Research On Multi-step Intrusion Detection System Based On Multi-objective Genetic Algorithm

With the rapid development of network technology,the network brings convenience to life,but also spawned many network security incidents.Among the various aspects of resolving network intrusion events,it is critical to detect network intrusions fast and efficiently.Most of the existing research on intrusion detection focuses on the overall attack detection rate,but due to the imbalance of the data set itself,there are a few types of attacks are rare and difficult to distinguish from normal traffic,resulting in the detection of such attacks is very difficult.In this paper,a multi-step intrusion detection system scheme based on the multitarget genetic algorithm NSGA-? is proposed to improve the detection rate of a few types of attacks through five modules: data acquisition,pre-processing,feature selection,training model and evaluation of experimental results.The main work of the paper includes: Firstly,the intrusion detection system collects the network data and preprocessing the data.The discrete features of data are then converted to digital and unithermal coding.After standardizing continuous features,the feature quality is effectively improved,which facilitates the classifier model to screen out more distinguishable features from them.Secondly,this paper adopts a multi-step detection mechanism in the feature selection and training model.In the multi-step detection process,the multi-objective genetic algorithm NSGA-? is used for feature selection,which reduces the effect of feature redundancy or irrelevance and screens out features that contribute more to each type of attack,thus improving the detection rate of a few classes.Lastly,in the experimental evaluation section,this study uses the classic intrusion detection dataset KDD 99 and NSL-KDD to compare the experimental results with random forest classifiers that did not use this system and intrusion detection frontier studies.The paper verifies the feasibility of the proposed method in improving the detection rate of a few types of attacks by using a machine learning algorithm random forest as an example.The detection scheme proposed in this paper is simple in design and implementation,and generalizable in different data sets,which can effectively improve the detection rate of a few types of attacks under the premise of ensuring the overall detection rate,and can provide some reference for practical applications.