Synchronous Feature Selection Optimization Intrusion Detection Based On Seagull Optimization Algorithm

With the rapid development of the Internet and network information technology,various network applications emerge in an endless stream.While bringing convenience to people’s lives,a series of network security problems also appear.Therefore,network intrusion detection has become more and more important.It is difficult to judge new attack behavior,and the false positive rate is high,so it is often difficult to deal with complex and changeable attack behavior.Machine learning algorithm can quickly process a large number of data without manual rules and can learn rules from it adaptively,which is easier to implement than deep learning.Support vector Machine(SVM)has a good classification effect for nonlinear and high-dimensional data.In addition,the optimization problem is relatively simple and has good robustness.A better performance intrusion detection model is built,which can analyze the characteristics of network traffic to identify the attack behavior.Due to its strong global search ability and fast search speed,Seagull optimization algorithm(SOA)can quickly find the global optimal solution in multidimensional space,which is suitable for the optimization of intrusion detection model.Considering that the intrusion detection model needs to detect a large number of redundant and complex data,which will increase the detection time and lead to slightly lower detection accuracy,and the accuracy of classification is also affected by SVM parameters,this paper first proposed an improved seagull optimization algorithm after combining the advantages of SOA and SVM.Then,a more optimal feature subset is selected based on the feature selection method of weight mapping,and an intrusion detection model(HSOA-S VM)is constructed using the improved Seagull optimization algorithm for synchronous feature selection and SVM parameter optimization,so as to improve the performance of intrusion detection.The main work of this paper is as follows:(1)An improved gull optimization algorithm based on hybrid strategy is proposed.When dealing with iterative optimization,the original seagull optimization algorithm is prone to fall into local optimal and the convergence rate is too slow.In order to solve these problems,the following improvements are made to the Seagull optimization algorithm.Firstly,in the process of population initialization,Cubic mixing degree mapping combined with elite reverse learning is adopted to initialize the population due to the low population diversity of the original algorithm in the iterative process,so as to obtain the initial seagull population with diversity and uniform distribution.Then,the sinusoidal contraction factor is introduced to reduce the spiral flight radius of seagulls and improve the convergence accuracy of the algorithm.Finally,when the seagull position is updated,a uniform crossover method is proposed by integrating the population crossover operation in the genetic algorithm,so that the population with the best fitness value and the population with the poor fitness value are crossed in pairs by dimension,so that the algorithm can jump out of the local optimal.(2)A binary feature selection method based on weight mapping is proposed.High dimensional large-scale data may have some redundant features,which leads to more time consumed in model training and affects the predictive performance of the algorithm.Therefore,feature weight is introduced to represent the importance of each feature.The binary weight value is obtained by weight mapping and Boolean weight calculation as coding,and a better feature subset is initially screened.(3)An intrusion detection model(HSOA-SVM)based on synchronous optimization feature selection and SVM parameters based on improved Gull optimization algorithm is proposed.Considering that using SVM alone for feature selection or parameter optimization can neither reduce the optimization time nor improve the classification accuracy,the HSOA algorithm is used to synchronously optimize the feature selection and SVM parameters to find the best combination of SVM parameters while obtaining the optimal feature subset.The UNSW-NB15 data set is used to simulate the HSOA-SVM model.The experimental results show that the HSOA-SVM model is used to obtain a better feature subset,improve the detection accuracy,reduce the possibility of false positive and missing positive,and the overall performance of intrusion detection is effectively improved.