Multi-Stage Intrusion Detection Method Combining Gaussian Mixture Model and Ranking Learning

Abstract

Combining the multi-stage intrusion detection method of Gaussian mixture model and ranking learning, S1 obtains the malicious intrusion traffic data to obtain the network traffic feature data set; S2 divides the network traffic feature data set and extracts the optimal features; S3 predicts the prior information set Obtain the distribution of wrongly classified samples and overlapping samples; S4 matches the eigenvalues ​​of the wrong samples with the optimal feature test set, and obtains the first-stage prediction results through model prediction; S5 combines the distribution of wrong samples to obtain overlapping samples and non-overlapping samples, Use the prior information of the overlapping samples to formulate prediction labels for the overlapping samples to obtain the second-stage prediction results; S6 classify and predict the non-overlapping samples to obtain the first splicing vector; S7 predict the first splicing vector through the ranking learning model to obtain the second Three-stage prediction results; combining Gaussian mixture model and ranking learning to solve the problem of poor classification effect of samples with the same characteristics and different labels and samples with confusing categories.

Description

technical field [0001] The invention belongs to the technical field of learning intrusion detection, and more particularly relates to a multi-stage intrusion detection method combining Gaussian mixture model and sorting learning. Background technique [0002] Intrusion detection refers to the process that the system learns the existing network traffic data and captures the difference between normal traffic data and malicious traffic data, so as to identify malicious traffic data. [0003] There are two situations in the intrusion scenario: 1) Most of the network intrusion data are packet-based or flow-based, resulting in a low dimension of the extracted features, so that intrusion types with similar characteristics will get the same characteristics, thus causing intrusion Samples with the same feature value but different labels appear in the data. 2) The scope of various intrusion types in network intrusion data is relatively vague, resulting in the overlapping of scopes be...

AI Technical Summary

Problems solved by technology

[0003] The following two situations exist in the intrusion scenario: 1) Most of the network intrusion data are packet-based or flow-based, resulting in a low feature dimension extracted, so that intrusion types with similar characteristics will get the same characteristics, resulting in intrusion Samples with the same eigenvalues ​​but different labels appear in the data

2) The scope of various intrusion types in the network intrusion data is relatively vague, which leads to the overlap between the intrusion types with broad concepts, resulting in a large degree of confusion between the intrusion types with overlapping ranges, and it is difficult to classify them correctly

And when a sample of a certain feature combination is not correctly classified, all corresponding samples with the same feature will be misclassified, which will greatly affect the performance of the intrusion detection system

Images