Network real-time intrusion detection method based on fast gradient boosting tree model

Abstract

The invention discloses a network real-time intrusion detection method based on a fast gradient boosting tree model. The method comprises the following steps: training a fast gradient boosting tree classification model by using training data; capturing network traffic data in continuous time windows, wherein the original traffic data captured in each time window is used as a data block; performingstatistical analysis on data blocks to generate a plurality of feature vectors; classifying the feature vectors by adopting a fast gradient boosting tree classification model, and distinguishing normal behaviors from network intrusion behaviors; and if the behavior is judged to be the network intrusion behavior, outputting a network intrusion alarm signal. The category deviation problem of classification performance can be solved, the false alarm rate can be reduced, and meanwhile, the matching process of the model establishment stage and the decision stage meets the real-time requirement.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network real-time intrusion detection method based on a fast gradient lifting tree model. Background technique [0002] Common network security protection technologies include firewalls, data encryption, authentication, and digital signatures. These static passive defensive network security tools have a single service mode and are difficult to deal with today's complex and changeable network intrusions. [0003] Network traffic is an important data source for intrusion detection. Common network intrusion detection methods can be divided into misuse-based network intrusion detection and anomaly-based network intrusion detection according to the principle. However, the training data obtained in the real network environment is unbalanced data. , so the intrusion detection method based on misuse usually has category bias in classification performance, that is, the detection performa...

AI Technical Summary

Problems solved by technology

[0002] Common network security protection technologies include firewalls, data encryption, authentication and digital signatures, etc. These static passive defensive network security tools have a single service mode and are difficult to deal with today's complex and changeable network intrusions

[0003] Network traffic is an important data source for intrusion detection. Common network intrusion detection methods can be divided into misuse-based network intrusion detection and anomaly-based network intrusion detection according to the principle. However, the training data obtained in the real network environment is unbalanced data. , so the intrusion detection method based on misuse usually has category bias in classification performance, that is, the detection performance of some intrusion behaviors with a small amount of data is poor. On the other hand, it is a challenging task to define normal behavior and intrusion behavior, and the behavior of normal users in the current environment is not static, and abnormality-based network intrusion detection may misjudge normal behavior as Intrusion behavior, so often have a high false positive rate

Images