Self-adapting network intrusion detection system

Abstract

The invention provides a self-adapting network intrusion detection system, and the system comprises a message pre-processing and forwarding module, a misuse detection module, an abnormality responding module and an output device. The message pre-processing and forwarding module is used for extracting non-encrypted messages in network connecting objects and forwarding the messages to the misuse detection module which is used for forwarding the detected abnormal network connecting objects to the abnormality responding module. The system is characterized by also comprising a real-time database, a feature data arranging and storing module, a historical database, a semi-supervised self-adaptive learning module and an abnormality detection module which is used for analyzing the network connecting feature vectors in the real-time database and forwarding the detected abnormal network connection to the abnormality responding module. The beneficial effect of the system is as follows: the system uses the semi-supervised self-adaptive learning module to establish the rule of abnormality detection according to the data in the historical database, a lot of artificially-marked training data is not needed, thus reducing the deploying cost of the abnormality detection system.

Description

technical field [0001] The invention relates to a computer network intrusion detection system, in particular to an adaptive network intrusion detection system integrating anomaly detection technology and misuse detection technology. Background technique [0002] As one of the most important active network security measures at present, network intrusion detection effectively supplements and perfects the security measures such as access control, data encryption, firewall, virus prevention, etc. by identifying and responding to malicious network connections on computers and network resources. Security measures, which improve the integrity of the information security infrastructure, have become an integral part of information system security solutions. Network intrusion detection technology can be divided into misuse detection technology and anomaly detection technology according to its working principle. Among them, the misuse detection technology is based on the feature match...

AI Technical Summary

Problems solved by technology

However, the traditional method of manually collecting training samples by network experts is inefficient and leads to the problem of high application and deployment costs of anomaly detection systems

Images