The rapid evolution of AI-driven cybersecurity solutions has led to increasingly complex network infrastructures,which in turn increases their exposure to sophisticated threats.This study proposes a Graph Neural Netwo...The rapid evolution of AI-driven cybersecurity solutions has led to increasingly complex network infrastructures,which in turn increases their exposure to sophisticated threats.This study proposes a Graph Neural Network(GNN)-based feature selection strategy specifically tailored forNetwork Intrusion Detection Systems(NIDS).By modeling feature correlations and leveraging their topological relationships,this method addresses challenges such as feature redundancy and class imbalance.Experimental analysis using the KDDTest+dataset demonstrates that the proposed model achieves 98.5% detection accuracy,showing notable gains in both computational efficiency and minority class detection.Compared to conventional machine learning methods,the GNN-based approach exhibits a superior capability to adapt to the dynamics of evolving cyber threats.The findings support the feasibility of deploying GNNs for scalable,real-time anomaly detection in modern networks.Furthermore,key predictive features,notably f35 and f23,are identified and validated through correlation analysis,thereby enhancing the model’s interpretability and effectiveness.展开更多
In this paper, an improved k-means based clustering method （IKCM） is proposed. By refining the initial cluster centers and adjusting the number of clusters by splitting and merging procedures, it can avoid the algor...In this paper, an improved k-means based clustering method （IKCM） is proposed. By refining the initial cluster centers and adjusting the number of clusters by splitting and merging procedures, it can avoid the algorithm resulting in the situation of locally optimal solution and reduce the number of clusters dependency. The IKCM has been implemented and tested. We perform experiments on KDD-99 data set. The comparison experiments with H-means＋also have been conducted. The results obtained in this study are very encouraging.展开更多
The approachof anomaly detection is a vigorously adaptive technique because it can detect unknown intrusions. The paper summarizes the advantage and the shortcoming of known anomaly-detection approaches in the past,wh...The approachof anomaly detection is a vigorously adaptive technique because it can detect unknown intrusions. The paper summarizes the advantage and the shortcoming of known anomaly-detection approaches in the past,which is based on the model of intrusion detection proposed by Dorothy Denning. Moreover ,the development current of anomaly-detection is proposed on the above.展开更多
介绍一种利用YACC(Yet Another Compiler-Compiler)技术实现检测网络服务器程序异常行为的新方法。该方法用一种携带语义标注的上下文无关文法描述服务器程序正常行为模式,利用YACC自动生成的语法分析器构成异常检测引擎,并利用YACC提...介绍一种利用YACC(Yet Another Compiler-Compiler)技术实现检测网络服务器程序异常行为的新方法。该方法用一种携带语义标注的上下文无关文法描述服务器程序正常行为模式,利用YACC自动生成的语法分析器构成异常检测引擎,并利用YACC提供的错误处理和语义处理接口对异常现场进行分析。实验结果表明,该方法不仅能有效检测各种利用服务器程序漏洞进行的缓冲区溢出、堆内存破环等入侵方式,而且能实时地对异常行为进行分析追踪并向安全管理人员提供入侵相关详细信息,而这种能力正是目前同类方法所缺乏的。展开更多
入侵检测系统是一种积极主动的安全防护技术,它是信息安全保护体系结构中的一个重要组成部分.异常检测是入侵检测的一种方法,因其能够检测出未知的攻击而受到广泛的研究.以基于数据挖掘的异常检测技术为研究内容,以提高异常检测的检测...入侵检测系统是一种积极主动的安全防护技术,它是信息安全保护体系结构中的一个重要组成部分.异常检测是入侵检测的一种方法,因其能够检测出未知的攻击而受到广泛的研究.以基于数据挖掘的异常检测技术为研究内容,以提高异常检测的检测率、降低误报率为目标,以聚类分析为主线,提出了一种改进的聚类检测算法和模型,并进行仿真实验.算法首先去除了数据集中明显的噪声和孤立点,通过分裂聚类、合并聚类以及利用超球体的密度半径确定k个初始聚类中心,以减小初始k值的选取对聚类结果造成的影响,提高异常检测效率,并以此构造入侵检测模型.利用KDD CUP 1999数据集对模型进行实验测试,并对改进算法的效果进行了对比和分析.实验证明,新的检测系统具有良好的性能.展开更多
文摘The rapid evolution of AI-driven cybersecurity solutions has led to increasingly complex network infrastructures,which in turn increases their exposure to sophisticated threats.This study proposes a Graph Neural Network(GNN)-based feature selection strategy specifically tailored forNetwork Intrusion Detection Systems(NIDS).By modeling feature correlations and leveraging their topological relationships,this method addresses challenges such as feature redundancy and class imbalance.Experimental analysis using the KDDTest+dataset demonstrates that the proposed model achieves 98.5% detection accuracy,showing notable gains in both computational efficiency and minority class detection.Compared to conventional machine learning methods,the GNN-based approach exhibits a superior capability to adapt to the dynamics of evolving cyber threats.The findings support the feasibility of deploying GNNs for scalable,real-time anomaly detection in modern networks.Furthermore,key predictive features,notably f35 and f23,are identified and validated through correlation analysis,thereby enhancing the model’s interpretability and effectiveness.
基金Supported by the Beijing Municipal Commission ofEducation Science and Technology Project (KM200511232004)
文摘In this paper, an improved k-means based clustering method （IKCM） is proposed. By refining the initial cluster centers and adjusting the number of clusters by splitting and merging procedures, it can avoid the algorithm resulting in the situation of locally optimal solution and reduce the number of clusters dependency. The IKCM has been implemented and tested. We perform experiments on KDD-99 data set. The comparison experiments with H-means＋also have been conducted. The results obtained in this study are very encouraging.
文摘The approachof anomaly detection is a vigorously adaptive technique because it can detect unknown intrusions. The paper summarizes the advantage and the shortcoming of known anomaly-detection approaches in the past,which is based on the model of intrusion detection proposed by Dorothy Denning. Moreover ,the development current of anomaly-detection is proposed on the above.
文摘介绍一种利用YACC(Yet Another Compiler-Compiler)技术实现检测网络服务器程序异常行为的新方法。该方法用一种携带语义标注的上下文无关文法描述服务器程序正常行为模式,利用YACC自动生成的语法分析器构成异常检测引擎,并利用YACC提供的错误处理和语义处理接口对异常现场进行分析。实验结果表明,该方法不仅能有效检测各种利用服务器程序漏洞进行的缓冲区溢出、堆内存破环等入侵方式,而且能实时地对异常行为进行分析追踪并向安全管理人员提供入侵相关详细信息,而这种能力正是目前同类方法所缺乏的。
文摘入侵检测系统是一种积极主动的安全防护技术,它是信息安全保护体系结构中的一个重要组成部分.异常检测是入侵检测的一种方法,因其能够检测出未知的攻击而受到广泛的研究.以基于数据挖掘的异常检测技术为研究内容,以提高异常检测的检测率、降低误报率为目标,以聚类分析为主线,提出了一种改进的聚类检测算法和模型,并进行仿真实验.算法首先去除了数据集中明显的噪声和孤立点,通过分裂聚类、合并聚类以及利用超球体的密度半径确定k个初始聚类中心,以减小初始k值的选取对聚类结果造成的影响,提高异常检测效率,并以此构造入侵检测模型.利用KDD CUP 1999数据集对模型进行实验测试,并对改进算法的效果进行了对比和分析.实验证明,新的检测系统具有良好的性能.
