Intrusion Detection Method Based on Two-layer Heterogeneous Ensemble Learner

Abstract

The invention discloses an intrusion detection method based on a two-layer heterogeneous integrated learner, comprising the following steps: using a PKPCA data dimensionality reduction algorithm to perform dimensionality reduction processing on original data to obtain a preprocessing data set; using N classifiers to preprocess The data set is processed, and the hierarchical ten-fold cross-validation method is used to prevent overfitting; the classifier evaluation algorithm is used to select the best M classifiers as heterogeneous learners, where 2≤M

Description

technical field [0001] The invention proposes an intrusion detection method based on a double-layer heterogeneous integrated learner, which adopts an anomaly-based strategy for intrusion detection and belongs to the field of network security. Background technique [0002] Intrusion detection technology is a common method to detect network security attacks. The current intrusion detection method is divided into two categories. One is based on misuse of the intrusion detection method, which uses the method of signature pattern matching. The basic principle of this type of method is to compare the known signature or attack pattern with the monitored traffic. Match network traffic information to monitor for signs of intrusion. The advantage is that the false positive rate is low, but the difficulty lies in how to design patterns that can express "intrusion" phenomena without including normal activities. Its disadvantage is that it can only model known attacks, and it is diffic...

AI Technical Summary

Problems solved by technology

This is not advisable for intrusion detection, because the large time consumption will affect its practicality

[0007] To sum up, most of the current intrusion detection applications are unable to cope with unknown attacks, and although there are some preliminary applications of anomaly-based intrusion detection methods, most of them guarantee the false positive rate and false negative rate at the cost of time consumption.

Due to the high cost of false positives and false negatives in intrusion detection, the existing methods cannot fully meet the requirements of high accuracy, low false positive rate and false negative rate, and less time-consuming intrusion detection.

Images