Abnormal intrusion detection ensemble learning method and apparatus based on Wiener process

Abstract

The invention relates to an abnormal intrusion detection ensemble learning method based on the Wiener process. The method comprises the following steps: selecting a network traffic data set; inputting each network traffic sample and sample probability distribution thereof to an uninitialized neural network classifier or a neural network weak classifier obtained through the previous training, judging whether the neural network weak classifier wrongly classifies each network traffic sample, and adjusting quantity and sample probability distribution of each network traffic sample; repeating the step 2 to obtain a plurality of neural network weak classifiers; determining the weight of each neural network weak classifier respectively; obtaining strong classifiers based on each weak classifier and the corresponding weight of each neural network weak classifier; inputting network data flow to be detected to the strong classifiers to obtain intrusion detection results; and repeating the step 6 until all the network data flow to be detected is detected. According to the method and apparatus in the invention, the problem of classification of the unbalanced data set can be solved, and an unbiased classifier with high classification correct rate can be obtained.

Description

technical field [0001] The invention relates to an intrusion detection technology, in particular to an integrated learning method and device for abnormal intrusion detection based on Wiener process. Background technique [0002] Intrusion detection monitors the operating status of the network system, analyzes network traffic and system audit records, etc., extracts various behavior patterns and behavior characteristics of the system, and then detects some intrusions in the system, which are mainly divided into two types: Anomaly intrusion detection and misuse intrusion detection. Abnormal intrusion detection is the main research direction of intrusion detection system at present. It can detect intrusions based on abnormal behavior and the use of computer resources. Abnormal intrusion detection tries to describe acceptable behavior characteristics in a quantitative way to distinguish abnormal potential intrusions. Behavior. Abnormal intrusion detection first defines a set o...

AI Technical Summary

Problems solved by technology

[0005] The technical problem to be solved by the present invention is to provide an integrated learning method of Wiener process and Adaboost, solve the classification problem of unbal

Images