Research Of Intrusion Detection Model Based On Semi-Supervised Learning

The Internet brings convenience to the user, but at the same time, there are alsoserious security issues of its own. So, how to ensure the information stored on it is notstolen, tampered and destructed, has become a major issue, and has great significancefor the protection of economic and national security. In this circumstance, intrusiondetection as one of the important network security technologies develops rapidly. Itcollects system information, analysis the invasion from external and internal net, andresponds to them, to deal with the growing network threats.Semi-supervised learning based intrusion detection systems can use a large numberof unlabeled samples to help the classifier learning. Therefore, in the circumstance oftag data is usually more difficult to obtain, the semi-supervised learning-based intrusiondetection technology not only can achieve a higher performance with less cost, but alsocan make up the defects of supervised learning-based and unsupervised learning-basedsystem. This paper introduces the theory of intrusion detection, analysis andsummarizes the characteristics, classification and commonly used algorithms ofsemi-supervised learning and uses it to intrusion detection. Based on semi-supervisedlearning theory, we present a cooperation training model combining TSVM(Transductive Support Vector Machine) with SKM (Sequential K-Means), to improvethe speed and accuracy of the detection. By setting the feedback mechanism, the modelcan have a ability of self-learning, being able to adapt to the system and user behaviorchanges, and data flow control mechanism allows the system can continuously tonormal operation in the stage of feedback training of the support vector machines. Asthe feedback data comes from the consistent results of the two classifiers, the accuracyof re-training will be reduced if the feedback data is noise data. In this paper we detailedanalysis the factor that how reducing the noise data introduction can reduce the impactto the feedback training, and the redundancy issue of the sample library and principalcomponent analysis are also studied. Finally, we use10Percent subset of KDD’99datafor the training, Corrected subset (marked) as the test data, to test the performance and generalization ability of the model. Through the experiment, we can see the model has ahigh detection accuracy and strong adaptability.