基于集成降噪自编码的在线网络入侵检测模型

针对神经网络在线入侵检测模型训练时易出现过拟合和泛化能力弱的问题，提出基于改进的集成降噪自编码在线入侵检测模型以区分正常和异常的流量模式。降噪自编码减少了训练数据与测试数据的差别，缓解过拟合问题，提高模型的性能。同时阈值的选择方法直接影响网络入侵检测模型检测精度，该阈值采用随机方法确定，无须于离线入侵检测，不需通过完整的数据集即可选择最佳的阈值。采用CICIDS2017中的异常的数据流对模型进行测试，准确率分别为90.19%。结果表明，作为一种在线检测模型，提出的异常检测模型优于其他异常检测方法。

Online network intrusion detection model based on ensemble of denoising autoencoder

Aiming at the problem that the neural network online intrusion detection model is prone to over-fitting and generalization, this paper proposed an improved denoising autoencoder online intrusion detection model based on the modified to distinguish between normal and abnormal traffic patterns. Denoising AutoEncoder reduced the difference between training data and test data, alleviated over-fitting problems, and improved the performance of the model. At the same time, the threshold selection method directly affected the detection accuracy of the network intrusion detection model. It determined the threshold by a random method. Unlike offline intrusion detection, the optimal threshold could be selected without a complete data set. It tested the model using the anomalous data stream in CICIDS2017 with an accuracy of 90.19%. The results show that, as an online detection model, the proposed anomaly detection model is superior to other anomaly detection methods.