Research On Intrusion Detection Based On Machine Learning

With the continuous development of computer technology,the Internet has occupied an increasingly important position in people's lives,but network security accidents have frequently occurred,and security attacks have been emerging in an endless stream.Traditional security technologies and methods are increasingly stretched.Therefore,as an important technology in network security,intrusion detection technology has received more attention and research.Then,the traditional intrusion detection technology has gradually become powerless in this era of big data.Therefore,in recent years,machine learning technology has been applied to intrusion detection and has become another research hotspot.The two key points of intrusion detection technology are algorithms and data sets.The algorithms are mainly classification algorithms and clustering algorithms.And the excellent data set can help the algorithm to build a better model,so that it can get better detection results.The research in this thesis is based on two aspects of data sets and algorithms.The main work and results are as follows:(1)Aiming at the problem that the original data of the KDD-CUP99 dataset,a commonly used dataset for intrusion detection,is out of date,a more representative dataset among the public datasets at home and abroad is selected for analysis and comparison.An evaluation framework for intrusion detection data,an evaluation method based on three aspects of basic information,statistical characteristics and algorithm efficiency was proposed,and the NSL-KDD data set UNSW-NB15 data set was used for evaluation and comparison.Finally,UNSW-The NB15 dataset was used as the experimental dataset.(2)Combining the maximum mutual information coefficient and the Relief-F algorithm,a MIC-Relief-F feature selection algorithm is proposed to remove the influence of redundant features with high correlation and adjusted the weights for unbalanced data sets to form an effective feature subset and achieve feature dimension reduction.In the experiment,a random forest classifier was used to compare the data set after feature selection using these two algorithms and the original data set.The results show that the MIC-Relief-F algorithm works best.(3)An intrusion detection model based on XGBoost algorithm is proposed.This model combines the MIC-Relief-F algorithm to perform feature selection processing on the UNSW-NB15 dataset;uses grid search and cross-validation method for parameter optimization;compares the results of different loss functions and optimization functions,and uses two-class logistic regression method and root mean square log error function which have better effects;the performance of the model was evaluated through five aspects:accuracy rate,false alarm rate,F1 score,recall rate and AUC.Experiments show that compared with other algorithms,the algorithm model has a good detection effect.