Design And Implementation Of Hardware Algorithm For Decision Tree Classification Based On ZYNQ

At present,with the increasing growth of industrial digital equipment,industrial information security is facing complex and diverse challenges,and it is imperative to strengthen the protection capabilities of intrusion detection systems.The current network protection system will have design flaws,which are related to the detection model using a highly unbalanced data set for training,and there are redundant feature attributes in the dataset,which will lead to wasted performance of the trainer,increased computing overhead,and the current network protection system often does not have application flexibility.Therefore,the feature selection algorithm is used to reduce the dimensionality of the dataset,and the C4.5 decision tree algorithm is optimized based on the gain factor δ and the merged tree,and the hardware design of the decision tree model and the intrusion detection system are built based on ZYNQ.In this paper,the dataset CICIDS-2017 is pre-processed,and the feature selection and sorting method based on information gain is used to achieve dimensionality reduction processing of the dataset,and it is experimentally proved that the subset of features after dimensionality reduction is selected under the premise of ensuring the stable performance of the decision tree model,and the data subset containing 40 features is selected,and the training time is reduced by 44.5% compared with the full feature dataset,and the classification time is reduced by 43.3%,which greatly shortens the training execution time and classification execution time.Due to the unbalanced distribution of the dataset categories,the error of the decision tree model to the minority class is large,and the combination of the gain factor d and the merged tree algorithm is used to construct the decision tree model using C4.5 as the base classifier,which improves the recognition rate of the whole,and the majority class Normal,Dos and Portscan all reach 99.9%;the TPR of the Brute Force type in the minority class reaches99.7%,and the TPR of the Web Attack type reaches 95.8%.Bot-type TPR reached90.2%.Then based on the pipeline technology to achieve the hardware circuit design of the decision tree model,the decision tree classification system was designed,which reduced the classification execution time,and after experimental comparison,the classification execution speed of the hardware model proposed in this paper was 22.4%faster than that of the same type of hardware architecture,which was an order of magnitude faster than the software implementation,and the recognition rate of the overall system for various types of network behavior also met the design requirements.Finally,the intrusion detection system based on ZYNQ is tested by the actual network traffic and can correctly identify the abnormal behavior of the network.