用分而治之法让轻量模型在受限设备上实现高精度入侵检测。
Robust and Explainable Divide-and-Conquer Learning for Intrusion Detection
- 将复杂检测任务拆解为小问题，用简单模型分别处理
- 本地准确率提升43.3%，模型体积缩小257倍
- 适合资源受限设备，且更抗攻击、结果更可解释
基于机器学习的入侵检测需应对高维、噪声大、类别不平衡的原始网络流量，但复杂模型在计算与内存受限设备上难以部署。本文提出一种相关性感知的分而治之学习方法，将复杂学习任务分解为多个更易处理的子任务。这使得决策树等轻量模型可在特定子任务上训练，实现在真实网络入侵检测数据集上本地准确率最高提升43.3%，模型规模最大减少257倍，同时增强对抗鲁棒性和可解释性。
原文摘要 · Abstract (English)
Machine learning-based intrusion detection requires complex models to capture patterns in high-dimensional, noisy, and class-imbalanced raw network traffic, yet deploying such models remains impractical on resource-constrained devices with limited processing power and memory. In this paper, we present a correlation-aware divide-and-conquer learning technique that decomposes a complex learning problem into smaller, more manageable subproblems. This enables lightweight models as simple as decision trees to be trained on focused subtasks, yielding up to 43.3% higher local accuracy and up to 257 times reduction in model size on real-world network intrusion detection datasets, while also improving adversarial robustness and explainability.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。