关键词: 网络入侵检测, 深度学习, 多尺度卷积神经网络, 长短期记忆网络, 残差网络

Abstract: In view of the problems of the existing intrusion detection methods, such as poor feature extraction, low classification accuracy, and weak generalization ability, this paper proposes an intrusion detection model named MultiScale SpatialTemporal Residual Network(MSSTRNet)that integrates multiscale convolutional network (CNN), long shortterm memory network (LSTM), and residual network. Log1p smoothing is first applied to transform the data with large skewness, and this paper proves its effectiveness by comparing the correlation with the label before and after transformation and visualizing the data distribution. Then, the spatial and temporal features of the data are extracted by a multiscale onedimensional convolution module and a long shortterm memory module respectively. Finally, based on the idea of residual network, identity mapping is added to avoid gradient disappearance, gradient explosion and network degradation. The experimental results on the UNSW_NB15 dataset show that the proposed method can effectively enhance the representation ability and generalization ability of the model, and the performance of evaluation metrics has been significantly improved.

Key words: network intrusion detection, deep learning, Multi-scale convolutional neural network, long short term memory model, Residual network