一种面向网络入侵检测的特征选择方法

在网络入侵检测中,不相关或冗余的特征使得检测变得越来越困难,为了提高检测的精度和效率,提出了一种新的网络入侵检测的特征选择方法.该方法首先利用粗糙集理论的特性对特征进行筛选;然后利用遗传算法在解决NP问题上的并行性、鲁棒性和全局优化搜索等特点,在剩余的特征子集中寻找最优子集.考虑到早熟问题会使遗传算法陷入局部最优,采用对种群聚类的方式建立自适应的交叉、变异率,种群个体交叉时在不同的类内随机选择从而保证群体多样性,每次迭代均保留父代的最优个体.在入侵检测的经典数据集KDD CUP 99上检验了算法的有效性,使用SVM分类器对选出的特征子集进行性能评估.实验结果表明,该方法与相关研究对比提高了入侵检测系统的精度和效率.

A Feature Selection Method for Network Intrusion Detection

In the process of intrusion detection,1arge numbers of irrelevant or redundant features make the detection more and more difficult.In this paper,a new feature selection algorithm is proposed.Firstly the features are reduced based on the rough set theory.After that,genetic algorithms are used to find the best subset in the remnant.In order to get the optimum result,clustering is adopted to create adaptive crossing and mutation probability,different kinds are chosen when crossing to guarantee diversity,and the classic individual is kept in every repetition.At last,the classical KDD CUP 99 dataset is used in the intrusion detection experiments and the SVM classifier is used for estimating the validity of our reduced features.Experimental results indicate that the proposed approach can reduce the complexity of intrusion detection system and increase the detection rate comparing with other methods.