臺灣博碩士論文加值系統

網路發展至今，生活已離不開網路，不論是任何系統、行動裝置、網路設備多少都有弱點存在，容易成為有心人入侵的目標，因此如何在網路建構安全機制成為重要的課題，而入侵偵測是重要的功能之一。近年來隨著硬體設備的進步，使得AI領域有了更進一步的發展，有愈來愈多以機器學習為基礎的入侵偵測方法，希望能透過機器學習的特性，偵測難以發覺的特性或規則之惡意攻擊，以達到準確的分類效果。
本論文以KDD’99及NSL-KDD做為資料集，並建構LSTM、RNN、CNN+LSTM及CNN+RNN四種模型，將訓練集進行資料預處理後，輸入模型進行訓練，判斷該連線是否為惡意攻擊的二元分類。另外也進行多元分類實驗，除正常連線外，將惡意攻擊分為四大類：DoS、Probe、R2L(Remote to Local)、U2R(User to Root)。其中CNN+LSTM在各項實驗都有最高的準確率，針對KDD’99資料集，其二元分類準確率95.37%，多元分類準確率為93.56%，而NSL-KDD資料集其二元分類準確率為81.43%，多元分類準確率為76.98%。

With the development of Internet, life is inseparable from Internet. No matter it is any system, mobile device, or network device, there are always weaknesses that can easily become the target of intrusion. Therefore, how to construct a security mechanism on the network has become an important topic, and intrusion detection is one of the important functions. In recent years, the advancement of hardware has led to further development in the field of AI, and more and more intrusion detection methods based on machine learning have been developed. It is hoped that machine learning can reveal rules that are difficult to find in malicious attacks to achieve more accurate classification.
This paper takes KDD'99 and NSL-KDD as the data set, and constructs four models: LSTM, RNN, CNN+LSTM and CNN+RNN. After preprocessing the training set, input the model for training and determine the connection whether it is a malicious attacks The malicious attacks are categorized into four major groups: DoS, Probe, R2L(Remote to Local), and U2R(User to Root). Among all the models, CNN+LSTM has the highest accuracy rate in all experiments. In the KDD'99 classification experiment, the accuracy rate of binary classification is 95.37% and the accuracy rate of multi-class classification is 93.56%, while the accuracy rate of NSL-KDD's binary classification is 81.43% and the accuracy rate of multi-class classification is 76.98%.

摘要 i
Abstract ii
誌謝 iv
目錄 v
表目錄 vii
圖目錄 viii
第一章 緒論 1
1.1 研究背景 1
1.2 研究動機 1
1.3 研究目的 2
1.4 論文章節編排 2
第二章 相關技術與研究 3
2.1 文獻回顧 3
2.2 入侵偵測系統 3
2.3 類神經網路 4
2.3.1 深度神經網路 5
2.3.2 感知器與激發函數 6
2.3.3 誤差與反向傳播法 8
2.4 Keras 9
2.5 Google Colab 9
第三章 資料處理與模型設計 10
3.1 資料集 10
3.1.1 攻擊類型 11
3.1.2 資料特徵 12
3.2 資料預處理 14
3.2.1 數字化 14
3.2.2 資料清理 16
3.2.3 正規化 17
3.3 模型設計 20
3.3.1 RNN 20
3.3.2 LSTM 21
3.3.3 CNN 22
3.3.4 Dropout 23
第四章 實驗結果與分析 26
4.1 實驗環境 26
4.2 訓練資料 26
4.3 實驗評估方法 28
4.4 參數設定 29
4.5 實驗結果 29
4.5.1 KDD’99二元分類 29
4.5.2 KDD’99多元分類 32
4.5.3 NSL-KDD二元分類 35
4.5.4 NSL-KDD多元分類 38
4.6 綜合比較 41
第五章 結論與未來展望 44
5.1 結論 44
5.2 未來展望 44
參考文獻 45

[1]DIGITAL 2019: GLOBAL DIGITAL YEARBOOK, https://datareportal.com/reports/digital-2019-global-digital-yearbook, 2020
[2]CSISO網路安全報告, https://www.cisco.com/c/zh_tw/products/security/security-reports.html, 2020
[3]H. Shin , H. R. Roth, M. Gao, L. Lu, Z. Xu, I. Nogues, J. Yao, D. Mollura and R. M. Summers, “Deep Convolutional Neural Networks for Computer-Aided Detection: CNN Architectures, Dataset Characteristics and Transfer Learning,’’ IEEE Transactions on Medical Imaging, vol. 35, no. 5, pp. 1285-1298, 2016
[4]Y. Tian, K. Pei, S. Jana and B. Ray, “DeepTest: Automated Testing of Deep-Neural-Network-Driven Autonomous Cars,’’ IEEE/ACM 40th International Conference on Software Engineering (ICSE), pp. 303-314, 2018
[5]H. Yao, D. Fu, P. Zhang, M. Li and Y. Liu, “MSML: A Novel Multilevel Semi-Supervised Machine Learning Framework for Intrusion Detection System,’’ IEEE Internet of Things Journal, vol. 6, no. 2, pp. 1949-1959, 2019
[6]R. Vinayakumar, M. Alazab, K. P. Soman, P. Poornachandran, A. Al-Nemrat and S. Venkatraman, “Deep Learning Approach for Intelligent Intrusion Detection System,” IEEE Access, vol. 7, pp. 41525-41550, 2019
[7]C. Yin, Y. Zhu, J. Fei and X. He, “A Deep Learning Approach for Intrusion Detection Using Recurrent Neural Networks,’’ IEEE Access, vol. 5, pp. 21954-21961, 2017
[8]A. Torkaman, G. Javadzadeh, and M. Bahrololum, “A Hybrid Intelligent HIDS Model Using Two-layer Genetic Algorithm and Neural Network,’’ IEEE Conference on Information and Knowledge Technology, pp. 92–96, 2013
[9]R. Puzis, M. D. Klippel, Y. Elovici, and S. Dolev, “Optimization of NIDS Placement for Protection of Intercommunicating Critical Infrastructures,’’ IEEE International Conference on Intelligence and Security Informatics, pp. 191–203, 2008
[10]Y. LeCun, Y. Bengio and G. Hinton, “Deep Learning,’’ Nature, vol. 521, pp. 436–444, 2015
[11]C.Cortes and V.Vapnik, “Support-vector Networks,” Machine Learning, vol. 20, pp. 273–297, 1995
[12]A. Krizhevsky, I. Sutskever and G. Hinton, “ImageNet Classification with Deep Convolutional Neural Networks,” Neural Information Processing Systems, vol. 25, 2012
[13]S. Chen, H. Wang, F. Xu and Y. Jin, “Target Classification Using the Deep Convolutional Networks for SAR Images,” IEEE Transactions on Geoscience and Remote Sensing, vol. 54, no. 8, pp. 4806-4817, 2016
[14]Y. Xu, J. Du, L. Dai and C. Lee, “A Regression Approach to Speech Enhancement Based on Deep Neural Networks,” IEEE/ACM Transactions on Audio, Speech, and Language Processing, vol. 23, no. 1, pp. 7-19, 2015
[15]M. Olazaran, “A Sociological Study of the Official History of the Perceptron Controversy,” Social Studies of Science, vol. 26, pp. 611–659, 1996
[16]J. Han and C. Moraga, “The Influence of The Sigmoid Function Parameters on The Speed of Backpropagation Learning,” International Work-Conference on Artificial Neural Networks, pp. 195-201, 1995
[17]J. F. Kolen and S. C. Kremer, A Field Guide to Dynamical Recurrent Networks, New York, NY, USA: John Wiley & Sons, pp.237-243, 2001
[18]V. Nair and G. Hinton, “Rectified Linear Units Improve Restricted Boltzmann Machines,” International Conference on Machine Learning, pp. 807-814, 2010
[19]D. Rumelhart, G. Hinton and R. Williams, “Learning Representations by Back-propagating Errors,” Nature, vol. 323, pp. 533–536, 1986.
[20]KDD Cup 1999 Data, http://kdd.ics.uci.edu/databases/kddcup99/kddcup99.html
[21]M. Tavallaee, E. Bagheri, W. Lu and A. A. Ghorbani, “A Detailed Analysis of The KDD CUP 99 Data Set,” IEEE Symposium on Computational Intelligence for Security and Defense Applications, pp. 1-6, 2009
[22]G. Mantas, N. Stakhanova, H. Gonzalez, H. H. Jazi, and A. A. Ghorbani, “Application-layer Denial of Service Attacks: Taxonomy and Survey,” International Journal of Information and Computer Security, vol. 7, pp. 216–239, 2015
[23]E. Bou-Harb, M. Debbabi, and C. Assi, “Cyber Scanning: A Comprehensive Survey,” IEEE Communications Surveys & Tutorials, vol. 16, no. 3, pp. 1496–1519, 2014.
[24]KDD Cup 1999 Task Description, http://kdd.ics.uci.edu/databases/kddcup99/task.html
[25]E. Kreyszig, Advanced Engineering Mathematics(Fourth ed.), New York, NY, USA: John Wiley & Sons, pp. 880, 2009
[26]W. Wang, M. Zhu, J. Wang, X. Zeng and Z. Yang, “End-to-end Encrypted Traffic Classification with One-dimensional Convolution Neural Networks,” IEEE International Conference on Intelligence and Security Informatics, pp. 43-48, 2017
[27]S. Hochreiter and J. Schmidhuber, “Long Short-term Memory,” Neural Computation, vol. 9, pp. 1735–1780, 1997.
[28]Y. LeCun, B. Boser, J. S. Denker, D. Henderson, R. E. Howard, W. Hubbard and L. D. Jackel, “Backpropagation Applied to Handwritten Zip Code Recognition,” Neural Computation, vol. 1, no. 4, pp. 541-551, 1989
[29]R. Geirhos, D. H. J. Janssen, H. H. Schütt, J. Rauber, M. Bethge and F. A. Wichmann, “Comparing Deep Neural Networks Against Humans: Object Recognition when The Signal Gets Weaker,” arXiv :1706.06969, 2017
[30]N. Srivastava, G Hinton, A. Krizhevsky, I. Sutskever and R. Salakhutdinov, “Dropout: A Simple Way to Prevent Neural Networks from Overfitting,” Journal of Machine Learning Research, vol. 15, pp. 1929-1958, 2014.
[31]S. M. Ross, Introduction to Probability and Statistics for Engineers and Scientists, Cambridge, MA, USA: Academic Press, pp. 141, 2009
[32]Pandas, https://pandas.pydata.org/
[33]Numpy, https://numpy.org/
[34]Scikit-learn, https://scikit-learn.org/
[35]Matplotlib, https://matplotlib.org/
[36]Seaborn, https://seaborn.pydata.org/
[37]P. David and Ailab, “Evaluation: From Precision, Recall and F-measure to ROC, Informedness, Markedness and Correlation,” Journal of Machine Learning Technologies, vol. 2, pp. 2229-3981, 2011
[38]D. P. Kingma, J. Ba, “Adam: A Method for Stochastic Optimization,” arXiv:1412.6980, 2014