Multilayer traffic intrusion detection method based on relative information entropy and semi-supervised clustering

Abstract

The invention relates to a multi-layer traffic intrusion detection method based on relative information entropy and semi-supervised clustering, which adopts a brand new control strategy, comprehensively considers features of different dimensions in analysis of traffic data services, so that a detection result has higher accuracy, and has higher accuracy in analysis of features of each dimension. According to the scheme, the concept of relative information entropy is introduced, the random degree of feature distribution in different time periods is well described, and quick detection of network abnormal behaviors is achieved by calculating the relative information entropy value of each dimension feature; besides, for the problem that at present, many intrusion detection methods based on machine learning need a large amount of marked data to distinguish anomalies, the scheme combines information entropy and semi-supervised clustering modes, and only a small amount of marked data is needed to obtain better performance; therefore, efficient and accurate intrusion detection is comprehensively realized for the network, and the stability of network operation is ensured.

Description

technical field [0001] The invention relates to a multi-layer traffic intrusion detection method based on relative information entropy and semi-supervised clustering, and belongs to the technical field of network traffic anomaly detection. Background technique [0002] The development of the Industrial Internet is facing a situation where the industry is developing rapidly and the network security situation is severe. In the process of transformation and upgrading of traditional industrial systems to industrial Internet ecosystems, the optimization of production efficiency brought about by technological innovation has greatly improved industrial productivity, but at the same time it is also facing all-round security challenges. The Industrial Internet is widely used in all walks of life in industrial production. Once a large number of key information infrastructures are attacked, it will not only cause huge economic losses, but also cause environmental disasters and casualti...

AI Technical Summary

Problems solved by technology

However, the algorithm is easy to fall into the local optimal trap, and it is difficult to obtain the global optimal solution.

Images