Method for intrusion detection based on negative selection and information gain

Abstract

The invention discloses a method for intrusion detection base on negative selection and information gain, which mainly aims to solve the problems of poor effects and instability of the conventional negative selection algorithm (NSA) method. The method is implemented by the following steps of: (1) reading a self-mode set in; (2) performing conversion, normalization and discretization processing on data in the read-in self-mode set; (3) calculating the information gain of characteristics of 41 dimensions of the processed data; (4) selecting the characteristics of former N dimensions with higher information gain values according to calculated information gain value results, forming the self-mode set by using the data in the characteristics of the N dimensions, and training the formed self-mode set to generate a detector set; and (5) detecting the data in a test set by utilizing the generated detector set. The method has the advantages of high accurate detection rate, low rate of false alarm and capability of achieving satisfactory detection effects even with relatively less training data, and can be used for timely identifying abnormal network data and ensuring network security.

Description

technical field [0001] The invention belongs to the field of network security, and relates to a network data anomaly detection method, which can be used for network data analysis, identify abnormal network data in time, and expand unknown virus patterns to better ensure network security. Background technique [0002] With the development of the Internet, the problem of network security has attracted more and more attention. This is mainly because the Internet is an open system, and all users can conduct research on the system and ask questions, which raises many questions about security. Quite a lot of security issues have also occurred on the Internet, making security issues more concerned by everyone. When it comes to network security, many people think of firewalls first. As a static access control security product, firewalls usually use packet filtering technology to isolate networks. Although a properly configured firewall can block unexpected access requests, it cann...

AI Technical Summary

Problems solved by technology

[0008] The detection effect of NSA mainly depends on the coverage effect of the generated detector on the abnormal area. When the data in the self-set is high-dimensional, it is difficult to achieve satisfactory coverage effect.

Since the network data is high-dimensional data and contains a lot of redundant information, when NSA is used for network intrusion detection, the detection effect is unstable, the positive detection rate is low, and the false positive rate is too high.

Images