Research On Data Processing And Detection Algorithms Of Intrusion Detection System

Intrusion detection is a proactive information security technology that can detect malicious behavior from a large amount of network data.Due to the mass of network data,efficient intrusion detection algorithms and systems can usually be divided into two steps,first step is network data preprocessing to achieve data cleaning,Save valid data in the dataset while reducing the data size;the next step is the network data classification,which distinguish between normal data and intrusion data.This thesis has carried on the related research to the preprocessing and the detection,the innovation work of this thesis mainly has three points:(1)This thesis applies non-negative matrix factorization(NMF)algorithm to the data's dimension reduction intrusion detection.The non-negative matrix factorization algorithm has excellent performance in large-scale data processing and analysis and is widely used in image and word processing.Because all elements of decomposition matrix obtained by non-negative matrix factorization algorithm are non-negative,this kind of thinking is of great significance in the field of intelligent data processing and pattern recognition.This thesis applies the non-negative matrix factorization algorithm to the dimension reduction of intrusion detection data for the first time and obtains a better dimension reduction effect.(2)The traditional non-negative matrix factorization(NMF)algorithm has some problems such as difficulty in selecting K values and long optimization time caused by the random initial matrix.In this thesis,principal component analysis(PCA)and NMF algorithm are combined,make the dimension reduction matrix of PCA algorithm to be the NMF algorithm initialization matrix,then achieve iterative optimization.The improved NMF algorithm can not only set the reasonable K value of the NMF algorithm through the information entropy threshold of the PCA algorithm,but also reduce the iterative time and improve the classification accuracy of the subsequent data classification algorithm.(3)In the case of only a small amount of labeled samples,how to better train the classifier is an important issue in the field of intrusion detection.In this paper,the improvement of the traditional tri-training model is proposed.The new parameter objection rate p is used to represent the confidence of the marked samples.The influence of the introduced noise data is taken into consideration in the learner training process,the confidence of training samples is increased,achieved better training results with fewer iterations.Simulation results show that the improved SVM-based tri-training model can achieve higher intrusion detection rate with fewer iterations,and the detection rate is 0.11%higher than the traditional tri-training model.