Intrusion detection method based on traffic visualization and machine learning algorithm

Abstract

The invention discloses an intrusion detection method based on traffic visualization and a machine learning algorithm. The intrusion detection method comprises the following steps: S1, capturing traffic by using high-speed capture equipment; s2, sending the flow which cannot be identified by the intruder database and the packet header information required by the intruder database to a data processing layer for data processing; s3, converting the received flow subjected to data processing into a grey-scale map; s4, based on semi-supervised learning, clustering the grey-scale map by using a K-means algorithm and classifying the gray-scale images of each cluster after clustering by using a CNN, and judging whether unknown invasion occurs or not based on an entropy theory and a classificationresult; s5, according to a classification result, based on an antibody theory in an AIS algorithm, purifying the specific attack by adopting a decision tree algorithm to obtain a detection result; themethod solves the problems that in the prior art, each attack cannot be accurately detected, the network attack cannot be detected in real time, the intrusion system establishment speed is low, feature extraction is complex, and the resource occupancy rate cost is high.

Description

technical field [0001] The invention belongs to the technical field of the Internet, and in particular relates to an intrusion detection method based on traffic visualization and machine learning algorithms. Background technique [0002] In recent years, with the continuous development of Internet technology, people use the Internet more and more widely, the frequency and intensity of attacks in the network have been increasing, and the network environment has also deteriorated. Network attack refers to the attack on the hardware, software and data of the network system by using network loopholes and security defects. From the perspective of destructiveness to information, attack types can be divided into passive attack and active attack. Active attacks can lead to the tampering of certain data streams and the generation of false data streams. Such attacks can be divided into tampering, falsification of message data and termination (denial of service). In a passive attack...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the above-mentioned deficiencies in the prior art, the present invention proposes an intrusion detection method based on traffic visualization and machine learning algorithms, which is used to solve the existing problems in the prior art that cannot accurately detect each attack, cannot detect network attacks in real time, and establish intrusion detection methods. The problems of slow system speed, complex feature extraction and high cost of resource occupancy

Images