多尺度对比嵌入增强的自适应入侵检测模型

王桂鑫; 吴晓鸰; 冯永晋; Hoon Heo

doi:10.12052/gdutxb.250011

欢迎来到能源电力期刊网！

English Version 期刊登录

您当前的位置：

首页 >

文章列表页 >

多尺度对比嵌入增强的自适应入侵检测模型

计算机科学与技术 | 更新时间：2026-05-27

- 多尺度对比嵌入增强的自适应入侵检测模型
- Multi-Scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model
- 广东工业大学学报 2026年43卷第2期页码：30-40
- 作者机构：
  
  1. 广东工业大学计算机学院,广东,广州,510006
  2. 三星电机有限公司,京畿道,水原市,16674
- 作者简介：
- 基金信息：
  
  广东省重点领域研发计划项目(2019B010139002);广东省国际科技合作领域资助项目(2019A050513010)
- DOI：10.12052/gdutxb.250011
  中图分类号： TP391
- 纸质出版：2026
- 稿件说明：
移动端阅览
王桂鑫, 吴晓鸰, 冯永晋, 等. 多尺度对比嵌入增强的自适应入侵检测模型[J]. 广东工业大学学报, 2026, 43(2): 30-40.
王桂鑫, 吴晓鸰, 冯永晋, 等. 多尺度对比嵌入增强的自适应入侵检测模型[J]. 广东工业大学学报, 2026, 43(2): 30-40. DOI： 10.12052/gdutxb.250011.

DOI： 10.12052/gdutxb.250011

摘要

在入侵检测中，一些无监督模型虽然能够利用阈值发现未知的攻击类型，但这类模型未能充分利用已归纳出的流量模式来捕捉流量间的相似性和差异性，进而导致模型将未知的攻击流量视为正常流量。针对该问题，本文提出了一个多尺度对比嵌入增强的自适应入侵检测模型(Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model，MCE-IDM)，基于层次对比学习将已有的攻击类型与其相关数据特征结合产生一个嵌入，再将嵌入与原始数据结合用于训练一个无监督模型。同时，使用轻量级梯度提升机来完成特征选择，有效降低了过往模型在特征选择阶段的时间复杂度。经过数据集验证，不仅模型性能稳定，而且其中一个数据类型极不平衡的数据集子集中的马修斯相关系数(Matthews Correlation Coefficient，MCC) 相比基准模型提高了15.78个百分点，同时在其他子集中也取得了较好的效果。

Abstract

In intrusion detection

while certain unsupervised models can detect unknown attack types using thresholds

they usually fall to effectively utilize the identified traffic patterns to capture the similarities and differences across traffic flows. As a result

unknown attack traffics are frequently misclassified as normal traffic. To address this issue

this paper proposes a Multi-scale Contrastive Embedding Enhanced Adaptive Intrusion Detection Model (MCE-IDM). It employs hierarchical contrastive learning to integrate known attack types with their associated data features

generating embeddings that are subsequently combined with the original data to train an unsupervised model.Furthermore

a lightweight gradient boosting machine is used for feature selection

which significantly reduces the time complexity during this phase compared to previous models. Experimental results on multiple datasets demonstrate that the proposed model not only exhibits stable performance but also improves the Matthews Correlation Coefficient (MCC) by 15.78 percentage points over baseline models on a highly imbalanced subset of data.The proposed method also consistently achieves competitive results across other subsets.

关键词

Keywords

references

PARK W, AHN S. Performance comparison and detection analysis in snort and suricata environment[J]. Wireless Personal Communications, 2017, 94(2): 241-252.

JIA Y, FANG B X, LI A P, et al . Research on cybersecurity defense strategies based on artificial intelligence[J ] . Strategic Study of CAE, 2021, 23(3): 98-105.

LI X, CHEN W, ZHANG Q, et al . Building auto-encoder intrusion detection system based on random forest feature selection[J ] . Computers Security, 2020, 95: 333-349.

ZHANG T, CHEN W, LIU Y, et al . An intrusion detection method based on stacked sparse autoencoder and improved gaussian mixture model[J ] . Computers Security, 2023, 128: 128-154.

LIU H, ZHANG W B. Improved light-weight malicious traffic identification method based on ViT[J]. Journal of Chinese Computer Systems, 2024, 45(2): 388-395.

TAYE M M. Understanding of machine learning with deep learning: architectures, workflow, applications and future directions[J]. Computers, 2023, 12(5): 91-105.

CAI J, LUO J, WANG S, et al . Feature selection in machine learning: a new perspective[J ] . Neurocomputing, 2018, 300: 70-79.

ARP D, QUIRING E, PENDLEBURY F, et al . Dos and don'ts of machine learning in computer security[C ] //Proceedings of the 31st USENIX Security Symposium. Berkeley, CA: USENIX Association, 2022: 3971-3988.

ANTONAKAKIS M, APRIL T, BAILEY M, et al . Understanding the mirai botnet[C ] //Proceedings of the 26th USENIX Security Symposium. Berkeley, CA: USENIX Association, 2017: 1093-1110.

LOUK M H L, TAMA B A. Dual-ids: a bagging-based gradient boosting decision tree model for network anomaly intrusion detection system[J]. Expert Systems with Applications, 2023, 213: 98-110.

VO H V, DU H P, NGUYEN H N. Apelid: enhancing real-time intrusion detection with augmented wgan and parallel ensemble learning[J]. Computers and Security, 2024, 136(5): 10-36.

WEI F, LI H, ZHAO Z, et al . Xnids: explaining deep learning-based network intrusion detection systems for active intrusion responses[C ] //32nd USENIX Security Symposium. Berkeley, CA: USENIX Association, 2023: 4337-4354.

CHEN J Y, LU X T, HUANG X F, et al . Double-Bagging based feature dimension reduction heterogenous integrated intrusion detection[J ] . Computer Engineering Science, 2023, 45(6): 1011-1019.

WANG S, HUANG S C. Intrusion detection method based on ICA algorithm and three-way decisions[J]. Computer Applications and Software, 2024, 41(7): 288-295.

WEI M J, ZHANG X N, LIU Y Z, et al . A network intrusion detection method based on SSA-BRF[J ] . Journal of Hebei University (Natural Science Edition), 2022, 42(5): 552-560.

DISHA R A, WAHEED S. Performance analysis of machine learning models for intrusion detection system using gini impurity-based weighted random forest (giwrf) feature selection technique[J]. Cybersecurity, 2022, 5(1): 230-241.

THABTAH F, HAMMOUD S, KAMALOV F, et al . Data imbalance in classification: experimental evaluation[J ] . Information Sciences, 2020, 513: 429-441.

SHARAFALDIN I, HABIBI L A, GHORBANI A A. Toward generating a new intrusion detection dataset and intrusion traffic characterization[C]//International Conference on Information Systems Security and Privacy. Setúbal, Portugal: SCITEPRESS - Science and Technology Publications, 2018: 821-834.

CHICCO D, JURMAN G. The advantages of the matthews correlation coefficient (MCC) over F1 score and accuracy in binary classification evaluation[J]. BMC Genomics, 2020, 21(1): 128-141.

CHEN Y, DING Z, WAGNER D. Continuous learning for android malware detection[C]//32nd USENIX Security Symposium. Berkeley, CA: USENIX Association, 2023: 1127-1144.

KE G, MENG Q, FINLEY T, et al . LightGBM: a highly efficient gradient boosting decision tree[C ] // Advances in Neural Information Processing Systems. Red Hook, NY: Curran Associates, Inc. 2017: 3147-3155.

CHEN H, WANG H W, JIN H B. Intrusion detection model combining improved self-encoder and residual network[J]. Computer Engineering, 2024, 50(2): 188-195.

WANG X Y, WU X L, FENG Y J. Network intrusion detection method combining over-undersampling and GAN[J]. Journal of Chinese Computer Systems, 2024, 41(7): 288-295.

TENG S H, CHEN C, HUO Y X. A multi-fold self-correction small-sample classifier for intrusion detection[J]. Journal of Guangdong University of Technology, 2020, 37(3): 9-16.

浏览量

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

小样本纠错的多层入侵检测分类研究

一种实时的网络入侵检测系统——Bro的研究

异常入侵检测中数据挖掘技术RIPPER的应用

双模态迭代交叉注意力融合集成框架

融合沟道倾斜角的3D NAND存储单元建模及编程策略优化