Distributed migration network learning-based intrusion detection system and method thereof

Abstract

The invention discloses a distributed migration network learning-based intrusion detection system and a method thereof, and mainly solves the problems that the prior method has low efficiency in detection of some attack types and is difficult to search data again. The whole system comprises a network behavior record preprocessing module, an abnormality detection module and an abnormal behavior analyzing module. The network behavior record preprocessing module completes the quantification and normalization processing of a network behavior record; the abnormality detection module uses an abnormality detection learning machine to completes the classification and identification for an input record, determines whether the record is a normal behavior, and completes the detection if the record is a normal behavior or transmits the record to the abnormal behavior analyzing module if the record is an abnormal behavior; and the abnormal behavior analyzing module uses an abnormal behavior analyzing learning machine to carry out the classification and identification of the input records and outputs the attach type of the record. The system and the method have the advantages of using other existing resources to improve the detection rate for the prior attach types with low detection rate and avoiding searching the data again and can be used for network intrusion detection.

Description

technical field [0001] The invention belongs to the field of network security, and in particular relates to an intrusion detection system, which can be used for intrusion detection in the aspect of information security. Background technique [0002] With the widespread use of the Internet, more and more illegal attacks on computer networks have threatened the security of information systems. Network security systems based on passive management such as firewalls have backdoors at the application layer and unauthorized operations by internal users. The resulting attack or theft or destruction of information has been powerless, and the firewall itself is vulnerable to attacks, often helpless for internal network security issues. As an important supplementary measure of the network security protection tool "firewall", the intrusion detection system (IDS) shows increasing importance. IDS can resist attacks from the internal network, prevent hackers from invading and prevent the ...

AI Technical Summary

Problems solved by technology

[0004] 1. There is an imbalance in the detection rate of network behaviors for different types of attacks, and the detection rate of network behaviors for certain types of attacks is very low;

[0005] 2. If the detection rate is to be improved, the user needs to collect data and learn again, which is expensive and time-consuming;

[0006] 3. Inability to use other existing available resources to improve the network behavior detection rate of certain attack types

Images