CN118282707A - An Intrusion Detection Method Based on Incremental Training - Google Patents

Abstract

The invention discloses an intrusion detection method based on incremental training, which relates to the technical field of network security and comprises the following steps: extracting key characteristic data of the target network flow data; performing classification detection on the key characteristic data by using a recently updated integrated isolated forest detection model to obtain target abnormal flow data and target normal flow data; performing multi-classification detection on the target abnormal flow data by using the recently updated self-adaptive random forest model, labeling the target abnormal flow data, and noting the attack type of the target abnormal flow data; constructing a first increment training data set according to the target normal flow data and the historical network flow data, progressively updating the integrated isolated forest detection model, constructing a second increment training data set according to the target abnormal flow data, and updating the self-adaptive random forest model. The invention improves the comprehensive detection capability of the intrusion detection system.

Description

An Intrusion Detection Method Based on Incremental Training

Technical Field

The present invention relates to the field of network security technology, and in particular to an intrusion detection method based on incremental training.

Background technique

With the rapid development of technologies such as cloud computing, the Internet of Things, and artificial intelligence, the scale and complexity of networks are increasing, providing attackers with more targets and opportunities. The methods and means of network attacks are also becoming increasingly diverse and covert, such as malware, zero-day vulnerability exploits, social engineering, phishing emails, ransomware, etc.

Intrusion detection plays an important role in network security. It monitors and analyzes network traffic, system logs, user behavior and other data in real time to find abnormal activities that do not conform to normal behavior patterns. However, although network intrusion detection has achieved great success and has high efficiency and accuracy, the current intrusion detection system does not implement fitting learning for the situation of network traffic data deviation, resulting in the problem that its detection accuracy will continue to decline over time. In view of this scenario, it is necessary to propose an incremental training intrusion detection method to analyze and learn the network traffic data deviation to ensure the accuracy of the intrusion detection system.

Summary of the invention

The present invention provides an intrusion detection method based on incremental training, which can efficiently and accurately realize the detection and analysis of network traffic data. If it is abnormal attack data, its attack type can also be analyzed, thereby providing a judgment basis for subsequent targeted defense. In addition, the present invention can perform incremental learning on the detection result data to analyze and learn the deviation of network traffic data, thereby ensuring the accuracy of the intrusion detection system.

The technical solution adopted by the present invention is as follows:

The present invention provides an intrusion detection method based on incremental training, comprising the following steps:

S1. Preprocess the collected target network traffic data and extract key feature data;

S2. Use the recently updated integrated isolation forest detection model to perform binary classification detection on the key feature data to obtain target abnormal traffic data and target normal traffic data, wherein the integrated isolation forest detection model includes multiple sub-isolation forest detection models;

S3. Use the recently updated adaptive random forest model to perform multi-classification detection on the target abnormal traffic data, label the target abnormal traffic data, indicate its attack type, and take corresponding network security defense measures according to the attack type to which the target abnormal traffic data belongs;

S4, randomly sampling target normal traffic data, and merging it with historical network traffic data to construct a first incremental training data set, and randomly sampling target abnormal traffic data, collecting each abnormal type, and constructing a second incremental training data set;

S5. Using the first incremental training data set to train a new sub-isolation forest detection model, using the new sub-isolation forest detection model to replace the sub-isolation forest detection model with low accuracy in the integrated isolation forest detection model, and completing the progressive incremental update of the integrated isolation forest detection model;

S6. Use the second incremental training data set to train and update the adaptive random forest model.

In a preferred embodiment of the present invention, step S1 specifically includes the following steps:

S101, calculating the correlation coefficient between features for the collected network traffic data to obtain the correlation coefficient between features;

S102, sorting the correlation coefficients between features, extracting feature pairs corresponding to the correlation coefficients between features that are greater than a set threshold, and obtaining a feature pair set;

S103. For each feature pair in the feature pair set, randomly delete one of the features and retain key feature data.

In a preferred embodiment of the present invention, the construction process of the initial integrated isolation forest detection model includes:

S201, randomly sampling and collecting historical network traffic data to construct a total training data set Φ;

S202, determining the maximum number L of sub-isolation forest detection models of the integrated isolation forest detection model and a storage set T for storing the integrated isolation forest detection model;

S203, randomly sampling from the total training data set Φ to form a data subset ψ;

S204, using the data subset ψ to train and generate a sub-isolation forest detection model, and putting the trained sub-isolation forest detection model into a storage set T;

S205. If the number of sub-isolation forest detection models in the storage set T reaches the maximum number of sub-isolation forest detection models L, the integrated isolation forest detection model is constructed, otherwise jump to step S203.

In a preferred embodiment of the present invention, the process of performing binary classification detection on key feature data using an integrated isolation forest detection model includes:

For each sub-isolation forest detection model in the integrated isolation forest detection model, use it to perform binary classification detection on the key feature data to obtain the detection result;

A hard voting summary analysis is performed on all the test results, and the test results of the integrated isolation forest are determined by the voting results (the test results of the integrated isolation forest are obtained by counting the test results of all the sub-isolation forests, and the final result is confirmed by the majority, which may be different from the test results of some sub-isolation forests).

In a preferred embodiment of the present invention, the integrated isolation forest detection model is matched with a total detection count counter to record how many network flow data are detected in total; each sub-isolation forest detection model in the integrated isolation forest detection model is matched with an abnormal count counter to record the number of network flow data detected errors;

After each detection, the number of incorrect detections of the sub-isolation forest detection model that is different from the detection result of the integrated isolation forest is increased by one through the abnormal number counter.

In a preferred embodiment of the present invention, for each sub-isolation forest detection model, a method for using the sub-isolation forest detection model to perform binary classification detection on key feature data includes:

For key feature data, let each data point x _i traverse each isolated tree iTree inside the sub-isolation forest detection model, calculate the average height of the data point in the forest, and normalize the average height of all data points. The calculation formula of the outlier score S of the data point is:

Among them, the function formulas are as follows:

H(i)≈ln(i)+0.5772156649

Among them, x represents the xth isolated tree; n is the total number of isolated trees; h(x) represents the number of edges that the current data passes through from the root node of the current isolated tree to the corresponding leaf node, that is, the path length of the data in the current isolated tree; H(i) is the harmonic number, which is estimated by the Euler constant; E(h(x)) is the average path length of the calculated data on all isolated trees; when the average path length of the data point is smaller, the closer the outlier score S is to 1, the greater the probability that the data point is an anomaly; the detection result obtained by the sub-isolation forest detection model for binary classification of key feature data refers to the data label obtained by the detection, which is normal or abnormal. This data label depends on the outlier score S.

In a preferred embodiment of the present invention, the construction process of the initial adaptive random forest algorithm model includes:

S301, collecting historical abnormal traffic data generated by network attacks to construct an attack traffic data set;

S302: Use the attack traffic data set to train and generate an adaptive random forest algorithm model.

In a preferred embodiment of the present invention, step S5 comprises the following steps:

S501, for each sub-isolation forest detection model of the integrated isolation forest detection model, calculate its detection accuracy according to the number of network traffic data with detection errors recorded by its abnormal number counter and the total number of network traffic data detections recorded by the total number of detections counter of the integrated isolation forest detection model, and if its detection accuracy is lower than the accuracy threshold, mark it as a model to be replaced;

S502, counting the number k of models to be replaced;

S503. Randomly sample the first incremental training data set, use the sampling results to train k new sub-isolation forest detection models, use the new sub-isolation forest detection models to replace the k models to be replaced in the integrated isolation forest detection model, and complete the progressive incremental update of the integrated isolation forest detection model.

In a preferred embodiment of the present invention, in step S6, the adaptive random forest model is updated through incremental learning and generation of new decision trees to adapt to the distribution and abnormal patterns of new data.

In a preferred embodiment of the present invention, the updating method of the integrated isolation forest detection model and the adaptive random forest model also includes directly inputting new data into the model.

Compared with the prior art, the present invention has the following beneficial effects:

The present invention first performs binary classification detection on the collected network traffic data, and then performs multi-classification detection on the abnormal data to determine the attack type. In addition, the timeliness of the detection model can be ensured through incremental training;

Compared with the existing intrusion detection methods, the present invention integrates the intrusion detection method based on anomaly detection and the intrusion detection method based on feature recognition, thereby improving the comprehensive detection capability of the intrusion detection system;

The incremental training-based intrusion detection method proposed in the present invention can learn the normal behavior pattern and detect abnormal behavior that does not conform to it, and can also quickly identify known attack behaviors by comparing the abnormal data with known intrusion features;

In addition, the present invention is based on incremental training, so that new samples can be introduced for learning on the basis of the existing model, thereby retaining historical knowledge, which is very important for models and data accumulated over a long period of time. It can avoid knowledge loss caused by retraining, and enable the system to flexibly respond to dynamically changing data and environments. The model can be locally adjusted and updated according to the characteristics of the new samples without retraining the entire model. This flexibility makes the model more flexible and able to adapt to changing needs and conditions.

In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the embodiments of the present invention are specifically cited below and described in detail with reference to the attached drawings.

BRIEF DESCRIPTION OF THE DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

FIG1 is a flow chart of an intrusion detection method based on incremental training of the present invention;

FIG2 is a flowchart of extracting key feature data of the present invention;

FIG3 is a flowchart of constructing the initial integrated isolation forest detection model of the present invention;

FIG4 is a flowchart of the progressive incremental update of the integrated isolation forest detection model of the present invention;

FIG5 is a diagram showing the effect of incremental training in the experiment of the method of the present invention.

Detailed ways

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments.

The intrusion detection method based on incremental training described in the present invention proposes an isolation forest detection algorithm of progressive incremental training according to the idea of ensemble learning, performs anomaly detection on the collected network traffic data information through the isolation forest detection algorithm of progressive incremental training, and then performs multi-classification detection on the detected abnormal traffic data information through an adaptive random forest algorithm, so as to detect the attack type to which the abnormal traffic data belongs, thereby providing reference and assistance for defense response operations.

In addition, the present invention can also perform incremental training on new data to cope with the situation of network traffic data drift. The present invention can flexibly respond to dynamically changing data and abnormal patterns over time and better capture abnormal behavior.

The following description of the specific implementation process of the method of the present invention in conjunction with Figures 1 to 4 includes the following steps:

S1. Preprocess the collected target network traffic data and extract key feature data, as shown in Figure 2, specifically:

S101, calculating the correlation coefficient between features for the collected network traffic data to obtain the correlation coefficient between features;

S102, sorting the correlation coefficients between features, extracting feature pairs corresponding to the correlation coefficients between features that are greater than a set threshold, and obtaining a feature pair set;

S103. For each feature pair in the feature pair set, randomly delete one of the features and retain key feature data.

S2. Use the recently updated integrated isolation forest detection model to perform binary classification detection on the key feature data to obtain target abnormal traffic data and target normal traffic data, where the integrated isolation forest detection model includes multiple sub-isolation forest detection models.

As shown in Figure 3, the construction process of the initial integrated isolation forest detection model includes:

S201. Randomly sample and collect historical network traffic data to construct a total training data set Φ.

S202: Determine the maximum number L of sub-isolation forest detection models of the integrated isolation forest detection model and a storage set T for storing the integrated isolation forest detection model.

S203, randomly sampling from the total training data set Φ to form a data subset ψ.

S204, using the data subset ψ to train and generate a sub-isolation forest detection model, as follows:

The sub-isolation forest detection model contains several iTree isolation trees. Each iTree is a binary tree structure. Each time, a sample point is randomly selected from the data subset ψ as the sample subset and placed in the root node of the tree.

Randomly specify a dimension (feature) and randomly generate a cutting point p in the current node data (the cutting point is generated between the maximum and minimum values of the specified dimension in the current node data);

A hyperplane is generated with this cutting point p, and then the data space of the current node is divided into two subspaces: the data in the specified dimension that is smaller than the cutting point p is placed in the left child node of the current node, and the data that is greater than or equal to p is placed in the right child node of the current node.

Recursively repeat the above steps in the child nodes, and continuously construct new child nodes until there is only one data in the child node (no further cutting is possible) or the child node has reached the limited height. At this time, the creation of the current iTree isolated tree is completed, and the creation steps of the iTree isolated tree are repeated to finally form a sub-isolation forest detection model, and the trained sub-isolation forest detection model is placed in the storage set T.

S205. If the number of sub-isolation forest detection models in the storage set T reaches the maximum number of sub-isolation forest detection models L, the integrated isolation forest detection model is constructed, otherwise jump to step S203.

The process of using the integrated isolation forest detection model to perform binary classification detection on key feature data includes:

For each sub-isolation forest detection model in the integrated isolation forest detection model, use it to perform binary classification detection on the key feature data to obtain the detection result;

A hard voting summary analysis is performed on all the detection results, and the detection results of the integrated isolation forest are determined by the voting results, that is, the target abnormal traffic data and the target normal traffic data are obtained.

In the present invention, the integrated isolation forest detection model is matched with a total detection count counter to record how many network flow data are detected in total; each sub-isolation forest detection model in the integrated isolation forest detection model is matched with an abnormal count counter to record the number of network flow data detected errors;

After each detection, the number of incorrect detections of the sub-isolation forest detection model that is different from the detection result of the integrated isolation forest is increased by one through the abnormal number counter.

For each sub-isolation forest detection model, the method of using it to perform binary classification detection on key feature data includes:

For key feature data, let each data point x _i traverse each isolated tree iTree inside the sub-isolation forest detection model, calculate the average height of the data point in the forest, and normalize the average height of all data points. The calculation formula of the outlier score S of the data point is:

Among them, the function formulas are as follows:

H(i)≈ln(i)+0.5772156649

Among them, x represents the xth isolated tree; n is the total number of isolated trees; h(x) represents the number of edges that the current data passes through from the root node of the current isolated tree to the corresponding leaf node, that is, the path length of the data in the current isolated tree; H(i) is the harmonic number, which is estimated by the Euler constant; E(h(x)) is the average path length of the calculated data on all isolated trees; when the average path length of the data point is smaller, the closer the outlier score S is to 1, the greater the probability that the data point is an anomaly; the detection result obtained by the sub-isolation forest detection model for binary classification of key feature data refers to the data label obtained by the detection, which is normal or abnormal. This data label depends on the outlier score S.

S3. Use the recently updated adaptive random forest model to perform multi-classification detection on the target abnormal traffic data, label the target abnormal traffic data, indicate its attack type, and take corresponding network security defense measures according to the attack type to which the target abnormal traffic data belongs.

For the initial adaptive random forest algorithm model, the construction process includes:

S301, collecting historical abnormal traffic data generated by network attacks to construct an attack traffic data set;

S302: Use the attack traffic data set to train and generate an adaptive random forest algorithm model.

S4. Randomly sample target normal traffic data and merge it with historical network traffic data to construct a first incremental training data set. Randomly sample target abnormal traffic data, collect each abnormal type, and construct a second incremental training data set.

S5. Using the first incremental training data set to complete the progressive incremental update of the integrated isolation forest detection model, as shown in FIG4 , specifically as follows:

S501, for each sub-isolation forest detection model of the integrated isolation forest detection model, calculate its detection accuracy according to the number of network traffic data with detection errors recorded by its abnormal number counter and the total number of network traffic data detections recorded by the total number of detections counter of the integrated isolation forest detection model, and if its detection accuracy is lower than the accuracy threshold, mark it as a model to be replaced;

S502, counting the number k of models to be replaced;

S503. Randomly sample the first incremental training data set, use the sampling results to train k new sub-isolation forest detection models, use the new sub-isolation forest detection models to replace the k models to be replaced in the integrated isolation forest detection model, and complete the progressive incremental update of the integrated isolation forest detection model.

S6. Use the second incremental training data set to train and update the adaptive random forest model. Update the adaptive random forest model through incremental learning and generation of new decision trees to adapt to the distribution and abnormal patterns of the new data.

FIG5 is a diagram showing the effect of incremental training in the experiment of the method of the present invention, wherein the diagram mainly shows various evaluation indicators for measuring the performance of the classification model, which are introduced as follows:

First, we need to introduce the basis of all evaluation indicators: confusion matrix. Confusion matrix is a table used to evaluate the performance of classification models. For binary classification problems, the confusion matrix contains four concepts: positive, negative, true, and false. Its general meaning is as follows:

The predicted category is called normal, which is called positive, and the predicted category is called abnormal, which is called negative.

Correct predictions are called True, and incorrect predictions are called False.

For the above concepts, we can get four key indicators by permuting and combining them: True Positive (TP), which means predicting normal events as normal; False Positive (FP), which means predicting abnormal samples as normal; False Negative (FN), which means predicting normal samples as abnormal; True Negative (TN), which means predicting abnormal samples as abnormal. Combining them will get the confusion matrix. In the case of multi-classification, it is usually converted into a binary classification, where the class to be evaluated is regarded as the normal class and all other classes are regarded as abnormal classes, so as to construct the confusion matrix.

(1) Accuracy: It measures the proportion of samples correctly classified by the model. It represents the model's ability to correctly classify normal samples and abnormal samples. The higher the accuracy, the better the model performance. Accuracy is the ratio of the sum of the number of true positive (TP) samples and the number of true negative (TN) samples to all samples. The calculation formula is as follows:

(2) Precision: Indicates how many of the samples predicted as positive by the model are actually positive. It is used to measure the accuracy of the model in predicting positive categories, that is, how likely the model is correct when it identifies a positive category. A high precision means that when the model identifies a positive category, it is more likely to be correct. The calculation formula is as follows:

(3) Recall: Indicates how many of all actual positive samples are successfully predicted as positive. Recall measures the model's ability to identify positive samples, that is, to what extent the model finds the true positive samples. A high recall means that the model can better capture the actual positive samples. Its calculation formula is as follows:

(4) F1-score: It is the harmonic mean of precision and recall and is used to comprehensively evaluate model performance. The F1-score is a performance indicator that takes precision and recall into account. The F1-score ranges from 0 to 1, and the closer it is to 1, the better the model performance. In some tasks, precision and recall may be equally important. In order to balance the two and maximize the performance of the model, the classification threshold or model parameters of the model can be adjusted by observing the F1-score to find a balance between precision and recall, thereby improving the performance of the model. The calculation formula is as follows:

In addition, there are two indicators in Figure 5: "macro avg" and "weighted avg". "macro avg" is the macro average, that is, the arithmetic average of the corresponding indicators of each class. "weighted avg" is the weighted average, that is, the proportion of the number of this type to the total number of all types is used as the weight, and then the corresponding indicators of each class are weighted averaged.

As can be seen in Figure 5, after incremental training, the accuracy, precision and recall of the network attack anomaly detection part have been improved to a certain extent, indicating that the isolation forest detection algorithm model of the progressive incremental training of the present invention can further learn and analyze the data through incremental training in attack detection, thereby improving the performance of the model.

Then there are the incremental training results of the multi-classification detection part of network attacks. Among them, "normal", "dos", "probe", "r2l", and "u2r" in the classification report represent different data type information, which respectively represent five data categories of "normal", "dos attack", "Probe reconnaissance", "R2L remote to local attack" and "U2R user to root attack". By analyzing Figure 5, it can be seen that before incremental training, the precision, recall rate and F1 score of the detection of the three attack types of "probe", "r2l" and "u2r" are all low. This is because the model is insufficient to learn and analyze the three attack types due to the lack of relevant attack type data before incremental training. After incremental training, due to the addition of the three attack type data of "probe", "r2l" and "u2r", the model gradually learns the attack feature information of these attack types, so that the precision, recall rate and F1 score of these attack types in the test have been significantly improved, which shows that the adaptive random forest model of the present invention can achieve continuous learning in attack classification, so as to fully learn the attack features of various attack types and improve its own attack classification ability.

In summary, the two models proposed in the present invention can continuously perform incremental learning on the basis of ensuring high performance indicators, so that the model can learn new data to ensure the performance of the model.

The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims (10)

1. An intrusion detection method based on incremental training, characterized in that it comprises the following steps: S1. Preprocess the collected target network traffic data and extract key feature data; S2. Use the recently updated integrated isolation forest detection model to perform binary classification detection on the key feature data to obtain target abnormal traffic data and target normal traffic data, wherein the integrated isolation forest detection model includes multiple sub-isolation forest detection models; S3. Use the recently updated adaptive random forest model to perform multi-classification detection on the target abnormal traffic data, label the target abnormal traffic data, indicate its attack type, and take corresponding network security defense measures according to the attack type to which the target abnormal traffic data belongs; S4, randomly sampling target normal traffic data, and merging it with historical network traffic data to construct a first incremental training data set, and randomly sampling target abnormal traffic data, collecting each abnormal type, and constructing a second incremental training data set; S5. Using the first incremental training data set to train a new sub-isolation forest detection model, using the new sub-isolation forest detection model to replace the sub-isolation forest detection model with low accuracy in the integrated isolation forest detection model, and completing the progressive incremental update of the integrated isolation forest detection model; S6. Use the second incremental training data set to train and update the adaptive random forest model. 2. According to the incremental training-based intrusion detection method of claim 1, step S1 specifically comprises the following steps: S101, calculating the correlation coefficient between features for the collected network traffic data to obtain the correlation coefficient between features; S102, sorting the correlation coefficients between features, extracting feature pairs corresponding to the correlation coefficients between features that are greater than a set threshold, and obtaining a feature pair set; S103. For each feature pair in the feature pair set, randomly delete one of the features and retain key feature data. 3. The intrusion detection method based on incremental training according to claim 1 is characterized in that, for the initial integrated isolation forest detection model, its construction process includes: S201, randomly sampling and collecting historical network traffic data to construct a total training data set Φ; S202, determining the maximum number L of sub-isolation forest detection models of the integrated isolation forest detection model and a storage set T for storing the integrated isolation forest detection model; S203, randomly sampling from the total training data set Φ to form a data subset ψ; S204, using the data subset ψ to train and generate a sub-isolation forest detection model, and putting the trained sub-isolation forest detection model into a storage set T; S205. If the number of sub-isolation forest detection models in the storage set T reaches the maximum number of sub-isolation forest detection models L, the integrated isolation forest detection model is constructed, otherwise jump to step S203. 4. The intrusion detection method based on incremental training according to claim 3 is characterized in that the process of using the integrated isolation forest detection model to perform binary classification detection on key feature data includes: For each sub-isolation forest detection model in the integrated isolation forest detection model, use it to perform binary classification detection on the key feature data to obtain the detection result; A hard voting summary analysis is performed on all the detection results, and the detection results of the integrated isolation forest are determined based on the voting results. 5. According to the incremental training-based intrusion detection method of claim 4, it is characterized in that the integrated isolation forest detection model is matched with a total detection number counter to record how many network flow data are detected in total; for each sub-isolation forest detection model in the integrated isolation forest detection model, an abnormal number counter is matched to record the number of network flow data detected errors; After each detection, the number of incorrect detections of the sub-isolation forest detection model that is different from the detection result of the integrated isolation forest is increased by one through the abnormal number counter. 6. The intrusion detection method based on incremental training according to claim 4 is characterized in that, for each sub-isolation forest detection model, the method of using it to perform binary classification detection on key feature data includes: For key feature data, let each data point x _i traverse each isolated tree iTree inside the sub-isolation forest detection model, calculate the average height of the data point in the forest, and normalize the average height of all data points. The calculation formula of the outlier score S of the data point is: The function formulas are as follows: H(i)≈ln(i)+0.5772156649 Where x represents the xth isolated tree; n is the total number of isolated trees; h(x) represents the number of edges that the current data passes through from the root node of the current isolated tree to the corresponding leaf node, that is, the path length of the data in the current isolated tree; H(i) is the harmonic number, which is estimated by the Euler constant; E(h(x)) is the average path length of the calculated data on all isolated trees; when the average path length of the data point is smaller, the outlier score S is closer to 1, and the probability that the data point is an anomaly is greater; The detection result obtained by the sub-isolation forest detection model through binary classification detection of key feature data refers to the data label obtained by the detection, which is normal or abnormal. This data label depends on the outlier score S. 7. The intrusion detection method based on incremental training according to claim 4 is characterized in that, for the initial adaptive random forest algorithm model, its construction process includes: S301, collecting historical abnormal traffic data generated by network attacks to construct an attack traffic data set; S302: Use the attack traffic data set to train and generate an adaptive random forest algorithm model. 8. The intrusion detection method based on incremental training according to claim 4, characterized in that step S5 comprises the following steps: S501, for each sub-isolation forest detection model of the integrated isolation forest detection model, calculate its detection accuracy according to the number of network traffic data with detection errors recorded by its abnormal number counter and the total number of network traffic data detections recorded by the total number of detections counter of the integrated isolation forest detection model, and if its detection accuracy is lower than the accuracy threshold, mark it as a model to be replaced; S502, counting the number k of models to be replaced; S503. Randomly sample the first incremental training data set, use the sampling results to train k new sub-isolation forest detection models, use the new sub-isolation forest detection models to replace the k models to be replaced in the integrated isolation forest detection model, and complete the progressive incremental update of the integrated isolation forest detection model. 9. The intrusion detection method based on incremental training according to claim 4 is characterized in that in step S6, the adaptive random forest model is updated through incremental learning and generation of new decision trees to adapt to the distribution and abnormal patterns of new data. 10. According to claim 1, the intrusion detection method based on incremental training is characterized in that the updating method of the integrated isolation forest detection model and the adaptive random forest model also includes directly inputting new data into the model.