摘要
为有效应对DoH(DNS-over-HTTPS)隧道带来的威胁,提出一种基于改进黏菌算法优化支持向量机的检测模型。利用互信息和皮尔森相关系数提出特征倾向度的概念,并结合支持向量机构造一种嵌入式的自适应特征选择方法,根据原始数据集的特性制定筛选目标从中选择出最优特征子集。采用折射反向学习、差分变异和精英高斯扰动策略解决黏菌算法收敛速度慢和易陷入局部最优的问题,使用不同基准测试函数验证改进黏菌算法的有效性。两组对比实验的结果表明,该方法能更有效地提升支持向量机对DoH隧道流量的检测率并大幅降低误报率。
To effectively deal with the threat brought by DoH(DNS-over-HTTPS)tunneling,a detection model based on the improved slime mold algorithm optimizing support vector machine is proposed.The concept of feature propensity was proposed using mutual information and the Pearson correlation coefficient.An embedded adaptive feature selection method was constructed in combination with the support vector machine.It selected the optimal feature subset according to the screening target formulated on the characteristics of the original dataset.Refraction reverse learning,differential mutation,and elite Gaussian perturbation strategies were used to solve the problem of slow convergence speed of the slime mold algorithm and easy to fall into local optimum.Different benchmark functions were used to verify the effectiveness of the improved slime mold algorithm.The results of two sets of comparative experiments show that the proposed method can more effectively improve the detection rate of DoH tunneling traffic by support vector machine and significantly reduce the false positive rate.
作者
李道全
任大用
李腾
叶晓云
Li Daoquan;Ren Dayong;Li Teng;Ye Xiaoyun(School of Information and Control Engineering,Qingdao University of Technology,Qingdao 266520,Shandong,China)
出处
《计算机应用与软件》
北大核心
2025年第12期121-130,150,共11页
Computer Applications and Software
基金
国家自然科学基金项目(61902205)。
关键词
DoH隧道流量检测
黏菌算法
特征倾向度
支持向量机
DoH tunneling traffic detection
Slime mold algorithm
Feature propensity
Support vector machine
