Network intrusion detection method and system

Abstract

The embodiment of the invention provides a network intrusion detection method and system. The method comprises the steps of detecting to-be-detected network data based on a trained network intrusion detection model, analyzing and judging an obtained detection result, and if it is judged that the to-be-detected network data is known network data, performing fine-grained classification on the knownnetwork data according to the detection result; if it is judged that the to-be-detected network data is the network unknown category intrusion data, clustering the network unknown category intrusion data to obtain clustering centroids of all categories in the network unknown category intrusion data; and updating the classifier of the trained network intrusion detection model according to the clustering centroid of each category in the network unknown category intrusion data so as to perform intrusion detection on the network unknown category intrusion data in the subsequent to-be-detected network data according to the updated network intrusion detection model. According to the embodiment of the invention, recognition and learning of unknown invasion of the network are realized.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network intrusion detection method and system. Background technique [0002] Today, with the rapid development of 5G technology and the widespread use of IoT technology, a large number of physical devices are connected to the network, making the entire network vulnerable to various security threats. Most existing network systems use firewalls for prevention, and an intrusion detection system (Intrusion Detection System, referred to as IDS) is considered as the second line of defense. [0003] However, there is a serious disconnect between existing machine learning-based and deep learning-based intrusion detection solutions and those actually deployed by IDSs. Specifically, most of the existing algorithms are based on some flawed assumptions, which in turn distort their mapping to actually deployed IDSs. At present, most of the algorithms are based on the assumption o...

AI Technical Summary

Problems solved by technology

At present, most of the algorithms are based on the assumption of a closed world. During the classification process, only the categories seen during training are considered, and only the accuracy of fixed closed-set classes is evaluated, while the actually deployed IDS is in a dynamic and open environment, new network intrusions will continue to appear, because the training data set is difficult to cover all the network intrusions that will occur, the intrusion detection model constructed based on the incomplete training data set may misdetect new network intrusions as existing intrusions or Existing normal behavior, which causes the intrusion detection model to fail to detect unknown network intrusions

Images