A network intrusion detection method based on data mining

Abstract

The invention relates to a network intrusion detection method based on data mining. In the prior art, problems that the classification accuracy is reduced due to the defect of sample weight updating,the classification speed is low due to a redundant weak classifier, and the calculation cost is high exist. According to the method, in the weak classifier training stage, the Adaboost algorithm of the improved weight updating method is adopted for weak classifier training, the sample weights are updated according to the weighted average accuracy of all samples in previous t times of training, infinite expansion of the noise sample weights is restrained, and weight updating of all the samples is more balanced. In a weak classifier combination stage, a new mode for measuring the similarity between weak classifiers is provided; selective integration is performed based on the similarity measurement mode and the hierarchical clustering algorithm, weak classifiers with the similarity exceedinga threshold value are classified into one class, the weak classifier with the highest classification accuracy in each class is selected to be combined into a strong classifier, and therefore redundantweak classifiers are removed, the classification speed is increased, and calculation expenditure is reduced.

Description

technical field [0001] The invention belongs to the technical field of computers, in particular to the technical field of network security, and relates to a network intrusion detection method based on data mining. Background technique [0002] As an important part of the information security system structure, intrusion detection can collect information from several key points in the network system, and analyze whether there are intrusion behaviors and signs in the network. Intrusion detection can be regarded as a data classification process, identifying normal operation and intrusion behavior from the collected information. Currently, intrusion detection and classification algorithms mainly include decision trees, neural networks, or support vector machines. However, the above classifiers are all single classifiers, their generalization ability is insufficient, and the classification accuracy is not high, so the ensemble learning method is introduced. Ensemble learning is ...

AI Technical Summary

Problems solved by technology

[0011] The purpose of the present invention is to provide a network intrusion based on data mining for the problems of the classification accuracy rate reduction caused by the sample weight update defect in the traditional Adaboost algorithm, and the slow classification speed and high calculation overhead caused by redundant weak classifiers. The detection method is an adaptive boosting method based on improved weight updating and selective integration

Images