Sample prediction method and device based on intrusion detection model and electronic device

Abstract

The embodiment of the invention provides a sample prediction method and device based on an intrusion detection model and an electronic device. The method comprises the steps of clustering samples in an initial training sample set, thereby obtaining first clusters, for each first cluster, if all samples in the first cluster belong to the same class, extracting the samples in the first cluster from the initial training sample set and marking the class of the first cluster as the class of any marked sample in the first cluster; obtaining a target training sample set, a target intrusion detection model and an initial test sample set, and for each sample in the initial training sample set, judging whether to extract the sample form the initial training sample set or not; obtaining a target test sample set composed of the samples which are not extracted from the initial training sample set; and carrying out class prediction on each sample in the target test sample set through utilization of the intrusion detection model. Through application of the scheme provided by the embodiment of the invention, when the sample prediction is carried out, the sample prediction accuracy is improved.

Description

technical field [0001] The present invention relates to the technical field of network security, in particular to a sample prediction method, device and electronic equipment based on an intrusion detection model. Background technique [0002] In recent years, various network security incidents have occurred frequently. In order to deal with frequent network security incidents and protect computers from illegal intrusion and malicious attacks, the application of network security technology has emerged. As an active defense network security technology, intrusion detection has been extensively studied. [0003] The intrusion detection technology is mainly based on the intrusion detection model to predict the type of samples, so that it can monitor internal attacks, external attacks and misoperations in real time, and intercept the network system before it is compromised to achieve the purpose of protecting the network. Generally speaking, the categories of samples can be divid...

AI Technical Summary

Problems solved by technology

[0005] At present, when performing sample prediction based on the intrusion detection model, there are two problems: one is that the number of samples in each category in the training sample set used is seriously unbalanced, and the number of samples in some categories may be thousands of samples in other categories. Tens of thousands of times, because the sample features covered by the category with a large number of samples are relatively comprehensive, while the sample features covered by the category with a small number of samples are relatively scarce, therefore, using this training sample set to train the target intrusion detection model in the When a sample performs category prediction, it tends to predict the category of the sample as: the category with a large number of samples makes it difficult to accurately predict the category with a small number of samples, resulting in low prediction accuracy of the sample category; the second is The samples in the training sample set used are all labeled samples, while the samples in the test sample set are all unlabeled samples, and the sample categories in the test sample set and the sample categories in the training sample set do not obey the same probability distribution. The category that has not appeared in the training sample set will cause the intrusion detection model to be unable to accurately predict the samples belonging to this category, so that the accuracy of sample prediction is not high

Images