Semi-supervised anomaly intrusion detection method

Abstract

The invention discloses a fuzzy clustering and support vector domain description-based (SVDD) semi-supervised anomaly intrusion detection method, which is mainly used for solving the problems of low intrusion detection data detection rate and high false alarm rate in the prior art. The method comprises the following steps of: (1) initializing a labeled sample set and an unlabeled sample set; (2) initializing a clustering center; (3) carrying out fuzzy C-mean clustering; (4) updating the labeled sample set and the unlabeled sample set according to a clustering result; (5) carrying out SVDD-based self-training; (6) updating the labeled sample set and the unlabeled sample set according to a self-training result; (7) carrying out SVVD-based classification; and (8) evaluating and outputting anintrusion detection result. The method improves the detection rate and reduces the false alarm rate at the same time, and can be used for a real-time intrusion detection system in which training dataonly contains less normal data.

Description

technical field [0001] The invention belongs to the technical field of network security and relates to an intrusion detection method, specifically a semi-supervised abnormal intrusion detection method based on fuzzy clustering and support vector domain description, which can be used for data detection in a network environment. Background technique [0002] With the rapid development of global information technology, the network has been widely used in various fields of social life, and the accompanying network information security problems are also increasing. Traditional network security technologies that have been widely used include data encryption technology, authentication technology, firewall technology and intrusion detection system. Among them, the intrusion detection system has become a research hotspot in the field of network security because of its strong detection, wide range of applications, and timely response. [0003] According to different sources of detect...

AI Technical Summary

Problems solved by technology

The traditional intrusion detection method is based on supervised learning. Although the detection rate is high and the false alarm rate is low, it cannot effectively detect unknown intrusion behaviors.

Therefore, the unsupervised learning method is applied to intrusion detection. The cluster-based intrusion detection method can detect unknown intrusion behavior without marking network data, so the detection rate of this detection method is high. Mislabeling as a normal class will cause this type of intrusion behavior and its variants to be regarded as normal data, so the false alarm rate is also high

Images