Research On Intrusion Detection Of Random Forest

Intrusion detection technology is an important part of network security.It collects and analyzes various information on the network to detect various intrusions,which is the key to maintaining network security.With the popularity of the network and the increase of the network speed,the number of network attack behaviors is increasing,the attack method is constantly updated,and the traditional intelligent detection technologies is difficult to achieve the desired results.Aiming at the shortcomings of the existing deep learning-based intrusion detection algorithm models such as long training time,a large number of hyper-parameters and large data demands,an intrusion detection algorithm based on Ensemble Deep Forests(EDF)is proposed.The algorithm first uses Principal Component Analysis(PCA),character data conversion method and normalization algorithm to preprocess the data with feature selection and feature transformation.And then,the forest layers complies with the strategy of Convolutional Neural Network(CNN)hidden layer structure and bagging integration in Ensemble Learning is constructed.The strategy constructs multiple forest layers,inputs the randomly selected feature training for the deep forest model in each layer,and then passes the output class vectors and feature vectors to the lower layer and iterates,and continues training until the model converges or reaches the termination condition,and finally some experiments with the NSL-KDD dataset is designed to compare the performance of the EDF and CNN intrusion detection algorithms.The experimental results show that the convergence speed of EDF algorithm is more than 50% higher than that of CNN,and the classification accuracy is almost the same,which indicates that EDF intrusion detection algorithm is a highly efficient and feasible algorithm,which improves the performance of intrusion detection algorithm.In order to further extract useful features and improve detection rate,EDF was improved by Multi-Grained Scanning in the preprocess phase to obtain an intrusion detection method of Multi-Grained Scanning Cascade Forest(GCForest).Multi-Grained Scanning is added between the PCA and the EDF to scan the data using multiple different size windows,extracting more subtle and relevant data features,and then inputting the data into the Random Forest(RF)and the complete random tree forest constitute a probability extraction layer,and the obtained prediction probability vector is used as an enhanced feature,and is spliced as input data of EDF.The experimental results show that the improved method can improve the detection rate by about 7% compared with EDF,and the detection rate reaches 86.15%.It gets the highest detection rate in the comparison of some novel algorithms.Aiming at the defect that the distribution of multiple categories of data in the data set is uneven and the model has poor classification performance on small-scale samples,this paper introduces a dynamic lifting strategy and a multi-layer classification model to optimize the random forest model.The first part uses the principle of multi-layer classification and considers small-scale sample sets as superclasses.First,the superclasses and large-scale samples are classified,and then the sample types within the superclasses are classified.Then,the multilayer classification strategy is introduced into random forest.A multi-layer classification model based on random forest is proposed,and experiments are designed to verify its performance.Preliminary experimental results show that the model can improve the detection rate of smallscale samples.Then a dynamic promotion strategy is introduced,and the sample is segmented according to different sample classification strategies in each layer.A segmentation strategy is designed for different situations whether the decision tree is completely grown,and the decision tree in a random forest is selected.According to the dynamic lifting strategy,a model of random forest intrusion detection algorithm based on dynamic lifting is proposed,and experiments are designed to evaluate the performance of the model.Experimental results show that the model can improve the situation of uneven sample distribution.Under the same conditions,the detection rate of small sample categories has increased by more than 20%.