Self-adaptive updating network intrusion detection method

Abstract

The invention discloses a self-adaptive updating network intrusion detection method. The method comprises the following steps that a plurality of classification models are trained in different feature spaces through feature space mapping; a plurality of classification models cooperate to perform intrusion detection; the plurality of classification models are automatically updated and triggered according to the difference between the current sample distribution and the historical sample distribution; and a plurality of classification models cooperatively perform adaptive updating. The opportunity of triggering update of the intrusion detection model is automatically determined by periodically calculating the change condition of the relative entropy of the newly collected sample distribution and the historical sample distribution; and through collaborative learning of the multi-classification model, adaptive updating of the intrusion detection model is realized, and the method can better adapt to environment change.

Description

technical field [0001] The invention relates to the technical field of network space security, in particular to an adaptive update network intrusion detection method. Background technique [0002] With the advent of the era of big data and artificial intelligence, Internet attack patterns are diversified, large-scale, and intelligent, and the attack duration is longer, faster, and the implementation cost is lower. Most of the attackers operate in groups, and most of them have specific attack targets, mainly targeting the core business systems of enterprises and institutions, and comprehensively using loopholes, social workers, new Trojan horses and other means. [0003] The traditional network intrusion detection uses the machine learning model, and the traditional machine learning model is based on the theory of structural risk minimization. It is believed that as long as the model satisfies the minimization of empirical risk and confidence risk on the training sample set, ...

AI Technical Summary

Problems solved by technology

[0007] The purpose of the present invention is to provide an adaptive update network intrusion detection method, which is used to solve the problem that the traditional network intrusion detection method cannot automatically trigger the automatic update of the intrusion detection model, does not have the ability of automatic update and learning, and cannot adapt to changes in the environment question

Images