Network intrusion detection method based on information entropy and confidence down-sampling

Abstract

The invention provides a network intrusion detection method based on information entropy and confidence coefficient downsampling. According to the invention, the information entropy and the algorithm confidence are simultaneously adopted as down-sampling references to replace a traditional random down-sampling strategy for a plurality of classes; secondly, through the integration idea of Boosting, the dynamic downsampling method is popularized to any algorithm; in addition, the information entropy used in the method comprises the sample fuzzy membership degree and the structure information at the same time, and therefore information loss of multiple classes can be effectively restrained. Compared with a traditional unbalanced classification integration method, the dynamic downsampling is combined with the information entropy and the confidence coefficient for the first time, an integrated model can adapt to more base algorithms, and the detection performance of the model on unbalanced network intrusion is more effectively improved.

Description

technical field [0001] The invention relates to an unbalanced network intrusion detection and recognition method, which belongs to the field of network information security Background technique [0002] In the past ten years of rapid development of network technology, network security issues have gradually been paid attention to by the public. Among them, the related research on network intrusion identification method is a hot research field nowadays. Preliminary classification of existing network attacks, basic attack types include denial of service (Denial of Service, DoS), unauthorized remote host access (Remote-to-Login, R2L), unauthorized access to superuser access (User -to-Root, U2R), listening detection (Probing), etc. The above-mentioned network attack methods also have some subtype variants, so identifying these network intrusion methods has great practical application value. [0003] The existing commonly used network attack detection methods can be briefly sum...

AI Technical Summary

Problems solved by technology

[0007] In view of the fact that the existing sampling integration algorithm cannot effectively solve the problem of unbalanced network intrusion, the present invention also uses self-defined information entropy and algorithm confidence as the sampling benchmark for down-sampling to replace the traditional random down-sampling strategy for most classes; secondly , through the integration idea of ​​Boosting, the method of dynamic downsampling is extended to any algorithm; and the information entropy used in the present invention includes the sample fuzzy membership and structural information at the same time, so it can effectively suppress the information loss of the majority class

Images