Malicious traffic detection method based on smote algorithm and integrated learning

Abstract

The present invention proposes a malicious traffic detection method based on SMOTE algorithm and integrated learning, aiming to solve the technical problem of low recall rate of malicious traffic detection caused by unbalanced benign and malicious traffic on the basis of ensuring the accuracy of malicious traffic detection, The implementation steps are: obtain benign traffic and malicious traffic; extract the statistical characteristics of the obtained traffic, obtain the malicious flow feature vector and the benign flow feature vector, and form the training set and the test set; cluster the malicious flow feature vector; use the KNN nearest neighbor algorithm Calculate the dangerous points of each cluster, delete the dangerous points to obtain a safe cluster; optimize the SMOTE algorithm; use the optimized SMOTE algorithm to center on the cluster center, and any sample in the cluster is a reference sample interpolation to generate a new sample ; Add new samples to the training set to obtain a balanced training set; build an ensemble learning classifier model; obtain the predicted label of the test set through the majority class voting method.

Description

technical field [0001] The invention belongs to the technical field of malicious traffic detection, and relates to a malicious traffic detection method, in particular to a malicious traffic detection method based on SMOTE algorithm and integrated learning. Background technique [0002] Malicious traffic refers to the traffic generated by viruses, Trojan horses, and malware running on electronic devices, and can be further divided into encrypted malicious traffic and unencrypted malicious traffic. If viruses, Trojan horses and malicious software are not found in time in the actual network, viruses, Trojan horses and malicious software will spread widely and damage network security. Malicious traffic detection technology detects viruses, Trojan horses and malware by detecting malicious traffic in network traffic. This technology can be divided into malicious traffic detection based on deep packet technology and malicious traffic detection based on machine learning algorithms. ...

AI Technical Summary

Problems solved by technology

[0005] The purpose of the present invention is to overcome the deficiencies in the prior art above, and propose a malicious traffic detection method based on the SMOTE algorithm and integrated learning, aiming at ensuring the detection accuracy of malicious traffic, and solving the problems caused by unbalanced benign and malicious traffic. Technical issues with low recall for malicious traffic detection

Images