| With the progress of the times and the development of science and technology,network security has increasingly become the focus of attention.In recent,network attacks are large in scale,many in type,and fast changing.Network security issues continue to rise.Therefore,in the era of big data,how to identify abnormal behavior from the massive network traffic is the focus of current research.This paper proposes an intrusion detection system based on auto-encoder to solve these problems.Firstly,the network features are extracted from the massive network traffic and preprocessed to provide better data for the subsequent modules.Secondly,the data preprocessed by the random forest algorithm is selected to get the best feature.Thirdly,according to the sparsity of the data,the best features are divided into the sparse matrix and dense matrix.Some samples are selected from the normal samples of the sparse matrix and dense matrix,and the AP clustering algorithm is used to calculate the feature similarity.Features are divided into several feature groups.Finally,we build models with the normal samples in the sparse matrix and dense matrix,respectively.The normal samples are trained based on the auto-encoder to calculate the abnormal scores.K-means or GMM are used to classify the abnormal scores.Finally,the function and performance test of the proposed method is carried out through experiments to verify the credibility and feasibility of the system.The experimental results show that this method processes the training set through feature selection and feature grouping,which greatly reduces the learning time.The method based on auto-encoder effectively improves the prediction accuracy of attack detection.Compared with the traditional intrusion detection method,it has the advantages of convenient training,wide adaptability,and high detection accuracy. |
