Classification method applicable for intrusion detection

Abstract

The invention discloses a classification method applicable for intrusion detection. The method is characterized in that according to the characteristics of the SVM classification algorithm that the sensitivity to unbalanced classes of data sets is high and classification is carried out in a kernel space, through a mixed sampling mode, in which oversampling based on kernel SMOTE is carried out on minority sample sets in training sample sets, and undersampling based on kernel fuzzy C-means clustering is carried out on majority sample sets in the training sample sets, a balancing preprocessing of the unbalanced training data sets is achieved; and training is then carried out newly obtained training sample sets through the Bagging ensemble learning method to obtain an SVM-based ensemble classifier. The method has the advantages that a model obtained through the training can effectively solve the defects of unsatisfactory intrusion data identification effects and a high misjudgment rate for normal data of the traditional SVM intrusion detection model, and the adopted Bagging ensemble algorithm is applicable for large-scale parallel computing.

Description

technical field [0001] The invention belongs to the technical field of network security, relates to a mixed sampling technology for equalized preprocessing of intrusion detection data and a support vector machine integrated learning method, and discloses a classification method suitable for intrusion detection. Background technique [0002] In the field of network security, intrusion detection, as an active defense technology, monitors user and system activities by collecting and analyzing system, user and network data packet information. In order to enable the detection system to automatically detect anomalies from the collected information, machine learning technology is introduced into the intrusion detection system. [0003] As an important research branch in the field of machine learning, support vector machine has been applied in the field of intrusion detection because of its perfect mathematical theory and good practical application effect. However, in the tradition...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the above-mentioned defects of SVM application in intrusion detection, the present invention proposes a sample equalization preprocessing method based on kernel-space mixed sampling technology on the training sample set, and a learning method of support vector machine integration on the classification algorithm. The scheme can improve the shortcomings of the support vector machine detection model, such as low detection rate and high misjudgment rate of intrusion data, and is suitable for large-scale parallel computing

Images