A non-negative matrix factorization-based intrusion detection method and system under sparse representation

Abstract

The invention discloses a method and a system for intrusion detection based on non-negative matrix factorization under sparse representation. The method includes: acquiring network data and host data, and obtaining a level-one audit privilege program of original network data; preprocessing the network data and the host data, and generating network characteristic data and short-sequence vectors; performing non-negative matrix iterative factorization for a data test matrix, and performing sparse representation for a basis matrix and a weight matrix; sampling weight matrix data subjected to sparse representation by the aid of a projection matrix so that highly characteristic weight coefficient vectors are obtained; and matching the highly characteristic weight coefficient vectors with characteristic vectors in training data by the aid of characteristic vector library data, and judging whether abnormal characteristics are conformed to or not. The method and the system for intrusion detection achieve data dimension reduction by non-negative matrix factorization and uses multi-divergence as a measurement level, an RIP (routing information protocol) condition in sparse representation is added into a combined divergence objective function family to restrain a non-negative matrix factorization iterative process, data detection dimensionality is lowered, and high-dimensional mass data processing of the system for intrusion detection is facilitated.

Description

technical field [0001] The invention belongs to the technical field of intrusion detection, in particular to an intrusion detection method based on non-negative matrix decomposition under sparse representation. Background technique [0002] Since James Anderson first proposed the basic concept of intrusion detection in the technical report "Computer Security Threat Monitoring and Surveillance", intrusion detection has gone through three stages: behavior rule matching, reliability detection and machine learning detection methods. The use of pattern recognition and machine learning methods to study intrusion detection makes the detection system adaptive, learning, and indestructible, which is an effective means to combat various known and unknown attack methods in the current network. The usual method is to extract the characteristics of intrusion data or normal access data, construct a feature vector library, and perform pattern matching to complete intrusion detection. Comm...

AI Technical Summary

Problems solved by technology

[0010] The present invention provides an intrusion detection method based on non-negative matrix decomposition under sparse expression, aiming to solve the training time caused by the large data correlation in the intrusion detection sample data and the large number of training repeated samples in various existing machine learning methods The long-term and intrusion sample marking difficulties have not been solved

Images