Anomaly detection method for various kinds of intrusion

Abstract

The invention discloses an anomaly detection method for various kinds of intrusion. The method comprises the following steps of: 1) pre-processing an original data set, identifying a complete request message, and dividing network connection through service type to extract relevant characteristics; 2) by analyzing the characteristics of all kinds of attack by a characteristic extraction unit, and by using application layer information during consideration of relevant fields on the head of a data packet, extracting three characteristics, namely basic characteristics, flow characteristics and content characteristics; 3) by using an attribute reduction algorithm based on a discernibility matrix, processing attributes of a great number of extracted data characteristics, deleting redundant attributes in the attributes to obtain a reduced attribute set, extracting data from original training data according to the reduced attribute set to obtain new training data, and transmitting the new training data to a support vector machine (SVM) module for training and classification; and 4) by using a multi-classification SVM method based on a binary tree, classifying minimum attribute sub-sets after reduction of a rough set to realize a quick classification function of intrusion detection.

Description

technical field [0001] The present invention is an anomaly detection technical solution. Based on the consideration of the diversity of network attacks, the method extracts the header and application layer data of the data packet, and uses rough set attribute reduction and support vector machine technology to perform anomaly detection, which belongs to computer network security. technology field. Background technique [0002] With the increasing frequency and types of network intrusions, designing a good intrusion detection scheme has become a research hotspot. From the perspective of intrusion detection strategy, there are two main intrusion detection models: misuse detection and anomaly detection. Misuse detection is to use a certain rule or pattern to pre-identify a specific intrusion behavior, and on this basis, compare the captured traffic related to the target to be detected with the intrusion rule or pattern, in order to find out from the traffic that is related to t...

AI Technical Summary

Problems solved by technology

At present, the existing methods include one-to-many method, one-to-one method, linear programming solution method, directed acyclic graph multi-class SVM algorithm (DAG-SVM), error correction coded SVM (ECC-SVM), etc., but in comprehensive consideration Training speed, discrimination speed and accuracy, the actual effectiveness of the above algorithms and the optimal design of multi-class SVM still need further research

Images