An intrusion detection method based on traffic visualization and machine learning algorithm

Abstract

An intrusion detection method based on traffic visualization and machine learning algorithms, including the following steps: S1: use high-speed capture equipment to capture traffic; S2: send the traffic that cannot be identified by the intruder database and the required packet header information to the data processing layer for processing Data processing; S3: Convert the received traffic for data processing into a grayscale image; S4: Based on semi-supervised learning, use the K-means algorithm to cluster the grayscale image, and use CNN for each cluster after clustering Carry out grayscale image classification, and judge whether an unknown intrusion occurs based on the entropy theory and classification results; S5: According to the classification results, based on the antibody theory in the AIS algorithm, use the decision tree algorithm to purify the specific attack and obtain the detection results; the present invention solves the problem of Existing technologies have the problems of being unable to accurately detect every type of attack, unable to detect network attacks in real time, slow in building an intrusion system, complex feature extraction, and high cost of resource usage.

Description

technical field [0001] The invention belongs to the field of Internet technology, and in particular relates to an intrusion detection method based on traffic visualization and machine learning algorithms. Background technique [0002] In recent years, with the continuous development of Internet technology, people's application of the Internet has become more and more extensive, the frequency and intensity of attacks in the network have continued to increase, and the network environment has also deteriorated. A network attack is an attack on the hardware, software and data of a network system by exploiting network vulnerabilities and security flaws. From the destructive point of view of information, the types of attacks can be divided into passive attacks and active attacks. Active attacks can lead to the tampering of some data streams and the creation of fake data streams. Such attacks can be divided into tampering, forgery of message data, and termination (denial of servi...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the above-mentioned deficiencies in the prior art, the present invention proposes an intrusion detection method based on traffic visualization and machine learning algorithms, which is used to solve the existing problems in the prior art that cannot accurately detect each attack, cannot detect network attacks in real time, and establish intrusion detection methods. The problems of slow system speed, complex feature extraction and high cost of resource occupancy

Images