Double-layer trigger intrusion detection method based on flow prediction

Abstract

The invention provides a double-layer trigger intrusion detection method based on flow prediction. A lower-layer model is triggered according to a certain rule only when it is detected that an upper-layer model is abnormal and an abnormal area occurs, so that energy use of nodes is reduced and accuracy of detection results can be guaranteed. The method includes the step of data collecting, the step of data analysis, the step of triggering and judgment and the step of starting of a local intrusion detection model, wherein in the step of data collecting, a monitoring node periodically collects data flow information in a network and transmits the information to a base station; in the step of data analysis, the base station receives the information sent by the monitoring mode and then carries out flow prediction on historical data of the monitoring node according to an ARIMA model; in the triggering and judgment step, the base station sends an abnormity alarm to a sink node when the difference between a flow prediction value and a true value exceeds a preset threshold, and a local intrusion detection system is started in the abnormal area; in the step of starting of the local intrusion detection model, when the sink node receives the abnormity alarm, a second-layer intrusion detection model, namely a local intrusion monitoring model, is started in sink nodes and common nodes of areas, where abnormity occurs, in the alarm.

Description

technical field [0001] The invention relates to a flow prediction-based double-layer trigger intrusion detection method, which belongs to the field of wireless sensor networks. Background technique [0002] The research on intrusion detection can be traced back to the work of James P.Anderson in 1980. He proposed terms such as "threat" for the first time. The "threat" referred to here is basically the same as the meaning of intrusion. Unreliable, deliberate, unauthorized access attempts that render the system unreliable or unusable. In 1987, Dorothy Denning of Georgetown University first proposed the definition of intrusion detection: an intrusion detection system consists of three components, the information collection component completes the collection of network information; the detection component completes the analysis and detection of the collected information; the response module Intrusion behavior to take certain measures. The framework of an intrusion detection sy...

AI Technical Summary

Problems solved by technology

Tian et al. proposed a community intrusion detection system based on support vector machine (SVM). This scheme optimizes the parameters of SVM by using genetic algorithm, thereby enhancing the algorithm convergence speed and recognition accuracy. Due to its high classification ability and effective learning Ability and generalization ability, the algorithm has a high accuracy rate, the disadvantage is that the algorithm needs a large number of training samples, and the training time is long

Images