Network Intrusion Detection Method Based on Genetic Algorithm Oversampling Support Vector Machine

Abstract

The invention relates to a network intrusion detection method based on a genetic algorithm oversampling support vector machine. The method comprises the following steps: obtaining training data sets consisting of historical network data; classifying the training data sets according to the categories of intrusion detection results; comparing the sample numbers of the sample sets, and performing oversampling processing on the sample sets with sample numbers being smaller than a set value; selecting a set sample number from the training data sets after sampling processing to form a training set; performing cross validation on the training set by using an SVM model, and determining SVM parameters; training the training set by using the SVM model, and screening data with high contribution rates to form a feature vector; performing feature extraction on the training set according to the feature vector so as to train the SVM model by using the training seat after the feature extraction; and performing network intrusion classification detection on network data collected in real time. Compared with the prior art, the network intrusion detection method provided by the invention has the advantages of high unbalanced data classification accuracy.

Description

technical field [0001] The invention belongs to the classification field in machine learning, and relates to a classification method for unbalanced data, in particular to a network intrusion detection method based on a genetic algorithm oversampling support vector machine. Background technique [0002] The computer network has the characteristics of various and uneven connection forms, and its security issues are constantly threatened by intrusions that emerge in an endless stream. At present, the effective way to deal with network intrusion is to establish a corresponding security auxiliary system for the network system according to a certain security mechanism strategy. Intrusion Detection System (Intrusion Detection System, referred to as IDS) is such a system. The system assumes that the system mode used by the intruder is different from that of normal users. The protected system can distinguish the abnormal usage mode of the intruder through the tracking records of net...

Images