Network intrusion detection method and system based on mixed sampling

Abstract

The invention relates to the technical field of network intrusion detection, in particular to a network intrusion detection method and system based on mixed sampling, and the method comprises the steps: converting symbol attributes in a network intrusion historical data set into digital attributes; normalizing the network intrusion historical data set to an interval [0, 1]; sampling the network intrusion historical data set by using a hybrid sampling algorithm to obtain a training set of each category balance; training a BP neural network classifier by using the obtained training set; inputting the real-time network intrusion data into a trained BP neural network classifier, and outputting the category of the real-time network intrusion data by the BP neural network classifier. According to the method, the abandonment of most types of samples is reduced, so the loss of valuable information for constructing the classifier is reduced; compared with an intrusion detection technology basedon SMOTE oversampling, noise introduced when a few types of new samples are generated is reduced, and therefore the algorithm has better classification performance on unbalanced data.

Description

technical field [0001] The invention relates to the technical field of network intrusion detection, in particular to a network intrusion detection method and system based on mixed sampling. Background technique [0002] In recent years, machine learning methods have been increasingly used in network intrusion detection, and network intrusion detection is treated as a classification problem. In network attacks, some attack types occur frequently, and some attack types occur infrequently. Therefore, intrusion detection is a typical application scenario of data imbalance. Machine learning can classify most types of intrusion samples when processing imbalanced data. The effect is better, but the classification effect on the intrusion samples of the minority class is poor. However, the detection of the intrusion samples of the minority class is also very important. The existing methods of network intrusion detection system to deal with unbalanced data include network intrusion d...

AI Technical Summary

Problems solved by technology

[0007] For the existing network intrusion detection technology based on machine learning, when dealing with extremely unbalanced intrusion data, in order to make the data balanced, the simple under-sampling method needs to reduce a large number of samples of the majority class and lose a large number of important value for the construction of classifiers. Potential information, the pure SMOTE algorithm needs to generate a large number of new samples of the minority class, which brings serious noise problems. The present invention proposes a network intrusion detection method and system based on mixed sampling. The method is as follows figure 1 , including the following steps:

Images