Intrusion detection method, system and device and readable storage medium

Abstract

The invention discloses an intrusion detection method, which comprises the following steps: classifying data in an obtained data set, with the category of the data comprising a large sample and a small sample; carrying out data expansion on the data of which the category is a small sample in the data set; dividing the expanded data set into a training set and a test set, training a preset networkmodel by using the training set, and performing performance evaluation on the trained preset network model by using the test set; and determining the preset network model with the optimal performanceas an intrusion detection model, and performing intrusion detection on the obtained perception data by using the intrusion detection model. Data of which the category is a small sample in the data setis subjected to data expansion, so that the underfitting phenomenon of a learner on the small sample is avoided, the learning efficiency and generalization ability of the model are improved, and theintrusion detection accuracy is further improved. The invention further provides an intrusion detection system and device and a readable storage medium which have the above beneficial effects.

Description

technical field [0001] The present application relates to the field of intrusion detection, in particular to an intrusion detection method, system, device and readable storage medium. Background technique [0002] Intrusion detection is a network security technology that provides real-time protection for computer networks. It mainly detects the data currently input into the protected network or protected host to determine whether the currently detected data is legal or illegal. The traditional detection schemes currently used for attacker intrusion detection are modeled based on normal network behavior characteristics or known attack type characteristics, which has certain limitations, and the characteristics are processed manually, which cannot guarantee the accuracy of the model for large amounts of data. Attack types are learned and updated in time. [0003] In order to deal with a series of problems encountered in traditional detection schemes, intrusion detection schem...

AI Technical Summary

Problems solved by technology

Gradient Boosting Decision Tree (GBDT) is the most widely used model for ensemble learning to solve classification problems. However, this scheme usually performs ensemble learning on multiple base models, and there is a problem of unbalanced data distribution in the training set, which reduces the model Learning efficiency and generalization ability lead to low accuracy of intrusion detection

Images