【《基于深度学习的入侵检测方法综述》3600字】

基于深度学习的入侵检测方法综述深度学习ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[67]属于机器学习领域中的一个子类，属于较新的研究技术。深度神经网络ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[68]能够学习数据的内部信息和表示层次，并能适应高维度学习和预测的要求，学习获得的信息对图像、文字、声音等数据的解释有较大的帮助，更注重学习有效特征信息，深度学习技术也被广泛用于入侵检测领域。（1）本文相关深度学习模型常见的深度学习的研究方法有：CNN-LSTM、稀疏自动编码器等方法。1）循环神经网络循环神经网络（RecurrentNeuralNetwork，RNN）ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[69]能够较好地对具有序列特征的数据进行学习。其网络结构如图2.7所示。图STYLEREF1\s2.SEQ图\*ARABIC\s16循环神经网络结构Figure2.7ThenetworkstructureofRecurrentNeuralNetwork其中，X=(x1,x2,xhY=softmax((2.18)其中ht代表这一时刻的输出，ht−1代表上一时刻的输出，b代表截距，softmax2）门控神经网络由于在循环神经网络中，距离当前节点越远的节点对于当前节点处理的影响越小。门控神经网络（GatedRecurrentUnit，GRU）ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[70]通过使用“门”结构，能够解决模型难以建模长距离依赖的问题，能够实现信息的保留和选择功能。门控神经网络的网络结构如图2.8所示。图STYLEREF1\s2.SEQ图\*ARABIC\s17门控神经网络结构Figure2.8ThenetworkstructureofGatedRecurrentUnit 门控神经网络的各个门结构的计算过程如公示2.19所示。(2.19)其中Zt代表更新门，rt代表重置门，xt代表t时刻的输入向量，ht代表t时刻的输出向量，ht代表候选输出，Wz、Wr3）卷积神经网络卷积神经网络（ConvolutionalNeuralNetwork,CNN）ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[71]是一种能够对输入数据进行平移不变分类的神经网络。池化层通过减少模型参数并保留有效信息，能够避免过拟合问题，提升模型训练效率。卷积神经网络通常用于对图像数据进行处理，其神经网络的网络结构如图2.9所示。图STYLEREF1\s2.SEQ图\*ARABIC\s18卷积神经网络结构Figure2.9ThenetworkstructureofConvolutionalNeuralNetwork4）CNN-LSTM CNN-LSTMADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[72]的基本思想主要目的是通过直接使用卷积式的记忆活动神经网络对这些数据模型信息进行特征提取,并结合长短期记忆神经网络（LSTM，LongShort-TermMemory）ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[73]来进行序列预测。CNN-LSTM算法结合了二者的优点，适合处理长序列任务。网络结构分别如图2.9、图2.10所示。图STYLEREF1\s2.SEQ图\*ARABIC\s19长短期记忆网络结构Figure2.10ThenetworkstructureofLongShort-TermMemory LSTM的各个门结构的计算过程如公式2.20所示。(2.20)其中，xt代表时间步长t的输入矢量，ht代表时间步长t的输出矢量，Wi、Wf、WC、Wo代表权重矩阵，bi、bf、bC5）稀疏自动编码器稀疏自动编码器ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[74]是一种无监督学习算法，通过计算输入和输出之间的误差，来调节参数，训练得到最终的模型。稀疏自动编码器在自动编码器模型的基础上增加了L1正则化限制，限制每次得到的表达尽可能稀疏，只有部分隐藏层神经元处于活跃状态，目的是为了让模型能够在较恶劣的条件下，仍然能学习到更好的表达样本的特征。稀疏自动编码器的建模过程如图2.11所示。图STYLEREF1\s2.SEQ图\*ARABIC\s110稀疏自动编码器建模过程Figure2.11ModelingprocessofSparseAuto-Encoder（2）研究现状由于深度学习能适应高维度学习和预测的要求，因此在入侵检测领域也有了相应的应用。以前关于预测恶意事件的研究只关注攻击是否会发生，而没有关注攻击者会采取的具体步骤。为了填补这一空白，Shen等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[75]利用循环神经网络来预测未来事件，并在商业入侵防御系统收集的数据集上对所提模型进行测试。随着海量高维复杂数据的增加，传统机器学习技术难以利用海量数据解决入侵分类问题。针对这一问题，Althubiti等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[76]利用CIDDS数据集，采用长短时记忆深度学习方法来构建入侵检测系统，但是该方法的检测准确率为84.83%。Agarap等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[77]通过使用线性支持向量机替代GRU模型输出层的Softmax函数来提升模型的检测能力，并使用京都大学蜜罐系统的2013年网络流量数据集来对模型进行验证，但是该方法的检测准确率较低，为84.15%。Lin等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[78]提出一种基于卷积神经网络的字符级入侵检测系统，但是该方法并未对NSL-KDD数据集中的不同类别流量数据分布的差异进行处理，但是该算法在两个测试集上的多分类准确率较低，分别是79.05%和60.86%。Wu等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[79]按照数量对每个类的成本函数权重系数进行相应设置，将数量较少的异常类别对应的权重系数数值设置大一些，并结合卷积神经网络来识别攻击行为，但是该算法在两个测试集上的多分类准确率较低，分别是79.48%和60.71%。表STYLEREF1\s2.SEQ表\*ARABIC\s14ISCX数据集一周内攻击流量与正常流量的比率Table2.4TheratioofattacktraffictonormaltrafficintheISCXdatasetwithinaweekDayDescriptionSize(GB)FlowsNormalAttackRatioattack/normalFridayNormalActivityNomaliciousactivity16.1378,667378,66700.0000SaturdayNormalActivitysomemaliciousactivity4.22133,193133,11120820.0156SundayInfiltratingthenetworkfrominside+NormalActivity3.95275,528275,17020,3580.0740MondayHTTPDenialofService+NormalActivity6.85171,380167,60937710.0225TuesdayDistributedDenialofServiceusinganIRCBotnet23.4571,698534,32037,3780.0700WednesdayNormalActivityNomaliciousactivity17.6522,263522,26300.0000ThursdayBruteForceSSH+NormalActivity12.3397,595392,39252030.0133由于基于机器学习的入侵检测方法需要耗费大量人工成本来进行特征提取，会丢失原始数据中的大量重要信息，为了解决这一问题，Sun等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[80]提出了一种CNN-LSTM入侵检测方法，来提取网络流量数据的时空特征，并在训练阶段使用类别权重进行优化，但是由于缺乏数据，该方法对于部分攻击行为的检测准确率较低。Majjed等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[81]提出了一种自学习入侵检测系统，使用稀疏自动编码器来进行特征学习及降维，在NSL-KDD数据集上，该方法的检测准确率为84.96%，F-measure为85.28%，检测精度仍有较大提升空间。针对网络数据维度较高，检测困难的问题，Aldwairi等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[82]使用对比散度和持久对比散度作为训练算法，并使用受限玻尔兹曼机来对NetFlow流量进行类别划分。ISCX数据集分布如表2.4所示，Aldwairi等人通过对ISCX数据集中正常类别数据进行简单采样，来构建增大少数样本的比例，但是该模型检测准确率较低，只有89%。Wei等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[83]提出了一种联合优化算法来优化深度信念网络的网络结构，首先利用基于鱼群思想的粒子群优化算法寻找初始优化解，再基于初始最优解，使用遗传算子优化粒子群优化算法以搜索得到全局最优解。最后，使用上述联合优化算法构造的全局优化解决方案来构建入侵检测模型，其具体建模过程如图2.6所示。但是该算法并未对NSL-KDD数据集中的不同类别流量数据分布的差异进行处理，并且在两个测试集上的二分类准确率较低，分别是83.86%和68.75%。图STYLEREF1\s2.SEQ图\*ARABIC\s111Wei等人ADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[83]提出的深度信念网络模型Figure2.12ThedeepbeliefnetworkmodelproposedbyWeietalADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[83]表STYLEREF1\s2.SEQ表\*ARABIC\s15基于深度学习的入侵检测方法研究现状对比Table2.5Researchstatusofintrusiondetectionmethodsbasedondeeplearning文献发表时间所提方法解决的问题存在的缺陷AlthubitiADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[76]2018LSTM传统机器学习技术无法利用海量数据解决入侵分类并未对CIDDS数据集分布差异进行处理；检测准确率较低，为84.83%。AgarapADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[77]2018GRU、SVM误报率高、检测率低检测准确率较低，为84.15%。LinADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[78]2018CNN网络数据量较大，检测困难并未对NSL-KDD数据集分布差异进行处理；在两个测试集上的多分类准确率较低，分别是79.05%和60.86%。WuADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[79]2018CNN网络数据量较大，检测困难在两个测试集上的多分类准确率较低，分别是79.48%、60.71%SunADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat</title><secondary-title>Usenix,Nov</secondary-title></titles><periodical><full-title>Usenix,Nov</full-title></periodical><pages>2013-2016</pages><volume>4</volume><number>4</number><dates><year>2009</year></dates><urls></urls></record></Cite></EndNote>[80]2020CNN-LSTM传统机器学习技术耗费大量人工成本提取特征该方法对于部分攻击行为的检测准确率较低MajjedADDINEN.CITE<EndNote><Cite><Author>Daly</Author><Year>2009</Year><RecNum>163</RecNum><DisplayText><styleface="superscript">[1]</style></DisplayText><record><rec-number>163</rec-number><foreign-keys><keyapp="EN"db-id="rfavw52efae2aees5xcxpwrawd22te5vwddp"timestamp="1525694466">163</key></foreign-keys><ref-typename="JournalArticle">17</ref-type><contributors><authors><author>Daly,MichaelK</author></authors></contributors><titles><title>Advancedpersistentthreat