Research On Intrusion Detection Based On Feature Fusion And Improved Quantile Random Forest

Nowadays,with the continuous development of network technology,the security threats to the network environment are increasing.Network intrusion detection defends against various attacks in cyberspace by analyzing the characteristics of data flow in the network,and has relatively high requirements for real-time and recall rate.It is of great importance to study intrusion detection techniques to maintain the security of cyberspace.This thesis proposes two models for imbalanced data classification,and the main work is as follows:(1)To address the problem that the performance of quantile random forest in imbalanced multi-classification is severely degraded for relatively majority class detection,an improved quantile random forest classification model(IRFQ)is proposed with the goal of balancing the attention of quantile random forest to each class.The proportion of each class of data to the total data is counted in the training phase,and then the probability values of each class obtained from the random forest are calculated in the voting phase,and the data features are finally classified into the class with the largest ratio according to the ratio of the latter to the former.The improved algorithm has a balanced and good recognition performance for each imbalance class on the intrusion detection domain.(2)To address the problem of detection difficulties caused by complex feature relationships in highly imbalanced datasets,a classification model combining feature fusion with improved quantile random forest(IRFQ-FF)is proposed.The model uses a sliding window to segment the original feature set,inputs the generated feature subset into the random forest,and then splices the obtained class probability vectors as new features into the original feature set.Finally,the input of the obtained new dataset into IRFQ produces the classification results.IRFQ-FF does not use the cascaded random forest structure in deep forest,but uses the two-layer structure of the general Stacking algorithm,which has faster detection efficiency.(3)The proposed IRFQ and IRFQ-FF are experimentally evaluated based on UNSW-NB15,CIC-IDS2017 and CES-CIC-IDS2018 intrusion detection datasets.The results show that compared to the RUSBoost,BRF,AdaBoost,and DF models,IRFQ has the best detection recall,G-mean,and AUC metrics on the CIC-IDS2017 intrusion detection dataset,while IRFQ-FF has the best detection recall,G mean as well as AUC metrics were optimal.