Intrusion detecting method based on semi-supervised neural network

Abstract

The invention discloses an intrusion detecting method based on a semi-supervised neural network, belonging to the field of network information security. The intrusion detecting method comprises the following steps of: 1) using a training set A to initialize an Oth layer of neurons of a GHSOM (Growing Hierarchical Self-Organizing Map) neural network, and calculating a QE0; 2) expanding an SOM (Self Organized Mapping) from the Oth layer of the neurons, and setting a layer identification Layer of the SOM as 1; 3) initializing each SOM expanded in a Layerth layer and training each SOM by the following steps of: adjusting weights of a winning neuron and other neurons in adjacent domains, updating a winning vector set and calculating a main label, a main label rate and an information entropy etyi of the winning neuron; and 4) calculating a qei of each neuron in the SOM and a sub network MQE (Message Queue Element), if MQE is more than QEf*mu1, inserting one row or column of the neurons in the SOM, and if QEi is more than QE0*mu2 or etyi is more than etyf*mu3, generating a layer of a new sub network on the neuron, and adding the new sub network into a sub network array of a (Layer+1)th layer. The detection accuracy of a GHSOM algorithm is improved by using the method.

Description

Technical field [0001] The present invention is applied to an intrusion detection system, improves the intrusion detection method based on the Growing Hierarchical Self-organizing Maps (GHSOM) neural network, and introduces the semi-supervised method into the training process of the GHSOM algorithm, Improve the algorithm's detection accuracy of intrusion data. It belongs to the technical field of computer network information security. Background technique [0002] With the rapid development of computer networks, especially the Internet technology, the network is playing an increasingly important role in our daily life, study and work, and the issue of network security has attracted more and more attention. Quickly and effectively discovering various new intrusions is very important for ensuring the security of network systems. Intrusion detection technology is an information security technology that monitors the operating status of a network system to discover various attack at...

AI Technical Summary

Problems solved by technology

But the SOM network structure is fixed and cannot be changed dynamically

During network training, some neurons can never win and become "dead" neurons, resulting in a relatively low detection rate of the intrusion detection method based on the SOM network. The GHSOM neural network tries to overcome these defects

[0005] The traditional GHSOM algorithm is unsupervised, that is, the training data does not carry any prior knowledge. In actual intrusion detection applications, due to the limitations of various realistic conditions, it is difficult to obtain a large amount of labeled training data.

Images