RCLMD：一种开放集网络入侵检测方法

刘原维; 柳毅

RCLMD：一种开放集网络入侵检测方法

投稿时间：2025-12-16 修订日期：2026-01-01 点此下载全文

引用本文：

摘要点击次数: 39

全文下载次数: 0

作者	单位	邮编
刘原维^*	广东工业大学计算机学院	510006
柳毅	广东工业大学计算机学院

基金项目:广州市南沙区科技计划项目（2024ZD001）

中文摘要:针对当前开放集网络入侵检测方法特征判别性不足与决策边界模糊问题，本文提出一种融合重构导向对比学习与马氏距离（Reconstruction-guided Contrastive Learning and Mahalanobis Distance，RCLMD）的方法。在训练阶段，RCLMD通过重构导向对比学习机制，利用重构误差自适应调整样本权重，增强特征判别性；同时设计对抗性边界收缩正则化，对高可靠性样本施加对抗扰动生成伪未知样本，收缩已知类决策边界。在测试阶段，RCLMD采用马氏距离异常检测器，通过协方差矩阵建模特征维度相关性，克服欧氏距离局限，精准识别未知攻击。在CICIDS2017数据集上的实验表明，RCLMD的准确率达95.9%，F1分数97.3%，分类错误率仅4.21%，AUROC达0.971，均优于现有技术。该方法有效平衡了已知攻击精准分类与未知攻击可靠识别的双重目标。

中文关键词:开放集识别网络入侵检测对比学习马氏距离对抗正则化

RCLMD:An Open-set Network Intrusion Detection Method

Abstract:To address the insufficient feature discriminability and ambiguous decision boundaries in current open-set network intrusion detection methods, this paper proposes a novel approach integrating Reconstruction-guided Contrastive Learning and Mahalanobis Distance (RCLMD). During training, RCLMD employs a reconstruction-guided contrastive learning mechanism that adaptively adjusts sample weights based on reconstruction errors to enhance feature discriminability; simultaneously, it designs an adversarial boundary contraction regularization that generates pseudo-unknown samples by applying adversarial perturbations to high-reliability samples, explicitly contracting known-class decision boundaries. In testing, RCLMD adopts a Mahalanobis distance anomaly detector that models inter-dimensional feature correlations through covariance matrices, overcoming Euclidean distance limitations to accurately identify unknown attacks. Experiments on the CICIDS2017 dataset demonstrate that RCLMD achieves 95.9% accuracy, 97.3% F1-score, only 4.21% classification error rate, and 0.971 AUROC, outperforming all existing techniques. The method effectively balances the dual objectives of precise known-attack classification and reliable unknown-attack identification.

keywords:Open-set recognition Network intrusion detection Contrastive learning Mahalanobis distance Adversarial regularization

查看全文 查看/发表评论 下载pdf阅读器