Intrusion detection method based on semi-supervised learning

Abstract

The invention discloses an intrusion detection method based on semi-supervised learning. The method comprises the steps of selecting an initial mixed sample set with samples with labels and unlabeled samples to be tested, calculating information gain of each characteristic value in a characteristic space, and completing characteristic selection based on information entropy; then, screening the samples with the labels based on the characteristic selection of the information entropy, using new screened training data for semi-supervised training of a classifier based on LapSVM, and utilizing the classifier after training is finished to classify the unlabeled samples to be tested; according to a detection index, determining the best evaluation value of the detection index, and outputting a classification result corresponding to the best evaluation value of the detection index. According to the intrusion detection method based on semi-supervised learning, the characteristic selection method is adopted to deal with redundancy phenomena easily occurring in network environment data, a semi-supervised learning model is established by utilizing a small number of samples with labels and a large amount of unlabeled data, the false alarm rate is reduced, and the detection rate is increased; meanwhile, the data redundancy can be reduced, and the detection efficiency is improved.

Description

technical field [0001] The present invention relates to intrusion detection technology in the field of network security, in particular to an intrusion detection method based on semi-supervised learning, which is used to complete the classification and identification of abnormal data in network data Background technique [0002] In recent years, network security incidents have occurred frequently, and network security issues have attracted great attention from many countries. Since the first public security vulnerability report in 1980, the methods and types of network attacks have become more and more complex, making it difficult to detect network attacks. According to different detection methods, intrusion detection methods can be divided into two categories: misuse-based intrusion detection and anomaly-based intrusion detection. Classical misuse-based detection methods rely on known signatures of attack types and thus lack the ability to detect unknown attacks. In contra...

AI Technical Summary

Problems solved by technology

The challenge of this method is to find the optimal discriminant function to establish an accurate normal value classification benchmark

Images