Computer intrusion detection method based on integrated study and semi-supervised SVM

Abstract

The invention discloses a computer intrusion detection method based on integrated study and a semi-supervised SVM. The method is mainly used for solving the problem that when the computer intrusion detection problem is processed in the prior art, on the condition that the number of marked samples is limited and datasets are seriously unbalanced, the classification accuracy for attacked samples is low. The method comprises the implementation steps of 1, normalizing intrusion detection datasets; 2, initializing marked sample sets and unmarked sample sets; 3, training an SVM classifier, and predicting the unmarked samples to obtain predicted marks; 4, training a semi-supervised SVM classifier, and updating the marks of the unmarked samples in an iteration mode; 5, removing sampling data corresponding to a support vector; 6, using T classification models for predicting the marks of the unmarked samples; 7, inputting the T marks into an integrated classifier based on the Dunne index to obtain and output a final detection result. As for data with few marked samples, the detection precision of attacked samples is improved, and the method can be used for computer intrusion detection with few training samples.

Description

technical field [0001] The invention belongs to the field of computer intrusion detection, and is an application of data mining methods in the field of computer intrusion detection, specifically a computer intrusion detection method based on integrated learning and semi-supervised SVM, which can be used for computer intrusion detection. Background technique [0002] In recent years, with the popularization of the network and the gradual expansion of the application field, the problems of network security and information security have become increasingly prominent. Intrusion detection technology is a new type of network security technology that has emerged in recent years. Its purpose is to provide real-time intrusion detection and take corresponding protective measures, such as recording logs and disconnecting network connections. It expands the security management capabilities of system administrators (including security logs, monitoring, attack identification and response)...

AI Technical Summary

Problems solved by technology

However, the current intrusion detection system still has the following deficiencies: (1) Due to the high dimensionality of intrusion detection data, the detection efficiency is low; (2) It is powerless to unknown attacks, lacks generalization ability, and has a high false positive rate: (3) Attack behavior The feature database is constantly updated, and the system maintenance workload is heavy

Images