基于特征选择的两级混合入侵检测方法

Two-level hybrid intrusion detection method based on feature selection

为提高入侵检测方法的检测率、降低误报率并提高对未知类型攻击准确率,提出一种以特征选择为基础的混合入侵检测方法。利用fisher分对特征进行降维处理,选择出与类别相关度大的特征子集;为解决样本的多元性问题,引入超图的Helly属性对得到的特征子集进行再次筛选,得到最终的最优特征子集;利用随机森林和改进的K均值(K-Means)聚类作为联合分类器,采用二次检测的方式确定样本所属类别。实验结果表明,该方法有效且可行,为入侵检测提供了可参考的算法模型。

To improve the detection rate of intrusion detection methods,reduce false positives,and improve the accuracy of attacks against unknown types,a two-level hybrid intrusion detection method based on feature selection was proposed.The fisher score based on the filtering mode was used to reduce the dimension,and a feature subset with a large degree of relevance to the category was selected.To solve the problem of sample multivariate,the new feature subset was selected again using the Helly property of the hypergraph to obtain the final optimal feature subset.The random forest and the improved K-Means clustering were used as the joint classifier,and the category of the sample was determined by means of secondary detection.Experimental results show that the proposed method is effective and feasible,and it provides an algorithm model for intrusion detection.