提出一种新特征选择方法,提升网络入侵检测的效率与准确性。
Feature Selection for Network Intrusion Detection
- 基于神经网络的熵理论方法,自动筛选无关特征。
- 可减少90%以上冗余特征,同时保持检测性能不变。
- 适合需要高效部署的网络安全系统开发者。
网络入侵检测(NID)是信息安全领域的重要研究方向,也受到机器学习实践者的关注。传统方法常通过主成分分析(PCA)等降维技术提取特征,但此类方法无法评估特征对检测任务的相关性,导致部分特征完全无用。这不仅增加模型处理负担,还因噪声干扰影响检测能力。为此,本文提出特征选择网络入侵检测(FSNID),一种基于信息论的新方法,利用神经网络近似函数,支持引入循环层以捕捉时间依赖性。实验表明,该方法显著减少特征数量,同时维持原有检测性能。代码将在发表后公开。
原文摘要 · Abstract (English)
Network Intrusion Detection (NID) remains a key area of research within the information security community, while also being relevant to Machine Learning (ML) practitioners. The latter generally aim to detect attacks using network features, which have been extracted from raw network data typically using dimensionality reduction methods, such as principal component analysis (PCA). However, PCA is not able to assess the relevance of features for the task at hand. Consequently, the features available are of varying quality, with some being entirely non-informative. From this, two major drawbacks arise. Firstly, trained and deployed models have to process large amounts of unnecessary data, therefore draining potentially costly resources. Secondly, the noise caused by the presence of irrelevant features can, in some cases, impede a model's ability to detect an attack. In order to deal with these challenges, we present Feature Selection for Network Intrusion Detection (FSNID) a novel information-theoretic method that facilitates the exclusion of non-informative features when detecting network intrusions. The proposed method is based on function approximation using a neural network, which enables a version of our approach that incorporates a recurrent layer. Consequently, this version uniquely enables the integration of temporal dependencies. Through an extensive set of experiments, we demonstrate that the proposed method selects a significantly reduced feature set, while maintaining NID performance. Code will be made available upon publication.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。