Industrial network DDoS intrusion detection system classification method based on GWA optimization

Abstract

The invention discloses an industrial network DDoS intrusion detection system classification method based on GWA optimization. The method comprises the following steps: step 1, setting initial parameters; step 2, generating an initial SVM parameter population by using a chaotic logic mapping strategy; step 3, optimizing the population of the initial SVM parameters by using an improved reverse learning strategy; step 4, updating the population of SVM parameters by using a GWA operator; step 5, calculating fitness function values of population individuals, and the position vector of the optimalindividual is updated; step 6, if the maximum allowable iteration frequency is reached, executing the step 7; otherwise, t = t + 1 and returning to the step 4; step 7, ending the SVM parameter optimization process, and outputting optimal parameters C and gamma; and step 8, training a support vector machine model by using the searched parameters, and applying the model to attack behavior detectionof the intrusion detection system. According to the method, local search and global search are well balanced, and the recognition capability and real-time performance are improved.

Description

technical field [0001] The invention belongs to the field of intelligent optimization, and relates to a classification method of an industrial network DDoS intrusion detection system optimized based on a global optimal whale algorithm (G-best Whale Algorithm, hereinafter referred to as GWA). Background technique [0002] In industrial production, industrial networks are generally subject to distributed denial of service (Distributed Denial of Service, hereinafter referred to as DDoS) attacks. DDoS refers to the use of client / server technology to combine multiple computers as an attack platform to launch attacks on one or more targets in order to paralyze the network. In order to maintain the network security of the enterprise, the enterprise basically configures an intrusion detection system (Intrusion Detection System, hereinafter referred to as IDS). The common commercial intrusion detection system is basically based on the rule base, so the completeness of the rule base ...

AI Technical Summary

Problems solved by technology

[0003] The standard parameter search algorithm of SVM is an exhaustive search algorithm, the training model is quite time-consuming, and it is difficult to apply it to the actual production environment

Traditional particle swarm optimization, genetic algorithm and other technologies have been widely used in optimization problems, but they have problems such as premature convergence to local optimum or slow convergence speed, which makes the optimization effect worse.

Images