Network intrusion detection method based on transfer learning and integrated learning

Abstract

The invention relates to a network instruction detection method based on transfer learning and integrated learning. The method comprises the following steps: 1) training and generating multiple independent intrusion detection machine learning judgment models according to standard data; 2) forming an integrated judgment model for the intrusion detection according to the integrated judgment; 3) producing various network traffic data containing attack behaviors by using a network attack tool, and screening the network traffic data by using the integrated judgment model; and 4) taking the screenednetwork traffic data as the attack data, performing transfer learning on the machine learning model, thereby finally obtaining the optimal learning judgment model. Compared with the prior art, the network intrusion detection method disclosed by the invention has the advantages of saving the training time, accelerating the convergence time and high accuracy.

Description

technical field [0001] The invention relates to the field of network security, in particular to a network intrusion detection method based on transfer learning and integrated learning. Background technique [0002] Network intrusion is the act of using the loopholes of the target system to achieve unauthorized access on the attacked computer through network communication protocols. Intrusion detection is a technical method used to detect intrusion behavior. Traditional intrusion detection methods detect abnormal traffic by detecting the characteristics of traffic on the network. New attack methods emerge in an endless stream on the Internet. From the generation of a new attack method to its use to attack the target system, the existing detection systems have no way to obtain information about this attack, so this attack is also called " Zero-day attack". For this "zero-day attack" behavior, traditional detection methods cannot be effectively detected, so using new methods ...

AI Technical Summary

Problems solved by technology

[0004] 1. Unable to detect new types of attacks

[0005] The generalization performance of the attack detection method based on machine learning is limited. It has high accuracy for known types of attack behaviors, and has a high false positive rate for new types of attack behaviors, so it cannot really accurately detect new types of attacks.

[0006] 2. It is difficult to generate detection sample data sets

Due to the complexity of network traffic, the workload of generating and labeling data sets for new attacks and network environments is huge

Images