Conditional mutual information based network intrusion classification method of double-layer semi-idleness Bayesian

Abstract

The method includes steps: (1) training phase: (a) collecting known determined whether dialog events are intruded, and extracting features as training set; (b) pretreating the training set; (c) obtaining trained bilaminar half lazy Bayes classifier based on conditional mutual information; (d) ending; (2) classifying phase: (e) pretreating dialog events to be tested; (f) using classifier obtained from step (1)-(c) to classify pretreated dialog events; (g) returning back classified result; (h) ending. Keeping low time complexity in application phase, the invention raises performance of classified precision so as to raise intrusion detection performance of intrusion detection system.

Description

technical field [0001] The invention relates to a network intrusion detection method, in particular to a network intrusion classification method based on a Bayesian classifier. Background technique [0002] In the environment of rapid development of network technology and increasingly prominent network security issues, traditional host-based or network-based intrusion detection systems have been difficult to meet the detection tasks of more and more complex network attacks. Introducing technologies such as machine learning and data mining into intrusion detection systems has become one of the main directions of intrusion detection system research. For example: intrusion detection technology based on Bayesian classification method, intrusion detection technology based on neural network and intrusion detection technology based on association rule mining, etc. [0003] Naive Bayesian classifier has been widely used in the field of intrusion detection because of its simplicity ...

AI Technical Summary

Problems solved by technology

However, these classifiers cannot be applied to intrusion detection systems with high real-time requirements and the pursuit of prediction accuracy, either because of the high time complexity or because they do not take into account the different attribute independence relationships of different class label events.

Images