arXiv:2410.15597cs.CRcs.AI2024-10被引 9

对比14种模型与集成方法,找到最适合网络入侵检测的方案。

A Comprehensive Comparative Study of Individual ML Models and Ensemble Strategies for Network Intrusion Detection Systems

  • 构建统一框架,测试14种单一模型与集成方法。
  • 在两个数据集上验证,多数方法准确率超95%。
  • 适合安全研究者和系统开发者参考应用。

网络系统入侵频发,推动了人工智能技术在入侵检测系统(IDS)中的应用。尽管已有多种AI方法用于自动化检测,但不同模型各有优劣,选择合适模型仍具挑战,需借助集成方法提升泛化能力。本文通过全面评估14种个体模型及简单与高级集成方法,填补这一空白。提出一个专为网络入侵检测设计的集成学习框架,涵盖数据加载、模型训练与评估指标生成。框架整合了决策树、神经网络等多种基学习器,采用袋装、堆叠、混合与提升等策略。在RoEduNet-SIMARGL2021与CICIDS-2017两个具有不同特性的数据集上进行实验,结果表明多数方法表现优异。基于评估指标与混淆矩阵对模型分类,并开源代码,为社区提供可复用的集成学习基础框架。

原文摘要 · Abstract (English)

The escalating frequency of intrusions in networked systems has spurred the exploration of new research avenues in devising artificial intelligence (AI) techniques for intrusion detection systems (IDS). Various AI techniques have been used to automate network intrusion detection tasks, yet each model possesses distinct strengths and weaknesses. Selecting the optimal model for a given dataset can pose a challenge, necessitating the exploration of ensemble methods to enhance generalization and applicability in network intrusion detection. This paper addresses this gap by conducting a comprehensive evaluation of diverse individual models and both simple and advanced ensemble methods for network IDS. We introduce an ensemble learning framework tailored for assessing individual models and ensemble methods in network intrusion detection tasks. Our framework encompasses the loading of input datasets, training of individual models and ensemble methods, and the generation of evaluation metrics. Furthermore, we incorporate all features across individual models and ensemble techniques. The study presents results for our framework, encompassing 14 methods, including various bagging, stacking, blending, and boosting techniques applied to multiple base learners such as decision trees, neural networks, and among others. We evaluate the framework using two distinct network intrusion datasets, RoEduNet-SIMARGL2021 and CICIDS-2017, each possessing unique characteristics. Additionally, we categorize AI models based on their performances on our evaluation metrics and via their confusion matrices. Our assessment demonstrates the efficacy of learning across most setups explored in this study. Furthermore, we contribute to the community by releasing our source codes, providing a foundational ensemble learning framework for network intrusion detection.

入侵检测集成学习网络安全

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。