Network intrusion detection method based on Plackett-Luce model

Abstract

The invention discloses a network intrusion detection method based on a Plackett-Luce model,belonging to the technical field of network security. The method comprises the following steps: generating network traffic data in a network according to users; obtaining preference values of a user for network traffic at different times by utilizing a Packett-Luce model; determining the preference relationship of the user to different network flows and the network flow domination times according to the preference value; then, according to a logarithm likelihood function of a Plackett-Luce model, obtaining a logarithm likelihood function of the Plackett-Luce model; constructing an iterative function by using a maximum likelihood estimation method; and finally, standardizing the domination times of the network traffic and substituting into an iterative function to calculate the observation weight of the network traffic each time, andtaking the result as a detection result to detect the network flow.The technical problem that whether the network flow of the user is abnormal or not is judged by adopting the Plackett-Luce model on the basis of the network flow data of the user is solved, inconsistency of behavior habits of different users is fully considered, and whether an intrusion behavior exists in the network or not can be better judged.

Description

technical field [0001] The invention belongs to the technical field of network security, and relates to a network intrusion detection method based on the Plackett-Luce model. Background technique [0002] Intrusion detection refers to starting from some key information points in the network or computer system, searching for relevant information, and conducting in-depth research and analysis on the information. It is a security technology that advances the intrusion attack traces in advance to find out whether there is a violation of the security policy in the computer system or network through comparison detection. Discover network intrusion attacks. [0003] There are mainly four types of intrusion detection technologies: statistical-based anomaly detection technology, predictive model-based anomaly detection technology, neural network-based intrusion detection technology, and data mining-based intrusion detection technology. [0004] Statistical-based anomaly detection t...

AI Technical Summary

Problems solved by technology

[0008] The traditional method judges whether there is a network intrusion based on the user's network traffic. Most of the methods are directly calculated through the user's network traffic data. However, due to the different personal behavior habits of users, the network traffic data is not comparable.

Whether there is an intrusion in the network calculated by network traffic data cannot accurately reflect whether there is an abnormality in user behavior in the network

Images