Network intrusion detection method based on double adaptive regularization online extreme learning machine

Abstract

The invention discloses a network intrusion detection method based on double adaptive regularization online extreme learning machine; empirical risk and structural risk are fully balanced in calculation of output weight Beta, ridge regression factor C based on Tikhonov regularization is introduced, and over-fitting and ill-conditioned problems in network intrusion detection are eliminated. In the initial phase, samples are extracted randomly from NSL-KDD dataset as an initial training set, and the output weight Beta is adaptively initiated according to the size of the initial training set; in the continuous learning phase, optimized value of the ridge regression factor C is acquired by means of leave-one-out cross validation based on singular value decomposition and prediction sum of squares according to all the datasets currently acquired and is updated adaptively; the output weight Beta is adaptively updated according to the size of the dataset arrived each time. The network intrusion detection method based on double adaptive regularization online extreme learning machine is capable of detecting network intrusions efficiently and quickly, and generalization performance and real-time performance of the network intrusion detection algorithm are improved significantly.

Description

Technical field [0001] The invention belongs to the field of machine learning, and relates to a network intrusion detection method based on a double-adaptive regularized online extreme learning machine. Background technique [0002] With the continuous development of network technology and network scale, the Internet has been widely used in military, finance, e-commerce and other fields. More and more hosts and networks are being threatened by various network intrusion attacks, and information security has been elevated to a very important position. Network intrusion means that network attackers obtain illegal permissions through illegal means (such as decrypting passwords, electronic spoofing, etc.), and use these illegal permissions to enable network attackers to perform unauthorized operations on the attacked host, such as stealing User’s online banking account information, etc. The main ways of network intrusion are: password decryption, IP spoofing and DNS spoofing. Netwo...

AI Technical Summary

Problems solved by technology

The first point is that due to the continuous emergence of new network intrusion methods, the network data sample set is getting larger and larger (that is, the training data set is getting bigger and bigger), which increases the overhead of security analysis, reduces efficiency, and is difficult to meet the real-time performance of intrusion detection. requirements

The second point is that network attacks are becoming more intelligent and complex, making it more difficult to detect malicious intrusions

However, OS-ELM, like ELM, is based on empirical risk minimization, which is prone to overfitting and pathological problems.

Images