Network intrusion detection model based on random forest algorithm

Abstract

The invention discloses a network intrusion detection model based on a random forest algorithm, which adopts the steps of: inputting training data, and after reading the training data, firstly carrying out preprocessing on the data; and then training the data by applying the random forest algorithm, and establishing an intrusion detection model. Data preprocessing is formed by five steps of: a first step of deleting a redundancy part in the data, i.e., deleting repeated data in the data; a second step of carrying out feature selection, i.e., by carrying out sorting from big to small on information gains, selecting first 70% of features; a third step of artificially synthesizing a new data set, i.e., due to unbalance of data distribution, artificially synthesizing the new data set by usinga SMOTE (Synthetic Minority Oversampling Technique) algorithm; a fourth step of carrying out data cleaning, i.e., carrying out a cleaning operation on the data by using an ENN (Edited Nearest Neighbor) algorithm; and a fifth step of carrying out regularization processing, i.e., carrying out regularization processing on the data, so that a range of each feature is centralized in a specific range.

Description

technical field [0001] The invention relates to the field of intrusion detection network security, in particular to a network intrusion detection model based on a random forest algorithm. Background technique [0002] Intrusion detection refers to collecting information from key points in a computer network, and analyzing the information to see if there is a violation of security policies in the network. Intrusion detection can be said to be a reasonable supplement and extension of firewall; if firewall is the first security gate, intrusion detection can be said to be the second security gate. On the premise of not affecting network performance, intrusion detection can protect various internal and external attacks in real time and dynamically, and at the same time effectively make up for the protection limit that firewalls can achieve. [0003] The traditional intrusion detection technology is a technology that applies the rule set method to detect violations of security po...

AI Technical Summary

Problems solved by technology

In general, the traffic data of attack types is very small, the distribution of data sets is unbalanced, and there are many unclean data in network traffic, that is, noise data, which is not conducive to the establishment of a good model

Images