Research On Network Intrusion Detection Algorithm Based On Manifold Learning And Auto-encoding

With the development and popularization of the internet,there are many network security problems appearing.In daily life,work and study,the internet helps people a lot.It is particularly important that network intrusion detection deals with tens of thousands of network traffic.Intrusion detection can model,analyze and detect the traffic data captured in the network,so as to find known or unknown abnormal network behaviors.In this research,a novel network intrusion detection clustering algorithm based on manifold learning and auto-encoding is proposed.The traditional clustering algorithms of network intrusion deal with the original feature matrix,without using the depth features and the manifold information.The focus of this research is how to effectively learn the manifold structure and the depth features of the data to improve the performance of the algorithm.Therefore,we propose a network intrusion detection algorithm based on Manifold Learning and Auto-Encoding(MLAE).Firstly,we preprocess the original network intrusion data and obtain the feature matrix containing the manifold structure information by manifold approximation and projection.Then,the feature matrix is extracted by auto-encoding between original data and manifold structure data.Finally,we present some clustering analysis of this feature matrix.The main work of this research is as follows:(1)By analyzing the traditional intrusion detection technology,a clustering algorithm is proposed to guide the auto-encoder learning by way of the manifold approximation projection method.Generally speaking,there are many problems in the intrusion detection data sets,such as data redundancy,feature redundancy,and dimension explosion.MLAE algorithm maps original data to a low-dimensional space through the manifold learning method,and then guides auto-encoding learning to acquire the feature matrix containing the manifold structure information and data information.Finally,abnormal network behavior is detected by a clustering algorithm.(2)Our study selects NSL-KDD data set and detailed analysis is presented.It has a greater change than KDDCup 1999,for example,NSL-KDD data set removes a lot of redundant network traffic data,and the proportion of intrusion data and normal data is relatively balanced,so,it is common that NSL-KDD is used as benchmark data set for network intrusion detection.The NSL-KDD contains not only numeric data butalso a variety of character data.Before using,the original data needs to be preprocessed to convert character data into numeric data so that it can be processed by the computer.At the same time,features need to be normalized to reduce the impact of different dimensions.(3)The performance of MLAE algorithm is presented by many experiments.In order to verify and analyze the effectiveness of the MLAE algorithm,this subject selects four clustering evaluation indexes(ACC,NMI,ARI,and F1).Experimental results show that the MLAE algorithm is superior to a single clustering algorithm in multiple clustering evaluation indexes.