Research On Intrusion Detection Algorithm Based On Network Log

With the rapid development of communication and Internet technologies,wireless network technology has been widely used for its low cost and mobility advantages.But compared with the wired networks,the wireless networks are more vulnerable to cyber attacks on valuable and concealed information.This defect causes more and more cyber crimes to be committed through the wireless networks.Therefore,an intrusion detection system that can effectively detect cyber attacks in real time is indispensable to improve the wireless network security.When processing massive intrusion data on the wireless networks,machine learning is often employed to do simple feature extraction and selection in traditional algorithm feature learning,which leads to failures of characterizing some specific attack types with the extracted features.On the contrary,the neural networks exhibit excellent performance in feature extraction and classification.More and more neural networks with different structures are being applied to intrusion detection.However,most neural networks are trained by a back-propagation algorithm which causes problems such as local minimum.The drawbacks of traditional machine learning and back-propagation algorithm will cause problems such as a high false positive rate in detecting attacks and low accuracy in detecting specific attack types.This thesis proposes improvements to these deficiencies.The specific work is as follows:(1)Studying the shortcomings of traditional feature learning algorithms and then proposing two-level feature learning algorithms based on SSAE and SVM-RFE.The algorithm consists of two layers.The first layer is the feature extraction based on deep learning.New features are extracted at deeper level through a stacked sparse autoencoder.The second layer is the weighted selection of the original and newly extracted features by SVM-RFE.Compared with traditional feature learning algorithms,this new algorithm can produce features that are more conducive to the classification of intrusion detection.(2)Using the neural network as a classifier for the intrusion detection model,which will make the model more scalable and reduce the false alarm rate effectively.However,neural networks have issues such as easily falling into local optimum when back-propagating training parameters.To overcome this problem,we propose a hybrid algorithm of the artificial bee colony algorithm and the monarch butterfly algorithm in local and global search respectively to increase the diversity of search and optimize the neural network training process.Experimental results show that this algorithm has better performance than the intrusion detection algorithms that seperately use the artificial bee colony,the monarch butterfly,and the evolutionary algorithm optimized classifiers of neural network.(3)Combining the two-layer feature learning algorithm and the optimized neural network classifier of the hybrid algorithm proposed in this thesis to form a novel intrusion detection model.The two-layer feature learning module is responsible for descending the dimensions of the features,reducing the redundant features,and selecting a subset of the features related to the output.The optimized neural network classifier of the hybrid algorithm are used as classification modules to classify attacks.The experimental results show that the model proposed in this paper can improve the accuracy of intrusion detection and has distinct advantages in detecting the flooding attacks.