基于半监督集成学习的自适应入侵检测研究

Research on Self-adaptive Intrusion Detection Based on Semi-supervised Ensemble Learning

在网络入侵检测中,网络攻击新方法层出不穷,传统基于块数据的集成学习算法由于无法收集完备的训练集,导致入侵检测系统无法识别新的攻击行为。为此,提出基于半监督集成学习算法,把半监督学习思想引入到集成学习中,使得分类模型可以动态更新,从而使入侵检测模型具有自适应性,提高对未知攻击行为的识别率。通过在NSL-KDD数据集上进行仿真试验,结果表明算法可以提高检测准确率,尤其是对未知的入侵行为的识别率有所提高。

In network intrusion detection,new methods of network attack emerge one after another.The traditional ensemble learning based on block data can not collect complete training set,so that the intruded detection system can not recognize new attack behavior.For this reason,it was proposed that,based on semi-supervised ensemble learning,semi-supervised learning idea was introduced into ensemble learning so that the classification model could be updated dynamically and the intrusion detection model might become self-adaptive,thus raising the recognition rate of unknown attack.Results of simulation experiments made on NSL-KDD dataset indicated that the proposed algorithm could improve detection accuracy rate,especially the recognition rate of unknown intrusion behavior.