Research On Intrusion Detection Based On Clustering And Neural Network

With the frequently occurrence of network security incidents,both the academic and industrial circles pay more and more attention to the field of network security,and one of the important parts of maintaining network security is intrusion detection and identification.An excellent intrusion detection system can help users identify attacks and resist intrusion.Therefore,researches about intrusion detection are numerous in recent years.Due to a large amount of intrusion detection dataset samples and unbalanced distribution of dataset,the traditional neural network and deep learning methods cannot achieve good prediction results,besides,the low proportion of data sets is difficult to be identified.In order to address all of the above issues,this academic thesis studies the intrusion detection model based on clustering and neural network.The cluster methods are used to generate different subsets for intrusion detection data,which reduces the size and complexity of data sets.Then,different sub-neural networks are used to train clustering subsets.For samples of low frequency type,targeted strategies are designed,which not only improves the learning efficiency of neural network,but also improves the recognition rate of samples in low frequency type.The main contributions of this dissertation are as follows:(1)Because of the characteristics of large amount of intrusion detection data and unbalanced data distribution,an enhanced interval type-2 fuzzy c-means clustering algorithm is formed for intrusion detection data,and realizes the division of intrusion detection data by determining the optimal fuzzy index.Then,the neural network is used to generate the classification model corresponding to the subset.In order to detect unknown intrusion detection data,some partition criteria are designed,and the trained neural network model is used to classify and predict the partition set.The experimental results show that the method is better than the method of comparative experiment.(2)Aiming at the problem that unsupervised clustering is easy to fall into local optimum,and in order to make full use of the label information of known data sets,the supervision information of training data is introduced into the clustering method,and then an intrusion detection model based on semi-supervised clustering and deep neural networks is proposed.The model randomly selects some samples of high-frequency type in the training set as the supervision information of the training set,and then takes the training samples close to the clustering center and the samples of low-frequency type as the supervision information of the testing set,so as to avoid the clustering results biased to the samples of high-frequency type.At the same time,in order to better express the attribute features,the 5-layer deep neural network is used to train the subsets.It is verified by experiments that the model has achieved satisfactory results in the prediction of low-frequency samples.(3)The fuzzy feature mapping method is more interpretable than the traditional feature mapping method,and is more suitable for the modeling of uncertain problems.Based on this,fuzzy feature mapping is applied to intrusion detection data sets,and an intrusion detection model is formed by fusing fuzzy feature mapping and width learning.In the preprocessing stage,the original features are mapped into the high-dimensional subspace through the fuzzy feature mapping method.Because the feature dimension after mapping is too high,the dimension reduction method is considered into the model.Next,the semi supervised clustering is used to form subsets of the reduced data,and the incremental broad learning system is used to train the classifier and recognize the data type.After several indicators comparison,we can conclude that the model not only achieves effective results,but also has the advantage of shorter network training time.