结合主动学习和半监督学习的网络入侵检测算法

Network Intrusion Detection Algorithm Based on Active Learning and Semi-supervised Learning

为提高网络入侵检测的分类效率,提出一种结合主动学习和半监督学习的入侵检测算法。结合入侵检测实际,对主动学习算法进行简化,用有标记样本训练生成2个分类器,实现对未标记样本的预测;将2个分类器预测不一致的未标记样本作为信息量丰富的样本,使用半监督学习算法进行标记;最后,把新增加的新标记样本添加到主动学习和半监督学习的训练集中,训练各自分类器,反复迭代直到未标记样本集为空,并用最新的有标记样本集训练形成最终的分类器。使用KDD CUP 99数据集进行入侵检测实验,其结果表明,与SVM方法相比,其分类率提高了4.3%,且较好地缩减了问题规模。

In order to improve the classification performance of network intrusion detection,a kind of intrusion detection algorithm is proposed based on active learning and semi-supervised. The active learning algorithm was simplified,and two classifiers were trained with labeled samples to predict the unlabeled sample. The unlabeled samples that were predicted differently by the two classifiers were considered as rich information samples,and were labeled using a semi-supervised learning algorithm and were added to the training set of active learning and semi supervised learning to train classifier. The iteration was repeated until the unlabeled set was empty. The final classifier was trained and generated by the newest labeled training set. The experiment was carried out on KDD CUP 99 data set.The results show that the classification rate increased by 4. 3% and the problem scale was reduced greatly.