隨著網路技術的不斷發展與進步，網路正逐漸改變我們的生活。網路的蓬勃發展雖然帶給我們莫大的便利性，但是我們所面臨的網路安全威脅卻也日益增加。因此，發展入侵檢測系統 (intrusion detection system, IDS) 作為檢測出因為網路入侵所造成的異常 (anomaly) 就變得越來越重要。有許多研究採用最新的技術發展網路入檢偵測系統，這些系統可以分為二分類或多分類系統，前者可以識別網路流量資料 (network traffic data) 是正常或是異常；而後者除了可以識別網路流量資料是正常或異常之外，還可以分辨異常所屬的類別。 本論文提出一個基於自適應合成 (adaptive synthetic, ADASYN) 抽樣與深度學習 (deep learning) 的入侵檢測方法以發展多分類網路入侵檢測系統。所提方法首先透過自適應合成 (adaptive synthetic, ADASYN) 抽樣來達成網路流量資料的少量樣本過採樣 (oversampling)。接下來，藉由變分自動編碼器 (variational autoencoder, VAE) 擷取輸入資料中重要的特徵，並壓縮出一組代表輸入特徵的低維向量，藉此解決資料集特徵維度過於龐大的問題。最後，再搭配長短期記憶 (long short-term memory, LSTM) 深度神經網路來識別輸入資料所屬的類別。本論文採用NSL-KDD公開資料集來評估所提的方法的效能，並與其他相關方法進行效能比較。比較結果顯示，不管在二分類或多分類入侵檢方面，本論文所提的方法都具有最好的正確率、精準度、召回率和 F1 分數。 ;With the development and progress of the Internet technology, the Internet is gradually changing our lives. Although the vigorous development of the Internet has brought us great convenience, the network security threats are also increasing. Therefore, it is desirable to develop intrusion detection systems (IDSs) for detecting anomalies caused by network intrusions. There are many studies using the state-of-the-art technology to develop network IDSs. These systems can be divided into binary-class or multi-class systems. The former can identify whether network traffic data is normal or anomalous; the latter can not only identify whether network traffic data is normal or anomalous, but also distinguish the class of the anomalous data. This thesis proposes a network intrusion detection method based on adaptive synthetic (ADASYN) sampling and the deep learning for developing multi-class network IDSs. The proposed method first uses the ADASYN sampling mechanism to oversample minority samples in network traffic data. Next, it uses the variational autoencoder (VAE) for extracting important features from data and outputs a set of low-dimensional vectors. Finally, the long-term short-term (LSTM) deep neural network is applied for classifying the data. The well-known NSL-KDD dataset is used to evaluate the performance of the proposed method. The evaluated results are compared with those of related methods. The comparisons show that the proposed method has the best accuracy, precision, recall and F1 score in terms of binary- and the multi-class intrusion detection.
