网络入侵的早期特征是影响网络入侵早期检测效果的关键.针对网络入侵早期特征选择问题,提出一种结合频率筛选的遗传算法,该算法以SOM神经网络作为评价模型,通过多次运行遗传算法改善其优化结果的稳定性,根据对最优解中特征出现的频率进一步筛选,得到一组优化的早期特征.对入侵早期特征集进行特征选择实验,将39维早期特征优化至29维.实验结果表明,使用优化特征组合不仅有效缩减了入侵检测建模时间,而且使入侵检测系统获得更高的检测率.
Selection of early features is an important factor to affect network intrusion early detection. To more accurately extract the early features of network intrusions, Genetic Algorithm (GA) mixed with frequency-based selection is proposed in this paper, which uses the SOM algorithm to evaluate the subset of feature. To improve the stability of the optimization results,it runs GA for multiple times and filter out the features with lower frequency in GA optimization results. The original set of 39 features is optimized to a subset of 29 features, and the early detection result shows that the subset of 29 optimized features not only decrease the modeling time of in- trusion detection,but also improve the early detection accuracy.