A Multi-fold Self-correction Small-Sample Classifier For Intrusion Detection

Intrusion detection is very important for network security,as an active security technology to ensure network security.However,with the continuous development of the Internet,traditional means are often unable to meet the growing new needs,such as it is difficult to find potential new network attacks,and it is difficult to prevent the internal network attacks,etc.in the face of the huge demand for real-time network data flow detection,it is even more limited.With the introduction of various machine learning algorithms into the construction of intrusion detection system,intrusion detection system has made great progress,but the unbalanced or confusing training samples,real-time network traffic detection problems often lead to poor performance of traditional intrusion detection algorithm.For this reason,this paper studies the problem of poor learning efficiency of unbalanced data sets in intrusion detection,and proposes a multi-fold self-correction small-sample classifier for intrusion detection.It mainly includes the following contents:1)Aiming at the time efficiency of network traffic detection in intrusion detection field,this paper constructs intrusion detection model based on orthogonal projection classification algorithm.Compared with the traditional machine learning algorithm,this method can not only ensure the high classification accuracy,but also improve the operation efficiency,shorten the modeling time and realize the efficient processing of network traffic detection.2)Aiming at the problem of sample imbalance in intrusion detection and other fields,this model combines random oversampling and error division and correction strategy to improve the learning efficiency of the classification model for small samples in unbalanced data sets.On the one hand,the self-correction strategy balances the training samples of different categories,makes them in the same order of magnitude,and reduces the algorithm over fitting caused by the large number of classification categories;on the other hand,after separating the attack categories with insufficient single features,it improves the specificity of their features.3)In this paper,a multi-fold self-correction small-sample classifier for intrusion detection is proposed.Based on the research of orthogonal projection classification algorithm,this model combines the Bagging algorithm and error correction strategy to realize intrusion detection.In the construction of the model,the first layer of the initial classifier is constructed by using the training set of the intrusion detection data set through the classification method based on dimension reduction algorithm,and the samples to be tested are roughly divided;then based on the support vector machine and random forest algorithm constructs cascaded classifier groups of the second and third layers,each layer gradually corrects the front layer and subdivides it,and finally merges the classification results.The ensemble algorithm effectively improves the generalization ability of the model and the detection ability of unknown attack types.Experiments based on the intrusion detection open source data set NSL-KDD verify the validity of this model.The experimental results show that this method significantly improves the learning efficiency of some small samples.Compared with other algorithms,the detection method in this paper improves the accuracy of small samples and the overall accuracy.