Distributed intrusion detection method and system based on simulated annealing fusion algorithm

Abstract

The invention provides a distributed intrusion detection method and system based on a simulated annealing fusion algorithm. Specifically, a first data packet of a current network behavior is acquiredin real time and initial detection is performed, whether a second data packet after initial detection is abnormal is judged based on a simulated annealing algorithm, and if the second data packet after initial detection is abnormal, the abnormal data packet is analyzed and network behavior detection result data based on different categories is generated. According to the invention, the final detection result data is obtained through dual detection and correlation analysis processing, the global optimization capability of simulated annealing is fully utilized, and the accuracy and execution efficiency of the intrusion detection model are improved.

Description

technical field [0001] The invention belongs to the field of network detection, and in particular relates to a distributed intrusion detection method and system based on a simulated annealing fusion algorithm. Background technique [0002] Intrusion detection refers to trying to monitor and prevent the intrusion of harmful information as much as possible, or other behaviors that can cause harm to users' systems and network resources. Network-based intrusion detection, this type is generally installed in the network segment that needs to be protected, uses network listening technology to monitor various data packets transmitted in the network segment in real time, and checks the content, source address, destination address, etc. of these data packets Analyze and test. If an intrusion or suspicious event is found, the intrusion detection system will send an alarm or even cut off the network connection. Intrusion detection technology is a technology designed and configured to...

AI Technical Summary

Problems solved by technology

[0003] The current method of intrusion detection includes anomaly detection based on neural network. The disadvantage is that the calculation is large, which will affect the real-time requirements of detection. The intrusion detection method based on data mining can detect unknown intrusion behavior, but the false alarm rate is high.

Although there are currently researches on intrusion detection methods based on simulated annealing algorithm, this method is based on K-means clustering, but this detection method only identifies attack behavior or normal behavior, and does not correlate network behavior data, so , the detection effect is not very ideal

Images