to be interpreted by or provide instructions or data to a processing device. can be embodied in Software may be distributed on networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer readable media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer readable medium may include program instructions, data files, data structures, etc. alone or in combination. Program commands recorded on the medium may be specially designed and configured for the embodiment or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. - includes hardware devices specially configured to store and execute program instructions, such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler.

As described above, although the embodiments have been described with limited examples and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from the method described, and/or components of the described system, structure, device, circuit, etc. may be combined or combined in a different form than the method described, or other components may be used. Or even if it is replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents of the claims are within the scope of the following claims.

110: data pre-processing unit
120: hybrid feature selection unit
130: data balance unit
140: deep neural network
710: model component
720: data input unit
730: intrusion detection unit

Claims (14)

In the network intrusion detection method performed by the network intrusion detection system,
constructing a network intrusion detection model based on a deep neural network through feature selection and data balance;
receiving test data for network intrusion detection into the configured network intrusion detection model; and
Detecting a network intrusion for the test data for detecting the network intrusion using the network intrusion detection model
Network intrusion detection method comprising a. According to claim 1,
The configuration step is
Training data is input to a network intrusion detection model based on a deep neural network through feature selection and data balancing, and feature selection and data balancing are performed to remove unnecessary attributes through feature selection and data balancing on the input training data. Learning a network intrusion detection model based on a deep neural network through
Network intrusion detection method comprising a. According to claim 1,
In the step of receiving the input,
Changing attribute values to values between 0 and 1 through a normalization process to prevent the test data from being excluded from the local optimum.
Network intrusion detection method comprising a. According to claim 3,
The normalization process,
It proceeds differently depending on the type of data including nominal, numeric, and binary.
The nominal data format encodes categorical character data into integer data, converts the encoded integer data into a one-hot vector,
In the numeric data format, minimum-max normalization is performed to change the numeric data to a common scale without distorting the difference in the range of attribute values,
The binary data format does not normalize binary data,
Network intrusion detection method, characterized in that. According to claim 1,
The detection step is
Eliminating irrelevant features and redundant features using a hybrid feature selection (HFS) using the intersection of each sub-property set, which is the output result of single feature selection algorithms
Network intrusion detection method comprising a. According to claim 5,
The detection step is
Remove features irrelevant to learning using Pearson Based Feature Selection method, Feature Importance Based Feature Selection method and Attribute Ratio Based Feature Selection method Step of removing overlapping features using
Network intrusion detection method comprising a. According to claim 6,
The detection step is
Considering two features having a Pearson's correlation coefficient higher than a predetermined criterion as an overlapping relationship, and selecting one of the two features considered as an overlapping relationship.
including,
The Pearson correlation coefficient is defined as Equation 1 and is represented by a value between -1 and 1,
[mathematical expression]

In the above equation, cov is the covariance, is the standard deviation of population X, and is the standard deviation of population Y. The closer to 1, the positive correlation between the two features, and the closer to -1, the more This closeness to the negative correlation implies that
Network intrusion detection method, characterized in that. According to claim 6,
The detection step is
After learning the decision tree model, the step of identifying the importance of each feature used for learning based on the information gain
including,
The decision tree preferentially divides nodes based on a feature that maximizes the amount of information acquisition.
Network intrusion detection method, characterized in that. According to claim 8,
The detection step is
Extracting feature importance through a random forest learning model and sorting the extracted feature importance by a preset criterion to select a feature that is greater than or equal to a threshold value
Network intrusion detection method comprising a. According to claim 6,
The detection step is
Selecting a feature whose feature importance calculated through the feature frequency and average value is greater than or equal to a threshold value
Network intrusion detection method comprising a. According to claim 5,
The detection step is
The number of samples of data is reduced through RUS (Random Under Sampling) technique for the majority class corresponding to half of the input test data through over sampling technique and under sampling technique, and the minority class Increasing the number of samples through the Synthetic Minority Over Sampling Technique (SMOTE) technique for probes, U2R, and R2L corresponding to
Network intrusion detection method comprising a. A computer-readable recording medium storing a computer program,
When the computer program is executed by a processor,
constructing a network intrusion detection model based on a deep neural network through feature selection and data balance;
receiving test data for network intrusion detection into the configured network intrusion detection model; and
Detecting a network intrusion for the test data for detecting the network intrusion using the network intrusion detection model
A computer readable recording medium comprising a. As a computer program stored on a computer-readable recording medium,
When the computer program is executed by a processor,
constructing a network intrusion detection model based on a deep neural network through feature selection and data balance;
receiving test data for network intrusion detection into the configured network intrusion detection model; and
detecting a network intrusion for the test data for detecting the network intrusion using the network intrusion detection model;
A computer program comprising instructions for causing the processor to perform an operation comprising: In the network intrusion detection system,
a model configuration unit configuring a network intrusion detection model based on a deep neural network through feature selection and data balance;
a data input unit that receives test data for network intrusion detection into the configured network intrusion detection model;
An intrusion detection unit for detecting a network intrusion with respect to the test data for detecting the network intrusion using the network intrusion detection model.
A network intrusion detection system comprising a.

Images