车联网中基于stacking集成学习的攻击检测模型
Attack detection model based on stacking ensemble learning for Internet of vehicles
徐会彬 1方龙 1张莎1
作者信息
- 1. 湖州师范学院信息工程学院,浙江 湖州 313000
- 折叠
摘要
由于无线网络的开放性,车联网容易受到网络攻击,如拒绝服务、模糊和欺骗攻击.为此,提出融合随机森林(random forest,RF)和梯度提升决策树(gradient boosting decision tree,GBDT)的堆叠(stack-ing)的入侵检测(RG-IDS)模型.首先,RG-IDS模型利用自适应合成采样(adaptive synthetic sampling,ADASYN)算法对不平衡类别的数据样本进行近邻采样,进而生成更多同类别的近似样本,形成相对平衡的样本数据.其次,RG-IDS模型利用GBDT评估特征的重要性,并选择具有重要特征的样本数据,建立轻量级分类器.最后,RG-IDS采用基于k折交叉验证的堆叠方法,降低过拟合的概率.将RF、GBDT和LightGBM分类器作为基学习器.采用数据集CICIDS 2017和NSL-KDD对RG-IDS模型进行实验测试.实验结果表明,RG-IDS模型可实现较高的F1值.
Abstract
Due to openness of wireless communication,Internet of vehicles(IoV)is vulnerable to many cyber-attacks such as denial of service,spoofing and fuzzy attacks.Therefore,random forest(RF)and gradient boosting decision tree-based stacking intrusion detection(RF-IDS)model was proposed.Firstly,the adaptive synthetic sampling(ADASYN)algorithm was adopted to generate more similar samples through the nearest neighbor sampling strategy in order to balance the training samples of different categories,and form a relatively symmetric dataset.Secondly,GBDT was used to evaluate the importance of features and select sample data with important features to build a light-weight classifier.Finally,the k-fold cross-validation stacking method was used to reduce the probability of overfitting.RF,GBDT and LightGBM classifiers serve were used as base-learner.The RG-IDS model was tested by CICIDS 2017 and NSL-KDD datasets.The experimental results demonstrate that RG-IDS model can achieve a higher F1-score.
关键词
车联网/入侵检测/自适应合成采样/梯度提升决策树/堆叠Key words
Internet of vehicles/intrusion detection/ADASYN/GBDT/stacking引用本文复制引用
出版年
2024
NETL
NSTL
万方数据