A classification method suitable for intrusion detection

Abstract

The invention discloses a classification method suitable for intrusion detection. According to the characteristics that the SVM classification algorithm is sensitive to unbalanced data sets and classifies in the kernel space, the minority class sample set in the training sample set is based on the kernel SMOTE oversampling, and at the same time adopt a hybrid sampling method based on kernel-based fuzzy C-means clustering and undersampling for the majority class sample set to realize the balanced preprocessing of the unbalanced training data set, and then use Bagging on the newly obtained training sample set The ensemble learning method trains an ensemble classifier based on SVM. The model trained by this method can not only effectively improve the disadvantages of the traditional SVM intrusion detection model, such as the unsatisfactory identification effect of intrusion data and the high misjudgment rate of normal data, but also the Bagging integration algorithm adopted is suitable for large-scale parallel computing.

Description

technical field [0001] The invention belongs to the technical field of network security, relates to a mixed sampling technology for equalized preprocessing of intrusion detection data and a support vector machine integrated learning method, and discloses a classification method suitable for intrusion detection. Background technique [0002] In the field of network security, intrusion detection, as an active defense technology, monitors user and system activities by collecting and analyzing system, user and network data packet information. In order to enable the detection system to automatically detect anomalies from the collected information, machine learning technology is introduced into the intrusion detection system. [0003] As an important research branch in the field of machine learning, support vector machine has been applied in the field of intrusion detection because of its perfect mathematical theory and good practical application effect. However, in the tradition...

AI Technical Summary

Problems solved by technology

[0004] Aiming at the above-mentioned defects of SVM application in intrusion detection, the present invention proposes a sample equalization preprocessing method based on kernel-space mixed sampling technology on the training sample set, and a learning method of support vector machine integration on the classification algorithm. The scheme can improve the shortcomings of the support vector machine detection model, such as low detection rate and high misjudgment rate of intrusion data, and is suitable for large-scale parallel computing

Images