Abstract: Intrusion detection is an effective method to prevent host and network attacks. The use of intrusion detection systems makes up for the shortcomings of traditional firewall technology, signature authentication technology, and access control technology in terms of security protection. However, the mutual redundancy between the features of intrusion detection data samples interferes with the accuracy and efficiency of attack detection. The feature selection method can effectively reduce the dimension of data features and eliminate redundant features, select the optimal sub-features and improve the accuracy of network traffic anomaly detection. Based on this, this article first uses the K-means algorithm to extract typical data from the real traffic data set UNSW-NB15, generates a data set with typical data characteristics as the feature extraction data set, and then uses 9 different strategies for intrusion on the data set. The detection model has conducted network intrusion detection experiments. The experimental results show that the method can effectively detect and classify, and the accuracy of two classifications of normal traffic and malicious traffic is 88.27%, which is higher than other machine learning algorithms. In addition, the detection rate of attack types with less sample data is improved in the study of multi-category classification. The effectiveness of the method is verified and it is easy to use.

Key words: intrusion detection, feature selection, UNSW-NB15, recursive feature elimination (RFE), logistic regression (LR)

摘要： 入侵检测是防止主机和网络攻击的有效方法。入侵检测系统的使用弥补了传统防火墙技术、签名认证技术、访问控制技术在安全保护方面的不足。但是，由于入侵检测数据样本特征之间存在互冗余性干扰了攻击检测的准确性和效率。特征选择方法能有效降低数据特征的维度和消除冗余特征，选出最优特征子集并提高网络流量异常检测的准确率。基于此，本文首先使用Kmeans聚类算法在真实流量数据集UNSW-NB15提取典型数据，生成具有典型数据特征的数据集作为特征提取的数据集，随后在该数据集上分别使用了9种不同策略的入侵检测模型进行了网络入侵检测实验。实验结果表明，该方法能够进行有效检测和分类，正常流量、恶意流量二分类精度为88.27%，高于其他机器学习算法。并且在进行多类分类研究时，样本数据少的攻击类型的检测率均有提高。验证了该方法的有效性，易于使用。

关键词: 入侵检测, 特征选择, UNSW-NB15, 特征递归消除(RFE), 逻辑回归(LR)