Network intrusion detection method and system based on partial least squares

Abstract

The invention provides a network intrusion detection method based on partial least squares. The method comprises the steps that an anomaly detection model of network data is built according to a partial least squares regression equation; attribute domain mapping is carried out on unlabelled data, and the anomaly detection model is utilized for classifying the data to obtain different types of access behaviors. According to the network intrusion detection method, when the network is subjected to external intrusion, the intrusion data can be regarded as a nonlinear perturbation superposed on the normal network flow, the perturbation strength is affected by intrusion time and intrusion data traffic, the anomaly detection model of the network nonlinear data is built through the nonlinear theory, abnormal data traffic is found through parameter fitting, intrusion behavior detection is carried out by means of nonlinear theory and the partial least squares method in the prediction theory, Kullback Leibler divergence is adopted as determining criterions of normal and abnormal behaviors for convergence conditions of the partial least squares method, and therefore detection of intrusion behaviors in the network is more accurate and rapider.

Description

technical field [0001] The invention relates to the field of computer network security, in particular to a network intrusion detection method and system based on partial least squares. Background technique [0002] The Internet is a huge network connected in series between networks. These networks are connected by a set of common protocols to form a logically single huge international network. This method of interconnecting computer networks can be called "network interconnection". On this basis, a global Internet covering the whole world is developed called the Internet, which is a network structure that is interconnected. China's Internet has formed a scale, and Internet applications are becoming more diversified. The Internet is changing people's study, work and lifestyle more and more profoundly, and even affects the entire social process. As of the end of December 2011, the number of Internet users in China exceeded 500 million, reaching 513 million. [0003] With th...

AI Technical Summary

Problems solved by technology

Although with the development of e-commerce and e-government services that require high security, various network-based secure communication protocols have emerged, but these protocols are all based on the TCP / IP architecture, and this architecture starts from the basic It is an insecure open system at the communication level

Moreover, the existing attack methods and technologies are constantly developing with the improvement of security technology. Therefore, when various network threats cannot be avoided, timely and correct detection of security threats and appropriate handling methods can reduce the damage caused by network attacks. The loss of network security is a hotspot in network security research at present. In view of the current network security situation, there is an urgent need for a new network detection method.

Images