Network intrusion detection method and device based on ensemble learning

Abstract

The invention discloses a network intrusion detection method and device based on ensemble learning, and the method comprises the steps: collecting network intrusion detection data, extracting features, carrying out the preprocessing, building a training data set, selecting attack type data with a smaller data size, and increasing the data size of the attack type data; training a plurality of learners for each data type in the training data set, and then fusing the learners together in an ensemble learning mode to form an ensemble learning model corresponding to each data type; setting an optimal classification threshold for each data type to minimize the cost of misclassification; and respectively inputting to-be-detected data into the ensemble learning model of each data type, and obtaining the data type to which the to-be-detected data belongs according to the output result of the ensemble learning model and the classification threshold. According to the method and the device, the problems of low detection accuracy, high false alarm rate and high false alarm rate of attack data of attack types with small data volume in the prior art can be effectively solved.

Description

Technical field [0001] This application relates to the field of information science and technology, and in particular to a method and device for network intrusion detection based on integrated learning. Background technique [0002] In recent years, the development of machine learning has brought new solutions to the problem of network intrusion detection. From the initial application of basic machine learning algorithms, such as decision tree algorithm, random forest algorithm, Bayesian network algorithm, Markov algorithm, support vector machine algorithm, K-nearest neighbor algorithm, artificial neural network algorithm, etc., These machine learning algorithms combine with each other to achieve new results and solve various problems in different aspects. For example, Muda Z et al. proposed a method of fusion of K-menas algorithm and Bayesian algorithm. GaddamS R et al. proposed a method of fusion of K-Means algorithm and ID3 algorithm in decision tree algorithm. These methods ...

AI Technical Summary

Problems solved by technology

[0006] Considering the different loss costs of misclassifying different types of data traffic in actual situations, this application proposes a network intrusion detection method and device based on ensemble learning to solve the problems existing in the prior art for attack types with a small amount of data Attack data detection accuracy is low, false alarm rate and false alarm rate are high

Images