Parallel Intrusion Detection Using Unbalanced Data Deep Belief Network
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing intrusion detection methods for unbalanced data sets are inefficient due to reliance on single optimization methods, randomness in Deep Belief Network parameters, and low accuracy from single classifiers, leading to suboptimal detection speeds and accuracy.
Innovation Solution
A method and system for parallel intrusion detection using a Deep Belief Network with Neighborhood Cleaning Rule and Gravity-based Clustering for data balancing, combined with Weighted Kernel Extreme Learning Machine and improved differential evolution for parameter optimization, and self-adaptive weighted voting for classification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data optimization methods (under-sampling/over-sampling) are used to balance unbalanced data sets, then detection accuracy for minority type is improved, but data loss occurs and detection speed decreases
Solution Approach 1:
The patent introduces a data balancing module as an intermediary component between data acquisition and intrusion detection. This module automatically performs under-sampling of majority class and over-sampling of minority class to create balanced training data, thereby improving detection accuracy without requiring manual intervention and minimizing data loss through intelligent sampling strategies
Solution Approach 2:
The system implements self-service through automatic data balancing that occurs without manual intervention. The data balancing module autonomously identifies unbalanced data sets and applies appropriate sampling techniques to balance the data before detection, eliminating the need for manual data preprocessing while maintaining high detection accuracy
2Measurement precision
If Deep Belief Network is used for feature extraction and classification, then detection accuracy is improved, but parameter initialization randomness causes local optima and increased computational complexity
Solution Approach 1:
The patent applies parameter changes by modifying the initialization strategy of Deep Belief Network parameters. Instead of using random initialization that leads to local optima, the system implements a improved differential evolution algorithm that systematically optimizes initial parameters, transforming the initialization process from random to deterministic and optimal, thereby reducing computational complexity while maintaining high detection accuracy
3Device complexity
If single classifier is used for intrusion classification, then system complexity is reduced, but classification accuracy is limited due to inherent bias
Solution Approach 1:
The patent applies segmentation by dividing the classification task into multiple parallel classifiers instead of using a single classifier. Each classifier processes different aspects of the intrusion detection task, and their results are combined through weighted voting. This segmentation approach reduces the burden on each individual classifier while improving overall classification accuracy through diverse perspectives
Solution Approach 2:
The system merges multiple classifier results through a weighted voting mechanism. Each classifier's output is combined with appropriate weights based on its performance, creating a ensemble decision that leverages the strengths of multiple classifiers while compensating for individual weaknesses, thereby achieving higher classification accuracy than any single classifier alone
4Measurement precision
If standard optimization algorithms are used for Deep Belief Network parameters, then parameter optimization is achieved, but large amount of iterative operations consume excessive computing resources and time
Solution Approach 1:
The patent applies dynamics by implementing an improved differential evolution algorithm that adapts its optimization process dynamically. The algorithm adjusts its search strategy based on the problem characteristics and iteration progress, transitioning from extensive random search to focused local optimization, thereby reducing the number of iterative operations required while maintaining parameter optimization quality
Data Source
AI summary
The disclosure discloses a method for detecting an intrusion in parallel based on an unbalanced data Deep Belief Network, which reads an unbalanced data set DS; under-samples the unbalanced data set using the improved NCR algorithm to reduce the ratio of the majority type samples and make the data distribution of the data set balanced; the improved differential evolution algorithm is used on the distributed memory computing platform Spark to optimize the parameters of the deep belief network model to obtain the optimal model parameters; extract the feature of data of the data set, and then classify the intrusion detection by the weighted nuclear extreme learning machine, and finally train multiple weighted nuclear extreme learning machines of different structures in parallel by multithreading as the base classifier, and establish a multi-classifier intrusion detection model based on adaptive weighted voting for detecting the intrusion in parallel.