Network intrusion detection method based on dual subspace sampling and confidence offset

Abstract

The invention provides a network intrusion detection method based on dual subspace sampling and confidence offset. The network intrusion detection method comprises the following steps: firstly, carrying out down-sampling preprocessing on a base classifier of each layer in sample and feature dual-layer level; secondly, mixing the confidence of each layer with the original features through an interpolation method to serve as new features to be input into the next layer of the model; then, distributing the confidence coefficient of interpolation layer by layer through a cascade model. The disturbance of the confidence coefficient will not participate in the test step. Compared with a traditional imbalance classification integration method, the method has the advantages that the depth forest is expanded to solve the imbalance problem, and the threshold problem in imbalance classification is further solved through the cascade structure; a model capable of selecting disturbance amplitude isgenerated through the system to train a sample, and the detection performance of the model for unbalanced network intrusion can be effectively improved; meanwhile, the integrated model stacked layer by layer can obtain more excellent generalization performance in the detection process.

Description

technical field [0001] The invention relates to an unbalanced network intrusion detection and identification method, which belongs to the field of network information security Background technique [0002] With the rapid development of network technology and the gradual expansion of the scale of the Internet, network security issues have gradually come into the public eye. The research on network intrusion identification methods is also a hot field this year. The main types of basic network attacks include denial of service (Denial of Service, DoS), unauthorized remote host access (Remote-to-Login, R2L), unauthorized access to superusers (User-to-Root, U2R), Monitoring detection (Probing), etc., the above-mentioned attack methods can further derive numerous sub-attack methods. Therefore, it is urgent to construct a targeted detection scheme for these network attacks. [0003] The existing commonly used network attack detection methods are: 1) rule-based detection methods,...

AI Technical Summary

Problems solved by technology

[0007] In view of the fact that the existing integration algorithm cannot effectively solve the problem of unbalanced network intrusion detection, and the integration scale cannot be well determined, and modeling can only be done by experience, the present invention proposes a method based on dual subspace sampling and Network Intrusion Detection Method Based on Confidence Bias

Images