Fusion Method Of Neural Network-based Intrusion Detection System

As a kind of active defense technology, intrusion detection technology detects sorts of malicious attacks in time and responds when the net system is endangered. It is an effective supplement to traditional security technology. Nowadays, intrusion detection technology has become the major concern of network security field.Intrusion detection technology can be divided into two categories, misuse detection and anomaly detection respectively. Artificial neural network has been applied to intrusion detection , working as a kind of anomaly detection technology. With the good ability of self-learning and memory, artificial neural network can recognize not only known attacks, but also unknown attacks . It makes the intrusion detection develop in the direction of intelligent.This thesis relates to the standard back-propagation algorithm used to train MLP ,in order to improve its performance such as convergence, generalization ,we study the improved BP algorithm. This thesis used the back-propagation algorithm with momentum to train the MLP and received better experimental result.In order to improve the generalization and stability of artificial neural network further, This thesis studies the fusion method based on theories such as winner-take-all, bayesian theory, D-S evidence theory and the neural network theory, analyzes their advantages and disadvantages. This thesis improved the model of ensemble learning by adopting the method based on neural network which decides the weight of each classifier dynamically. We proposed a second-level decision model which uses complete-voting fusion method and the neural network fusion method .First we use three neural networks which trains by three different kinds of features, then we use complete-voting fusion method to give preliminary result, if the result is not certain, we use the neural network fusion method to give the final result. Through the experiment, we proved it has better result.Lastly, we design the frame of the snort with the function of anomaly detection based on neural network multiple classifiers and realize some of its function., unifying the anomaly detection and misuse detection well.