Intrusion detection method based on incremental GHSOM (Growing Hierarchical Self-organizing Maps) neural network

Abstract

The invention discloses an intrusion detection method based on an incremental GHSOM (Growing Hierarchical Self-organizing Maps) neural network, and belongs to the technical field of network information safety. The method comprises the following steps: 1), acquiring network data online and inputting the network data to an intrusion detection module; 2), calculating a triumph nerve cell t capable of detecting a current vector quantity x by the intrusion detection module; 3), using t to detect x if t is a covering nerve cell and is of the same kind with t; otherwise, putting an unknown attack type tag on x and adding x into an incremental training set; 4), when t meets the expanding conditions, expanding a virtual nerve cell t' from the lower part of t and then expanding a new SOM (Self-organizing Maps) from t', and using an incremental training set It corresponding to t to carry out training; 5), searching a mature father nerve cell of a newly expanded SOM subnet, and if the mature father nerve cell exceeds the conditions for deleting an immature subnet, then training the immature neural network expanded dynamically again; and 6), judging the occurrence of the intrusion according to a detected result output by the intrusion detection module. The intrusion detection method can be used for timely detecting various intrusion behaviors, in particular to the newly emerging intrusion behaviors.

Description

technical field [0001] The invention relates to an intrusion detection method, in particular to an intrusion detection method based on an incremental growing hierarchical self-organizing map (Incremental Growing Hierarchical Self-organizing Maps, IGHSOM) neural network, belonging to the technical field of computer network information security. Background technique [0002] With the continuous expansion of computer network scale and the rapid development of network technology, computer network is closely related to people's daily life, and network security issues have also attracted people's attention. Especially in recent years, the frequency of hacker attacks, the speed of transmission, the extent of victims and the degree of damage have been increasing. How to ensure that personal information is not stolen, and how to resist attacks or attempts from outside the network and inside the system, has become a major issue in network security. An important topic that the industry...

AI Technical Summary

Problems solved by technology

However, in real intrusion detection network applications, attack types emerge in endlessly, so training samples containing all attack types are usually obtained gradually over time, and the internal information reflected by the training samples may change over time

If the algorithm has to retrain all the data every time it gets a new sample, it will inevitably increase the time complexity and space complexity of the algorithm, and it will not be able to detect new intrusion behaviors in time

Images