[论文解读] Feature Selection-based Intrusion Detection System Using Genetic Whale Optimization Algorithm and Sample-based Classification

Amir Mojtahedi, Farid Sorouri+3 more|arXiv (Cornell University)|Jan 3, 2022

Network Security and Intrusion Detection被引用 7

一句话总结

本文提出了一种混合特征选择与分类方法，用于无线传感器网络中的入侵检测，采用遗传算法（GA）与鲸鱼优化算法（WOA）相结合的方式选择最优特征，随后通过K近邻（KNN）分类进行检测。该方法在KDDCUP1999数据集上实现了高于以往方法的准确率，通过优化的特征子集有效识别恶意节点。

ABSTRACT

Preventing and detecting intrusions and attacks on wireless networks has become an important and serious challenge. On the other hand, due to the limited resources of wireless nodes, the use of monitoring nodes for permanent monitoring in wireless sensor networks in order to prevent and detect intrusion and attacks in this type of network is practically non-existent. Therefore, the solution to overcome this problem today is the discussion of remote-control systems and has become one of the topics of interest in various fields. Remote monitoring of node performance and behavior in wireless sensor networks, in addition to detecting malicious nodes within the network, can also predict malicious node behavior in future. In present research, a network intrusion detection system using feature selection based on a combination of Whale optimization algorithm (WOA) and genetic algorithm (GA) and sample-based classification is proposed. In this research, the standard data set KDDCUP1999 has been used in which the characteristics related to healthy nodes and types of malicious nodes are stored based on the type of attacks in the network. The proposed method is based on the combination of feature selection based on Whale optimization algorithm and genetic algorithm with KNN classification in terms of accuracy criteria, has better results than other previous methods. Based on this, it can be said that the Whale optimization algorithm and the genetic algorithm have extracted the features related to the class label well, and the KNN method has been able to well detect the misconduct nodes in the intrusion detection data set in wireless networks.

研究动机与目标

• 为解决在资源受限的无线传感器网络中持续监控不可行的入侵检测挑战。
• 通过仅从网络流量数据中选择最相关特征，降低计算开销。
• 通过结合鲸鱼优化算法（WOA）的全局搜索能力与遗传算法（GA）的局部搜索优势，提升检测准确率。
• 开发一种远程监控系统，能够检测并预测无线网络中恶意节点的行为。
• 使用标准基准评估所提方法与现有入侵检测系统的性能表现。

提出的方法

• 所提出的系统采用混合优化技术，结合鲸鱼优化算法（WOA）与遗传算法（GA）进行特征选择。
• 使用WOA探索搜索空间，并基于适应度评估识别有希望的特征子集。
• 将GA集成以优化WOA找到的解，提升收敛速度并避免陷入局部最优。
• 将选定的特征输入K近邻（KNN）分类器进行入侵检测。
• 特征选择的适应度函数基于分类准确率，旨在最大化检测性能。
• 使用KDDCUP1999数据集作为基准，根据攻击类型将特征标记为正常或恶意。

实验结果

研究问题

• RQ1 混合GA-WOA算法是否在选择入侵检测相关特征方面优于单一元启发式方法？
• RQ2 将GA与WOA结合如何提升网络入侵检测中特征选择的准确率与效率？
• RQ3 KNN分类器在多大程度上受益于GA-WOA算法优化后的特征子集以检测恶意活动？
• RQ4 所提系统在KDDCUP1999数据集上是否实现了高于现有入侵检测方法的检测准确率？
• RQ5 该系统是否能在计算资源有限的无线传感器网络中检测并预测恶意节点行为？

主要发现

• 所提出的GA-WOA特征选择方法在KDDCUP1999数据集上相比以往方法显著提升了分类准确率。
• 混合优化技术有效降低了数据集的维度，同时保留了关键的判别性特征。
• 当应用于GA-WOA算法选择的特征子集时，KNN分类器实现了高检测准确率。
• 该系统在识别各类网络攻击（包括DoS、Probe和U2R）方面表现出优越性能。
• WOA与GA的结合提升了收敛速度与解的质量，在特征选择方面优于单独使用WOA或GA。
• 由于其高效性与精简的特征集，该方法适用于在资源受限的无线传感器网络中部署。