Multi-stage intrusion detection method combining Gaussian mixture model and sort learning

Abstract

The invention discloses a multi-stage intrusion detection method combining a Gaussian mixture model and rank learning. The method comprises the following steps: S1, acquiring malicious intrusion traffic data to obtain a network traffic feature data set; S2, dividing the network traffic feature data set and extracting optimal features; S3, predicting the prior information set to obtain distribution conditions of misclassification samples and overlapped samples; S4, carrying out feature value matching on the error sample and the optimal feature test set, and obtaining a first-stage prediction result through model prediction; S5, obtaining the overlapped samples and non-overlapped samples in combination with the error sample distribution condition, making a prediction label for the overlapped samples according to the prior information of the overlapped samples, and obtaining a second-stage prediction result; S6, performing classification prediction on the non-overlapped samples to obtain a first splicing vector; S7, predicting the first splicing vector through a sorting learning model to obtain a third-stage prediction result; A Gaussian mixture model and sorting learning are combined to solve the problem that the classification effect of samples with the same features and different labels and samples with easy-to-confuse categories is poor.

Description

technical field [0001] The invention belongs to the technical field of learning intrusion detection, and more specifically relates to a multi-stage intrusion detection method combining Gaussian mixture model and ranking learning. Background technique [0002] Intrusion detection refers to the process in which the system learns the existing network traffic data to capture the difference between normal traffic data and malicious traffic data, so as to identify malicious traffic data. [0003] The following two situations exist in the intrusion scenario: 1) Most of the network intrusion data are packet-based or flow-based, resulting in a low feature dimension extracted, so that intrusion types with similar characteristics will get the same characteristics, resulting in intrusion Samples with the same eigenvalues ​​but different labels appear in the data. 2) The scope of various types of intrusion in the network intrusion data is relatively vague, which results in the crossing ...

AI Technical Summary

Problems solved by technology

[0003] The following two situations exist in the intrusion scenario: 1) Most of the network intrusion data are packet-based or flow-based, resulting in a low feature dimension extracted, so that intrusion types with similar characteristics will get the same characteristics, resulting in intrusion Samples with the same eigenvalues ​​but different labels appear in the data

2) The scope of various intrusion types in the network intrusion data is relatively vague, which leads to the overlap between the intrusion types with broad concepts, resulting in a large degree of confusion between the intrusion types with overlapping ranges, and it is difficult to classify them correctly

And when a sample of a certain feature combination is not correctly classified, all corresponding samples with the same feature will be misclassified, which will greatly affect the performance of the intrusion detection system

Images