结合门控递归单元（GRU）和支持向量机（SVM）神经网络网络入侵检测
A Neural Network Architecture Combining Gated Recurrent Unit (GRU) and Support Vector Machine (SVM) for Intrusion Detection in Network Traffic Data
摘要：
门控递归单元（GRU）是最近开发的长短期记忆（LSTM）单元的变体，两者都是递归神经网络（RNN）的类型。通过经验证据，这两种模型已经被证明在各种各样的机器学习任务中是有效的，例如自然语言处理（Wen等人，2015）、语音识别（Chorowski等人，2015）和文本分类（Yang等人，2016）。传统上，与大多数神经网络一样，上述两种RNN变体都使用Softmax函数作为其预测的最终输出层，并使用交叉熵函数计算其损失。在本文中，我们提出了一个修正案，通过引入线性支持向量机（SVM）作为Softmax在GRU模型的最终输出层的替代。此外，交叉熵函数应替换为基于边缘的函数。虽然已经有类似的研究（Alalshekmusic & Smith，2013; Tang，2013），但该提案主要用于使用来自京都大学蜜罐系统的2013年网络流量数据进行入侵检测的二进制分类。结果表明，GRU-SVM模型的性能相对高于传统的GRU-Softmax模型。该模型的训练准确率为~81.54%，测试准确率为~ 84.15%，而后者的训练准确率为~63.07%，测试准确率为~ 70.75%。此外，这两个最终输出层的并置表明SVM在预测时间上优于Softmax-这一理论含义得到了研究中实际训练和测试时间的支持。
英文摘要：
Gated Recurrent Unit (GRU) is a recently-developed variation of the long short-term memory (LSTM) unit, both of which are types of recurrent neural network (RNN). Through empirical evidence, both models have been proven to be effective in a wide variety of machine learning tasks such as natural language processing (Wen et al., 2015), speech recognition (Chorowski et al., 2015), and text classification (Yang et al., 2016). Conventionally, like most neural networks, both of the aforementioned RNN variants employ the Softmax function as its final output layer for its prediction, and the cross-entropy function for computing its loss. In this paper, we present an amendment to this norm by introducing linear support vector machine (SVM) as the replacement for Softmax in the final output layer of a GRU model. Furthermore, the cross-entropy function shall be replaced with a margin-based function. While there have been similar studies (Alalshekmubarak & Smith, 2013; Tang, 2013), this proposal is primarily intended for binary classification on intrusion detection using the 2013 network traffic data from the honeypot systems of Kyoto University. Results show that the GRU-SVM model performs relatively higher than the conventional GRU-Softmax model. The proposed model reached a training accuracy of ~81.54% and a testing accuracy of ~84.15%, while the latter was able to reach a training accuracy of ~63.07% and a testing accuracy of ~70.75%. In addition, the juxtaposition of these two final output layers indicate that the SVM would outperform Softmax in prediction time - a theoretical implication which was supported by the actual training and testing time in the study.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
