A Method of Intrusion Detection Based on Semi-Supervised Learning

Abstract

The invention discloses an intrusion detection method based on semi-supervised learning. The implementation steps include: selecting a mixed sample set initially containing labeled samples and unlabeled samples to be tested, calculating the information gain of each feature value in the feature space and completing the process based on The feature selection of information entropy, and then screen the labeled samples based on the feature selection of information entropy, and use the new training data obtained by screening for the semi-supervised training of the classifier based on LapSVM, and use the trained classifier to be tested. The samples are classified, the best evaluation value of the detection index is determined according to the detection index, and the classification result corresponding to the evaluation value of the best detection index is output. The present invention adopts the method of feature selection to deal with the redundancy phenomenon that is easy to appear in the network environment data, and uses a small number of labeled samples and a large amount of unlabeled data to create a semi-supervised learning model, while reducing the false alarm rate and improving the detection rate, It can reduce data redundancy and improve detection efficiency.

Description

technical field [0001] The present invention relates to intrusion detection technology in the field of network security, in particular to an intrusion detection method based on semi-supervised learning, which is used to complete the classification and identification of abnormal data in network data Background technique [0002] In recent years, network security incidents have occurred frequently, and network security issues have attracted great attention from many countries. Since the first public security vulnerability report in 1980, the methods and types of network attacks have become more and more complex, making it difficult to detect network attacks. According to different detection methods, intrusion detection methods can be divided into two categories: misuse-based intrusion detection and anomaly-based intrusion detection. Classical misuse-based detection methods rely on known signatures of attack types and thus lack the ability to detect unknown attacks. In contra...

AI Technical Summary

Problems solved by technology

The challenge of this method is to find the optimal discriminant function to establish an accurate normal value classification benchmark

Images