Research And Application For Intrusion Detection Based On Semi-supervised Learning

With the rapid development of network technology, network security events emerge event after another, intrusion detection technology has become the research hot spot of network security field as a proactive security technology.Intrusion detection research is an important problem on how to deal with vast amounts of network data and audit data effectively. In anomaly intrusion detection systems, which need the data be divided into normal data and abnormal data, and this is actually a binary classification problem. Traditional intrusion detection algorithm is based on supervised learning and non-supervised learning, these two algorithms have some limitations, in a supervised learning process, which can not use a lot of unlabeled data; in non-supervised learning, which will often result in high false alarm rate. Based on these, we propose a semi-supervised learning based on detection algorithm.SVM is an effective binary machine learning device, this paper combine semi-supervised strategy and SVM to design the algorithm. According to the characteristic of network data, it is marked a small amount of data, and to use labeled data to train the classifier and the initial secondary classifier, the unlabeled data set is extended by labeled data set and to optimize classifier to improve classification performance. Because of the network data for normal data and abnormal data in the imbalance, it uses the weighted SVM algorithm, and different kernel functions are used to differentiate classifier. To improve the algorithm performance, this article uses SVM for the data reduction processing, thereby reduces the learning cost.Finally, this paper presents a semi-supervised learning which based on intrusion detection model, and uses KDD cup99 data set to assess the algorithm, and adjusts unlabeled experimental data on the data set by the ratio of total,it is confirmed using unlabeled data can effectively improve the classification performance and reduce the false alarm rate by L-SVM, T1-SVM, T2-SVM algorithm.