Research On Method Of Network Intrusion Detection Based On Machine Learning

Various network attacks bring serious harm to individuals,businesses and the countries.The application of network intrusion detection methods provides the effective measure to protect system.With the development of artificial intelligence technology,the network intrusion detection methods based on machine learning is a focus research work in the network intrusion detection.At present,there are two problems of network intrusion detection methods based on machine learning: the distribution of class in network intrusion detection data is usually imbalanced,which leads to low recall rate of minority attacks for the classifier;in addition,there are redundant and irrelevant features in the network intrusion detection data set,which decreases the accuracy of intrusion detection.In order to solve the problem of low recall rate of minority attacks for network intrusion detection model,a hybrid sampling algorithm based on average classification error rate of samples within a cluster(HSACEC)is proposed.The HSACEC algorithm defines a concept related to the "average classification error rate of samples within a cluster".After the clustering process of each majority class,according to "average classification error rate of samples within a cluster",HSACEC algorithm picks out the representative samples of majority class.The algorithm apply SMOTE(Synthetic Minority Over-sampling Technique)approach to increase the number of samples of minority classes.Moreover,this thesis combines HSACEC algorithm with back propagation(BP)neural network to build a network intrusion detection model.Simulation results show that the network intrusion detection model using the HSACEC algorithm can effectively improve G-mean value and the recall rate of minority attacks.Aiming at the problem that the accuracy of intrusion detection is reduced due to redundant and irrelevant features,an improved LVW(Las Vegas Wrapper)feature selection algorithm based on multiple evaluation criteria for OVO(LVW-MECO)is proposed.Firstly,the accuracy of base classifier is used as evaluation criterion of the feature subset in LVW-MECO algorithm,and the wrapped feature selection is performed on each base classifier in OVO decomposition strategy to find different feature subsets for each base classifier.Then,F1 value of base classifier is used as the evaluation criterion of the feature subset,and the wrapped feature selection is performed on several base classifiers with the lower F1 value,so each of these base classifiers picks out two feature subsets in total.Finally,according to the accuracy of the multi-classifier made up of base classifiers on the verification set,each of these base classifiers selects the best feature subset from the two feature subsets that are picked out by itself.Moreover,this thesis combines LVW-MECO algorithm with BP neural network to build a network intrusion detection model to improve the accuracy of intrusion detection.The simulation results show that the intrusion detection model using the LVW-MECO algorithm can effectively improve the accuracy of intrusion detection,detection rate,and reduce the false alarm rate.