Dynamic integrated intrusion detection model based on powershap and hybrid sampling

HUANG Dongmei; YAN Hao; ZHANG Wenbo; HU Anduo; SUN Jinzhong; SUN Yuan

doi:10.11959/j.issn.1000-0801.2025178

您当前的位置：

首页 >

文章列表页 >

Dynamic integrated intrusion detection model based on powershap and hybrid sampling

Research and Development | 更新时间：2025-11-06

- Dynamic integrated intrusion detection model based on powershap and hybrid sampling
- Telecommunications Science Vol. 41, Issue 10, Pages: 132-142(2025)
- 作者机构：
  
  1.上海电力大学电气工程学院，上海 200090
  2.上海电力大学电子与信息工程学院，上海 201306
  3.上海海洋大学信息学院，上海 201306
  4.上海电力大学数理学院，上海 201306
- 作者简介：
- 基金信息：
  
  Young Scientists Fund of the National Natural Science Foundation of China(62102243)
- DOI：10.11959/j.issn.1000-0801.2025178
  CLC： TP393
- Received：06 March 2025，
  
  Revised：2025-05-09，
  
  Accepted：04 June 2025，
  
  Published：20 October 2025
- 稿件说明：
移动端阅览
黄冬梅,颜昊,张文博等.基于Powershap和混合采样的动态集成入侵检测模型[J].电信科学,2025,41(10):132-142.

HUANG Dongmei,YAN Hao,ZHANG Wenbo,et al.Dynamic integrated intrusion detection model based on powershap and hybrid sampling[J].Telecommunications Science,2025,41(10):132-142.
黄冬梅,颜昊,张文博等.基于Powershap和混合采样的动态集成入侵检测模型[J].电信科学,2025,41(10):132-142. DOI： 10.11959/j.issn.1000-0801.2025178.

HUANG Dongmei,YAN Hao,ZHANG Wenbo,et al.Dynamic integrated intrusion detection model based on powershap and hybrid sampling[J].Telecommunications Science,2025,41(10):132-142. DOI： 10.11959/j.issn.1000-0801.2025178.

摘要

随着互联网技术的迅猛发展，网络安全领域中的入侵检测任务变得更加重要。针对目前入侵检测中存在的特征维度高、数据类别不平衡以及单一分类器检测率低的问题，提出了一种基于Powershap和混合采样的动态集成入侵检测模型。首先，通过Powershap算法对数据集进行特征选择。随后，采用RENN-BorderlineSMOTE混合采样算法，对特定类别数据分别进行欠采样和过采样处理，解决数据集中的类别不平衡问题。最后，基于广义多样性从多个基分类器中筛选出最优组合，并将其集成至动态集成框架KNORAE中以结合多个基分类器的优势。模型在CIC-IDS2017数据集上进行了验证，证实了该模型在网络流量检测中的优越性。

Abstract

With the rapid development of Internet technology

the task of intrusion detection of the field of network security has become more important. Aiming at the problems of high feature dimension

imbalance of data categories and low model detection rate of single classifiers in current intrusion detection

a dynamic integrated intrusion detection model based on Powershap and hybrid sampling was proposed. Firstly

the Powershap algorithm was used for feature selection of the dataset. Subsequently

the hybrid RENN-BorderlineSMOTE sampling algorithm was applied to address the category imbalance in the dataset by under-sampling and over-sampling specific categories of data. Finally

the optimal combination was filtered from multiple base classifiers based on Generalization Diversity and integrated into the dynamic integration framework KNORAE to combine the advantages of multiple base classifiers. The model was validated on the CIC-IDS2017 dataset

which confirmed the superiority of the model in network traffic detection.

关键词

Keywords

references

ANDERSON J P , Computer security threat monitoring and surveillance [R ] . 1980 .

何红艳 , 黄国言 , 张炳 , 等 . 基于极限树特征递归消除和LightGBM的异常检测模型 [J ] . 信息网络安全 , 2022 , 22 ( 1 ): 64 - 71 .

HE H Y , HUANG G Y , ZHANG B , et al . Intrusion detection model based on extra trees-recursive feature elimination and LightGBM [J ] . Netinfo Security , 2022 , 22 ( 1 ): 64 - 71 .

陈俊彦 , 卢贤涛 , 黄雪锋 , 等 . 基于Double-Bagging特征降维异质集成入侵检测 [J ] . 计算机工程与科学 , 2023 , 45 ( 6 ): 1011 - 1019 .

CHEN J Y , LU X T , HUANG X F , et al . Double-Bagging based feature dimension reduction heterogenous integrated intrusion detection [J ] . Computer Engineering & Science , 2023 , 45 ( 6 ): 1011 - 1019 .

蹇诗婕 , 刘岳 , 姜波 , 等 . 基于聚类过采样和自动编码器的网络入侵检测方法 [J ] . 信息安全学报 , 2023 , 8 ( 6 ): 121 - 134 .

JIAN S J , LIU Y , JIANG B , et al . Network intrusion detection using cluster oversampling and auto-encoder [J ] . Journal of Cyber Security , 2023 , 8 ( 6 ): 121 - 134 .

魏明军 , 李凤 , 刘亚志 , 等 . 基于改进WGAN-GP和ResNet的车联网入侵检测方法 [J ] . 郑州大学学报(工学版) , 2024 , 45 ( 4 ): 30 - 37 .

WEI M J , LI F , LIU Y Z , et al . An intrusion detection method for Internet of vehicles based on improved WGAN-GP and ResNet [J ] . Journal of Zhengzhou University (Engineering Science) , 2024 , 45 ( 4 ): 30 - 37 .

孙敬 , 丁嘉伟 , 冯光辉 . 一种基于自编码器降维的神经卷积网络入侵检测模型 [J ] . 电信科学 , 2025 , 41 ( 2 ): 129 - 138 .

SUN J , DING J W , FENG G H . A neural convolutional network intrusion detection model based on autoencoder dimension reduction [J ] . Telecommunications Science , 2025 , 41 ( 2 ): 129 - 138 .

徐会彬 , 方龙 , 张莎 . 车联网中基于stacking集成学习的攻击检测模型 [J ] . 电信科学 , 2024 , 40 ( 12 ): 38 - 50 .

XU H B , FANG L , ZHANG S . Attack detection model based on stacking ensemble learning for Internet of vehicles [J ] . Telecommunications Science , 2024 , 40 ( 12 ): 38 - 50 .

VERHAEGHE J , VAN DER DONCKT J , ONGENAE F , et al . Powershap: a power-full shapley feature selection method [M ] // Machine Learning and Knowledge Discovery in Databases . Cham : Springer International Publishing , 2023 : 71 - 87 .

TMOEK I . An experiment with the edited nearest-neighbor rule [J ] . IEEE Transactions on Systems, Man, and Cybernetics , 2007 , SMC-6( 6 ): 448 - 452 .

HAN H , WANG W Y , MAO B H . Borderline-SMOTE: a new over-sampling method in imbalanced data sets learning [M ] // Advances in Intelligent Computing . Berlin, Heidelberg : Springer Berlin Heidelberg , 2005 : 878 - 887 .

KO A H R , SABOURIN R , BRITTO J . From dynamic classifier selection to dynamic ensemble selection [J ] . Pattern Recognition , 2008 , 41 ( 5 ): 1718 - 1731 .

WILSON D L . Asymptotic properties of nearest neighbor rules using edited data [J ] . IEEE Transactions on Systems, Man, and Cybernetics , 1972 , SMC-2( 3 ): 408 - 421 .

孙博 , 王建东 , 陈海燕 , 等 . 集成学习中的多样性度量 [J ] . 控制与决策 , 2014 , 29 ( 3 ): 385 - 395 .

SUN B , WANG J D , CHEN H Y , et al . Diversity measures in ensemble learning [J ] . Control and Decision , 2014 , 29 ( 3 ): 385 - 395 .

PARTRIDGE D , KRZANOWSKI W . Software diversity: practical statistics for its measurement and exploitation [J ] . Information and Software Technology , 1997 , 39 ( 10 ): 707 - 717 .

SHARAFALDIN I , HABIBI LASHKARI A , GHORBANI A A . Toward generating a new intrusion detection dataset and intrusion traffic characterization [C ] // Proceedings of the 4th International Conference on Information Systems Security and Privacy . SCITEPRESS - Science and Technology Publications , 2018 : 108 - 116 .

Views

161

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

An intrusion detection model based on convolution neural network for Internet of vehicles

Research on airborne network intrusion detection combining adaptive data augmentation and ensemble learning

Cross-domain federated intrusion detection model under heterogeneous data distribution

Deep learning and support vector machine-recursive feature elimination-based network intrusion detection model

Attack detection model based on stacking ensemble learning for Internet of vehicles

Related Author

ZHANG Rui

Gong Yishu

Li Yanjun

Liu Wenqi

Zhou Maohui

Zhang Shangzhe

WU Hao

ZHANG Yannian

Related Institution

Department of Information Engineering, Zhumadian Vocatiomal and Technical College

Xinjiang Tongda Low-altitude Technology Co., Ltd.

College of Civil Aviation, Nanjing University of Aeronautics and Astronautics

China United Network Communications Co., Ltd. Harbin Branch

Nanjing Vocational Institute of Transport Technology, School of Electronic Information Engineering

⁰