Abstract: Existing network intrusion detection systems are typically trained under a closedset setting, and are prone to misclassification in practical applications for new attacks that do not appear in the training data. In order to improve the accuracy of unknown attack detection and known attack classification, a twostage intrusion detection method based on the combination of convolutional neural network and bidirectional long and shortterm memory network is proposed on the basis of existing network intrusion detection systems—twostage confidence intrusion detection (TSCID) method. In the first stage, the outofdistribution data detector categorizes input data into indistribution and outofdistribution samples by evaluating their confidence scores; in the second stage, the m+1 classifier performs open intrusion detection on the indistribution data as well as part of the outofdistribution data obtained in the first stage, which can realize the fine classification of the known attacks and the further identification of the unknown attacks. The method is experimentally evaluated on the KDDCUP’99 dataset and the CICIDS2017 dataset. The experimental results show that the AUROC and AUPR of the model on the data have increased and the false positive rate has decreased when compared with other methods for open intrusion detection. The study shows that the twostage network intrusion detection method that introduces an outofdistribution data detector ensures the fine classification of known attacks and effectively improves the identification capability of the intrusion detection system for unknown threats, providing a new idea for building a comprehensive network security defense system.

Key words: network intrusion detection, outofdistribution detection, convolutional neural network, bidirectional long shortterm memory, deep learning

摘要： 现有的网络入侵检测系统常在封闭集中进行训练，在实际应用中对于训练数据中未出现的新攻击容易出现误判的情况.为提高未知攻击检测和已知攻击分类的准确性，在已有的网络入侵检测系统的基础上，提出了一种基于卷积神经网络与双向长短时记忆网络相结合的2阶段入侵检测方法——基于置信度的2阶段式入侵检测(twostage confidence intrusion detection, TSCID)方法.在第1阶段，分布外数据检测器通过对数据的置信度进行度量，将其划分为分布内数据和分布外数据2类；在第2阶段，m+1分类器将第1阶段中得到的分布内数据以及部分分布外数据进行开放式入侵检测，可以实现对已知攻击的精细分类和对未知攻击的进一步识别.该方法在KDDCUP’99数据集和CICIDS2017数据集上进行了实验评估.实验结果表明，与其他开放式入侵检测方法相比，模型对数据的AUROC,AUPR均有所上升，且误判率均有所下降.引入分布外数据检测器的2阶段式网络入侵检测方法既保证对已知攻击的精细分类，又有效提高入侵检测系统对未知威胁的识别能力，为构建全面的网络安全防御体系提供了新思路.

关键词: 网络入侵检测, 分布外数据检测, 卷积神经网络, 双向长短时记忆网络, 深度学习