Network intrusion classification method based on Bayes of total indirected graph

Abstract

The invention discloses a complete undirected graph-based Bayes network intrusion classification method, which comprises the following steps: (1) training phase: (a) collecting sessions with known invasion results and performing feature extraction to obtain a training set; (b) pre-processing the training set; (c) training a complete undirected graph-based Bayes classifier; and terminating; and (2) classification phase: (a) pre-processing sessions to be detected; (b) classifying the processed sessions with the Bayes classifier obtained in (1) step (c); (c) returning classification results; and (d) terminating. On the premise of simple calculation, the complete undirected graph-based Bayes network intrusion classification method improves the precision of the classifier, especially for anomalous events of small sample targets, so as to improve the intrusion detection performance of an intrusion detection system.

Description

technical field [0001] The invention relates to a network intrusion detection method, in particular to a network intrusion classification method based on a Bayesian classifier. Background technique [0002] Intrusion detection technology is a new type of network security technology that has emerged in the past 20 years. As the second security gate behind the firewall, it can detect various forms of intrusion behavior and is an important part of the modern computer network security system. In the environment of rapid development of network technology and increasingly prominent network security issues, traditional host-based or network-based intrusion detection systems have been difficult to meet the detection tasks of more and more complex network attacks. Applying technologies such as machine learning and data mining to intrusion detection systems has become one of the main directions of intrusion detection system research. For example: Intrusion detection technology based ...

AI Technical Summary

Problems solved by technology

However, these classifiers cannot be applied to high real-time requirements and the pursuit of prediction accuracy due to the high complexity of events, or because they do not take into account the attribute independence relationship of different class label events and the dependency relationship between different attributes. intrusion detection system

Images