Research On Intrusion Detection Method Based On Isolation Forest

With the development of Internet technology,the network has entered millions of households,so the problem of network security has become increasingly prominent.Intrusion detection technology can be used to identify intrusion behaviors and thus provide early warning of network security issues.However,there are massive data,high-dimensional data and uncertain data in the network,which lead to a large number of false positives and low detection rate.How to effectively detect intrusion,improve detection rate and reduce false alarm rate is one of the important issues in the field of network security.In order to improve the security of the network,this paper introduces the theory of isolation forest algorithm,and improves the algorithm.The main work is as follows:(1)When using the isolation forest algorithm to detect,the features of the data set in the network are more complex and the dimensions are higher,which leads to low detection accuracy.To solve this problem,this paper proposes a heuristic rough set reduction algorithm based on similarity.The algorithm mainly uses the attribute reduction theory of rough set to calculate the similarity according to the distance between different decision classes and the distance between the objects in the decision classes,so as to select a better feature subset and achieve the purpose of dimension reduction.In this paper,experiments are carried out on the feature subset and the original set,and the accuracy is taken as the evaluation standard.The experimental results show that the heuristic rough set reduction algorithm based on similarity improves the detection accuracy.(2)To solve the problems of low detection rate and low stability of isolation forest algorithm,this paper proposes a semi supervised model based on a small amount of label data,which is improved from two aspects: optimization of isolation forest algorithm and semi supervised clustering.Firstly,in the training phase of the isolation forest algorithm,the segmentation value of attributes is randomly selected,which leads to the low stability of the algorithm.To solve this problem,this paper uses the separability index to select the appropriate segmentation value to improve the stability of the algorithm.Secondly,when the training data set has a small amount of label data,combined with fuzzy c-means clustering algorithm and isolation forest algorithm,the training detection model can still ensure a high detection rate.This paper compares the proposed model with other methods in terms of stability,detection rate and false alarm rate.The experimental results show that the proposed model has advantages in stability,detection rate and false alarm rate.