Detection method based on fusion of simple neural network and extreme gradient boosting model

Abstract

The invention discloses a detection method based on fusion of a simple neural network and an extreme gradient promotion model. The method comprises steps of obtaining a data set, carrying out the preprocessing of the data set, and dividing the data set into a training set and a test set; performing data increment operation on minority class samples in the data set to balance the data set; trainingthe fusion detection model by using the training set; wherein the fusion detection model comprises a simple neural network and an extreme gradient boosting model, and supervised learning training isperformed on the data set till the model converges; and performing intrusion detection on to-be-detected data by utilizing the converged fusion detection model to obtain an intrusion detection result.According to the method, the limitation of insufficient generalization ability of a single machine learning model in different scenes is improved, and the defect of poor association rule mining ability of machine learning for deep information is overcome, compared with a traditional method, cost of manually mining association rules is saved, data features are more effectively utilized, and the intrusion detection rate is increased.

Description

technical field [0001] The invention relates to the field of network security, in particular to a detection method based on fusion of a simple neural network and an extreme gradient lifting model. Background technique [0002] With the rapid development of Internet technology and the continuous deepening of the integration of the Internet and human life, while the Internet brings various conveniences to people, the network security problems people face are also becoming more and more diverse. How to detect various network attacks in real time and effectively is a problem that must be faced at present. Intrusion Detection System (IDS), as an important means of protection to identify abnormal access, has become an important research object in the field of security. [0003] The purpose of network intrusion detection is to analyze the data traffic transmitted by the network, and find and detect abnormal traffic. So as to protect the network security. The NSL-KDD intrusion de...

AI Technical Summary

Problems solved by technology

[0005] 1. The public data sets NSL-KDD or KDD99 commonly used in intrusion detection experiments today have data imbalances, and there are one or two types of attack data that are too small compared to other data samples, so the models are too large during learning. Fitting features with a large number of samples, the detection ability of minority samples is extremely weak, and the actual application effect of the model is not ideal

[0006] 2. The current model has inflexible optimization when optimizing the target, unreasonable gradient penalty, and unclear convergence target when making boundary decisions, especially when the accuracy rate drops significantly in multi-classification

[0007] 3. Traditional machine learning algorithms require a large number of manually selected data features, and the transferability is not strong, and whether it is supervised or unsupervised, it belongs to shallow learning and cannot learn deep information of the data.

[0008] 4. A single model has its flaws, and its generalization ability is not strong when the scene is complex and diverse

Images