Research On Intrusion Detection Method Based On Non-negative Matrix Factorization

With the rapid development of the Internet and big data,a large number of network data have been generated.Intrusion detection is an important technology to ensure network security and protect network resources.It can detect the intrusion behavior violating security policy in network system.Network data are characterized by non-negative and high dimensionality.As an effective dimensionality reduction technique,the Non-negative Matrix Factorization?NMF?method has been successfully applied to intrusion detection.However,with the deepening of research,the traditional NMF technology cannot meet the processing requirements of network data.For example:?1?When the error function of NMF is calculated using the square term,it will increase the sensitivity to noise and outliers;?2?the traditional NMF cannot encode the high-order manifold structure inside the network data;?3?NMF is An unsupervised learning method,which has a high ambiguity of training samples in the classification process.Therefore,when they are used to reduce dimensionality,this will affect subsequent experimental results.This paper proposes three new methods by supplementing and improving the previous studies.And they are successfully applied to intrusion detection.The details are as follows:?1?Aiming at the inherent geometric structure,non-negative and high dimensionality of network data,a hypergraph regularized discriminative non-negative matrix decomposition method based on L_2,1 constraint(L_2,1HDNMF)is proposed.First,the L_2,1 norm instead of the Frobenius norm is applied to the error function,so that the error value of each sample point is no longer squared.Therefore,the robustness of the algorithm is improved.Then,the hypergraph regularization is introduced to consider the high-order geometry of high-dimensional data.Unlike graph regularization,which only captures the relationship between pairs of sample points,it captures the relationship between multiple sample points.Introducing the category label into the objective function,L_2,1HDNMF becomes a supervised learning model.This can improve the discriminative power of the algorithm.?2?Aiming at the inevitable problem of non-Gaussian noise and outliers in network data,a hypergraph regularized discriminative non-negative matrix decomposition method based on Huber?Huber-HDNMF?is proposed.The original NMF's error function uses the Frobenius norm to model noise that obeys Gaussian distribution.The original NMF's error function uses the Frobenius norm to model noise that obeys Gaussian distribution.Therefore,the Huber loss function between the L₁ norm and the L₂ norm is used to calculate the error.This will reduce the impact of non-Gaussian noise and outliers on the experimental results in the network data,thereby further improving the robustness of the algorithm.At the same time,to improve the performance of the algorithm,hypergraph regularization and discriminant information constraints are also imposed in the objective function.?3?Aiming at the problem that NMF-based method is sensitive to noise?Gaussian noise,non-Gaussian noise?and outliers by using European norm constraints,a hypergraph regularized discriminative non-negative matrix decomposition method based on correntropy?CHDNMF?is proposed.As a nonlinear local similarity measure,the correntropy represents the similarity probability of two random variables.Unlike the European norm,which only considers the second moment of the data,the correntropy can capture the higher moments.Therefore,applying the correntropy to the loss term of CHDNMF will maximize the robustness of the algorithm.In addition,the hypergraph regularization term and discriminant information are introduced into the objective function,so that the algorithm obtains satisfactory dimensionality reduction results.This paper first uses the above NMF-based improved methods to reduce the dimensionality of the network dataset NSL-KDD,which will retain important features.Then the Extreme Learning Machine?ELM?is used for classification.The experimental results show that the proposed methods are superior to other similar methods and have better classification performance.