AdaBoost算法在网络入侵检测中的实验研究

ON EXPERIMENTING ADABOOST ALGORITHM IN NETWORK INTRUSION DETECTION

提高入侵检测系统的检测率并降低误报率是一个重要的研究课题。在对稀有类分类问题研究的基础上,将集成学习应用到入侵检测中,采用对高速网络数据进行分流的检测模型,把网络数据包按照协议类型进行分类,然后交给各个检测器,每个检测器以C4.5分类器作为弱分类器,用集成学习AdaBoost算法构造一个加强的总检测函数。进一步用SMOTE技术合成稀有类,在KDD‘99数据集上进行了仿真实验,结果表明这种方法可有效提高稀有类的检测率。

It is an important research topic to improve detection rate and reduce false alarm rate in the field of intrusion detection.Basing on in-depth research on rare classes classification and applying ensemble learning to intrusion detection,we utilise the detection model which splits data stream in high speed network to classify the network data packets according to their protocol types,and then forward them to each detector.Each detector takes C4.5 classifier as the weak classifier and forms an enhanced general detection function by ensemble learning AdaBoost algorithm.We also further compose rare classes with the SMOTE technique,and make simulation experiments on KDD‘99 dataset.Experiment results indicate that this method can effectively improve the detection rate of rare classes.