Research And Implementation Of Intrusion Detection System Based On Ensemble Learning

The scope of network security problems brought about by the rapid development of Internet technology has gradually expanded.While people enjoy the convenience brought by the Internet,they have to pay attention to and find ways to solve the unpredictable problems caused by network attacks.harm.Firewalls based on packet filtering technology have long been unable to deal with various attacks that appear in the network,and intrusion detection systems,as the second barrier to protect computer network security,have gradually attracted the attention of scholars.After years of research by researchers,network intrusion detection has been used to enhance the security of computer networks.At the same time,many cutting-edge technologies have been introduced,such as machine learning and neural networks,which have not only strengthened the reliability of intrusion detection systems,Can also improve the speed of network intrusion detection.In addition to network devices such as servers,routers,and switches,many smart devices are gradually appearing,such as Internet TVs and smart phones,which have been connected to the network.The entire network architecture is becoming more and more complex and more and more vulnerable to loopholes.And it is invaded by hackers or viruses.In the current severe situation of frequent network intrusions,we need to use machine learning technology to improve the efficiency of detecting intrusive traffic.Traditional classification models are often single models,and their classification capabilities have certain limitations.There are also differences between various weak classifiers,and the classification results are often biased.This limitation can be solved by ensemble learning.Integrated learning is committed to integrating multiple single models to generate a better learner,which can get a more reasonable boundary,reduce the overall error rate,and achieve better results.The advantage of ensemble learning is that it can improve the comprehensiveness of the model,eliminate the bias of a single weak classifier,and can effectively improve the performance of the model.This paper mainly does the following work:(1)Using the publicly available KDD-CUP99 data set in the field of intrusion detection,the data set is first preprocessed,including the conversion of non-numerical features and the normalization of values.(2)The original features,the features selected by the genetic algorithm,and the features selected by the simulated annealing algorithm are used to model on the three integrated learning algorithms of Adaboost,XGBoost and Cat Boost.The experiment proves that the feature selection algorithm can improve the performance of the model.(3)Choose the best feature selection strategy among the three ensemble algorithms,and use the Stacking idea to perform model fusion on logistic regression,support vector machines and k nearest neighbors.Experiments prove that Stacking integration can improve model performance.(4)On the basis of the above three fusion models,the relative majority voting method was adopted for the second fusion.The experiment proves the effectiveness of the dual fusion strategy proposed in this paper.(5)Using Wireshark packet capture tool and torshanmmer test tool to achieve data collection,using Vue and Spring boot framework to achieve the front and back ends,and using jpython to call the python prediction model,and developed an intrusion detection system.