Intrusion Detection Schemes Based On Sustainable Ensemble Learning

With the rapid development of network-based computing services and applications,the Internet faces more and more security threats.Therefore,intrusion detection systems are particularly important as an important part of deep defense of network security.Intrusion detection systems detect and identify intrusion behavior in the system by detecting and analyzing network traffic or host behavior.In order to detect abnormal behavior under large-scale data traffic,machine learning-based intrusion detection systems have become the hotspot of current research.Such methods use machine learning technology to extract features in a large amount of data and establish a classification model for labeled data sets,implement classification of network traffic or host behavior to detect intrusion behavior in the system.Through the analysis of the research status,this paper finds and summarizes two problems still existing in the field of intrusion detection,and proposes two intrusion detection schemes based on ensemble learning.Therefore,the main research work of this paper includes:(1)It is found that there are still two problems in the current research.1)The existing ensemble learning scheme does not consider the different sensitivity of the detection model to different attack types,which leads to the low accuracy of the detection model.At the same time,the existing ensemble learning model is updated without considering the accumulation and transmission of data knowledge,which leads to poor stability;2)Existing intrusion detection schemes are based on assumptions with adequately labeled or unlabeled training data sets,but such assumptions are difficult to establish in the face of new network environments.(2)In view of the shortcomings of current ensemble learning,an intrusion detection scheme based on sustainable ensemble learning is designed.In the model establishment stage,each classifier weights the classification confidence and class probability of each category,and establishes the regression model of each category to automatically assign the decision weights of the individual classifiers.In the model update stage,the historical model is adopted and the parameters are passed to the new model,as pre-training.The test results of the historical model are added to the training process of the new model to complete the accumulation and transfer of knowledge in the process of model update.Experiment results show that compared with existing models,the proposed model has an obvious advantage in terms of detection accuracy,false alarm rate,stability and robustness.(3)In view of the difficulty in constructing the intrusion detection model caused by the lack of training data,we draw on the transfer learning method and propose an intrusion detection model based on ensemble transfer learning.Firstly,two hypotheses are proposed,which only use a small amount of labeled data and a small amount of unlabeled data.The detection model establishment based on transfer learning and improved transfer learning is designed for the two hypotheses.The differences in traffic characteristics under different attack types in the network are analyzed and verified,and the experiment results of the proposed scheme and the traditional scheme are compared comprehensively.It is verified that the proposed scheme is proved to have a higher detection accuracy,since it can still be effective when using just a small amount of data to update the model.