CN112217822B - Detection method for intrusion data - Google Patents

Abstract

The invention discloses a detection method for intrusion data, which specifically comprises the following steps: 1) a balanced data set acquisition step, 2) a data classification step, and 3) a classifier evaluation step; the invention provides a detection method aiming at intrusion data, which improves data protection and detection generalization performance.

Description

A detection method for intrusion data

technical field

The invention relates to the technical field of information reduction intrusion detection, and more particularly, to a detection method for intrusion data.

Background technique

With the development of the Internet industry, preventing information from being invaded has become one of the important topics, among which the uneven distribution of data is one of the problems that cannot effectively improve information protection. Unbalanced distribution of data means that the number of samples of one or several categories in the data set far exceeds the number of samples of other types. The category with a smaller proportion of data is called the minority category, and the category with a larger proportion of the data is called the majority category. There are various types of network attacks, some of which are very common, such as DDOS, brute force cracking, and ARP spoofing. Some attack types appear less frequently, such as unauthorized access to local superuser privileges, unauthorized access to remote hosts, and so on. Therefore, the number of samples of these types of attacks is much smaller than the number of common types of attacks. The consequences of a DDOS attack may damage the entire network, reduce service performance, block terminal services, and unauthorized access to remote hosts will lead to host control to conduct illegal and criminal activities. The existing classification methods have a high recognition rate for the sample points of the majority categories, so the minority categories are misclassified, which causes great problems and reduces the information prevention for the minority categories. Therefore, it is important to deal with imbalanced datasets and improve the generalization performance of data intrusion detection models.

SUMMARY OF THE INVENTION

The invention overcomes the deficiencies of the prior art, and provides a detection method for intrusion data that improves data protection and improves detection generalization performance.

In order to solve the above-mentioned technical problems, the technical scheme of the present invention is as follows:

A detection method for intrusion data, which specifically includes the following steps:

1) The steps of obtaining a balanced data set: Use the coarse clustering method to calculate the distance from the sample point to the cluster center point from the training data according to the Euclidean distance, and divide it into multiple cluster subsets, which will contain fewer sample points and farther distances. The clustered subsets of the intrusion data are regarded as noise points, and these noise data are deleted; then different categories of intrusion data are randomly sampled and dimensionality reduction is carried out to reduce the overfitting of different categories of intrusion data models, and the training set is adjusted by the oversampling method. Perform intra-class balance, increase the number of samples in some categories, and obtain a balanced data set;

2) Data classification step: the balanced data set is classified by the classifier, and the classifier adjusts the weight of the number of misclassified samples to improve the generalization performance of the classification model; among them, the AdaBoost M1 method is used to train the classifier for multiple iterations. The weak classifier in the training set, and each trained weak classifier will participate in the next iterative training; according to the results of the previous iteration, increase the weight of the sample points that are misclassified in the majority class in the training set, and at the same time correct the correct The weight of the classification sample points is reduced to enter the next iteration and improve the classification performance of the classifier; the classifier generated in the next iteration pays more attention to the wrong samples classified by the classifier in the previous iteration, so as to increase the correct rate of sample classification. ; Finally, the classification result is determined by voting according to the classifier generated by each iteration;

3) Classifier evaluation step: evaluate the classifier through confusion matrix, false negative rate, accuracy rate, and ROC curve; confusion matrix is used to compare the classification results with the actual results, and visualize the indicators of the classifier performance;

The false negative rate and accuracy rate are calculated by the following formulas:

False negative rate = TP/(FP+TN)

Accuracy = (TP+TN)/(TP+TN+FN+FP)

Among them, FP is judged as a positive sample, but is actually a negative sample; FN is judged as a negative sample, but is actually a positive sample; TN is judged as a negative sample, but is actually a negative sample; TP is judged as a negative sample Positive samples are actually positive samples;

The ROC curve is usually used to represent the effect of the model classifier. In the best state, the ROC should be in the upper left corner, which indicates a high true positive rate at a lower false positive rate; the horizontal axis of the ROC curve is the false positive rate FPR, the vertical axis true positive rate TPR;

TPR=TP/((TP+FN))

The true positive rate represents the ratio of the number of normal samples predicted by the model as normal samples to the number of all predicted normal samples;

FRP=FP/((FP+TN))

The false positive rate represents the ratio of the number of normal samples predicted by the model as attack types to the total number of samples predicted as attack types.

Further, the classifier generated in each iteration obtains the proportion of the final strong classifier according to the classification error rate; the lower the classification error rate, the higher the weight.

Further, the coarse clustering method uses the Euclidean distance to calculate the distance from the sample point to the centroid, compares it with the set distance thresholds T ₁ and T ₂ , and finally filters out the data according to the number of sample points in each category and the distance from each centroid. Concentrated interference points, and delete noise sample points; the specific steps are as follows:

1.1.1) Randomly arrange the original sample set into a sample list L={x ₁ ,x ₂ ,...,x _n }, and set the initial distance thresholds T ₁ and T ₂ according to the cross-validation parameter adjustment (T ₁ >T ₂ ) ;

1.1.2) Randomly select a sample point x _i from the list L, i∈(1,n), as the centroid of the first Canopy cluster, and delete x ₁ from the list;

1.1.3) Randomly select a sample point x _p from the list L, p∈(1,n)p≠i, calculate the distance from x _p to all centroids, and check the minimum distance D _min ;

If T ₂ ≤ D _min ≤ T ₁ , give x _p a weak label, indicating that D _min belongs to this canopy cluster, and join it; if D _min ≤ T ₂ , give x _p a strong label, indicating that D _min belongs to this canopy cluster cluster, and close to the centroid; and delete x _p from the list; if D _min >T ₁ , then x _p forms a new cluster, and delete x _p from the list;

1.1.4) Repeat step 1.1.3) until the number of elements in the list becomes zero, delete the clusters with few sample points in the canopy cluster, and delete the noise points with more than double the majority class sample points near the minority class sample points.

Further, the oversampling method randomly finds the minority class sample points, finds a point in the k nearest classes from the sample point, performs repeated interpolation, forms multiple new minority class samples, and adds the new minority class samples to the Data collection; specifically includes the following steps:

1.2.1) Select a minority class sample i from the data set, the feature vector is x _i , i∈{1,...,T};

1.2.2) Find the k nearest neighbors of sample x _i from all T samples of the minority category, denoted as x _i(near) , near∈{1,…,k};

1.2.3) Randomly select a sample x _i(nn ) from the k nearest neighbors, and then generate a random number λ ₁ between (0,1) to synthesize a new sample x _i1 :

x _i1 =x _i +λ ₁ ·(x _i(nn) -x _i ) (1)

1.2.4) Repeat step 1.2.3) N times, thereby synthesizing N new samples: x _inew , new∈{1,...,N}.

Compared with the prior art, the present invention has the following advantages:

The present invention combines data preprocessing and reinforcement learning to form a classifier, and proposes a coarse clustering method, an oversampling method and an intrusion detection classification method of Adaboost M1, using Canpoy clusters to perform coarse clustering to obtain noise points, and remove noise points. At the same time, the downsampling method is used to reduce the number of the majority class, reducing the model overfitting, and then the coarse clustering method is used to linearly synthesize the minority class sample points, which increases the number of minority classes, thereby reducing the imbalance between classes and forming a balanced data set , the balanced sample can make up for the shortcoming of insufficient number of classification samples of minority categories, and also solve the problem of loss of important information during random sampling. Combined with the AdaBoostM1 classifier, random forest is used as the base classifier, and the performance of random selection of feature subsets reduces the impact of the data dimension on the classification. In the process of each iteration, the local optimal weak classifier is obtained. The weights are updated, although the training time will increase, but compared with the results of the original unbalanced dataset on the Adaboost M1 classifier, it can effectively improve the accuracy of the minority categories and reduce the average false negative rate.

Description of drawings

Fig. 1 is the flow chart of the balanced data set construction of the present invention;

Figure 2 is a flowchart of the AdaBoostM1 framework;

Fig. 3 is the contrast diagram of U2R on ROC curve in the example of the present invention;

FIG. 4 is a comparison diagram of R2L on the ROC curve in the example of the present invention.

Detailed ways

Specific embodiments are given below to further illustrate the present invention.

As shown in Figures 1 to 4, a method for detecting intrusion data specifically includes the following steps:

1) The steps of obtaining a balanced data set: Use the coarse clustering method to calculate the distance from the sample point to the cluster center point from the training data according to the Euclidean distance, and divide it into multiple cluster subsets, which will contain fewer sample points and farther distances. The clustered subsets of the intrusion data are regarded as noise points, and these noise data are deleted; then different categories of intrusion data are randomly sampled and dimensionality reduction is carried out to reduce the overfitting of different categories of intrusion data models, and the training set is adjusted by the oversampling method. Perform intra-class equalization, increase the number of samples in some categories, and obtain a balanced data set.

Among them, the coarse clustering method uses the Euclidean distance to calculate the distance from the sample point to the centroid, compares it with the set distance thresholds T ₁ and T ₂ , and finally filters out the data set according to the number of sample points in each category and the distance from each centroid. and delete the noise sample points; the specific steps are as follows:

1.1.1) Randomly arrange the original sample set into a sample list L={x ₁ ,x ₂ ,...,x _n }, and set the initial distance thresholds T ₁ and T ₂ according to the cross-validation parameter adjustment (T ₁ >T ₂ ) ;

1.1.2) Randomly select a sample point x _i from the list L, i∈(1,n), as the centroid of the first Canopy cluster, and delete x ₁ from the list;

1.1.3) Randomly select a sample point x _p from the list L, p∈(1,n)p≠i, calculate the distance from x _p to all centroids, and check the minimum distance D _min ;

If T ₂ ≤ D _min ≤ T ₁ , give x _p a weak label, indicating that D _min belongs to this canopy cluster, and join it; if D _min ≤ T ₂ , give x _p a strong label, indicating that D _min belongs to this canopy cluster cluster, and close to the centroid; and delete x _p from the list; if D _min >T ₁ , then x _p forms a new cluster, and delete x _p from the list;

1.1.4) Repeat step 1.1.3) until the number of elements in the list becomes zero, delete the clusters with few sample points in the canopy cluster, and delete the noise points with more than double the majority class sample points near the minority class sample points.

The oversampling method randomly finds the minority class sample points, finds a point in the k nearest classes from the sample point, performs repeated interpolation, forms multiple new minority class samples, and adds the new minority class samples to the data set; Specifically include the following steps:

1.2.1) Select a minority class sample i from the data set, the feature vector is x _i , i∈{1,...,T};

1.2.2) Find the k nearest neighbors of sample x _i from all T samples of the minority category, denoted as x _i(near) , near∈{1,…,k};

1.2.3) Randomly select a sample x _i(nn ) from the k nearest neighbors, and then generate a random number λ ₁ between (0,1) to synthesize a new sample x _i1 :

x _i1 =x _i +λ ₁ ·(x _i(nn) -x _i ) (1)

1.2.4) Repeat step 1.2.3) N times, thereby synthesizing N new samples: x _inew , new∈{1,...,N}.

2) Data classification step: the balanced data set is classified by the classifier, and the classifier adjusts the weight of the number of misclassified samples to improve the generalization performance of the classification model; among them, the AdaBoost M1 method is used to train the classifier for multiple iterations. The weak classifier in the training set, and each trained weak classifier will participate in the next iterative training; according to the results of the previous iteration, increase the weight of the sample points that are misclassified in the majority class in the training set, and at the same time correct the correct The weight of the classification sample points is reduced to enter the next iteration and improve the classification performance of the classifier; the classifier generated in the next iteration pays more attention to the wrong samples classified by the classifier in the previous iteration, so as to increase the correct rate of sample classification. ; Finally, the classification result is determined by voting according to the classifier generated by each iteration;

3) Classifier evaluation step: evaluate the classifier through confusion matrix, false negative rate, accuracy rate, and ROC curve; confusion matrix is used to compare the classification results with the actual results, and visualize the indicators of the classifier performance;

The false negative rate and accuracy rate are calculated by the following formulas:

False negative rate = TP/(FP+TN)

Accuracy = (TP+TN)/(TP+TN+FN+FP)

Among them, FP is judged as a positive sample, but is actually a negative sample; FN is judged as a negative sample, but is actually a positive sample; TN is judged as a negative sample, but is actually a negative sample; TP is judged as a negative sample Positive samples are actually positive samples;

The ROC curve is usually used to represent the effect of the model classifier. In the best state, the ROC should be in the upper left corner, which indicates a high true positive rate at a lower false positive rate; the horizontal axis of the ROC curve is the false positive rate FPR, the vertical axis true positive rate TPR;

TPR=TP/((TP+FN))

The true positive rate represents the ratio of the number of normal samples predicted by the model as normal samples to the number of all predicted normal samples;

FRP=FP/((FP+TN))

The false positive rate represents the ratio of the number of normal samples predicted by the model as attack types to the total number of samples predicted as attack types.

The classifier generated in each iteration obtains the proportion of the final strong classifier according to the classification error rate; the lower the classification error rate, the higher the weight.

Specifically, the data set used in the experiment is the KDD CUP 99 data set. The dataset contains a large amount of network traffic data, including more than 5,000,000 network connection records, and about 2,000,000 test data. In order to avoid too large amount of data, the data set is randomly sampled according to the proportion of 10%, the sampling result is used as the training set for learning, and 10% of the test data is used as the test set. It can effectively reduce the time to build the model, and at the same time, the impact on the accuracy is small. The training dataset used in this experiment contains 49,399 pieces of training data. There are 41 features in the data set and 4 attack types, namely Denial of Service (DOS), Privilege Acquisition Attack (Remote to Local, R2L) originating from a remote host, Port Monitoring Scanning Attack (PROBE), Right attack (User to Root, U2R). The distribution of the number of attack types in the specific dataset is shown in Table 1 below:

type of data amount of training data test set Normal 97278 6059 DoS 391458 2298 Probe 4107 416 R2L 1126 161 U2R 52 228

Table 1

Because the samples in the original data set are unbalanced, the number of U2R is far less than DOS and Normal, which will affect the results and affect the generalization performance of the model. Canopy is used to remove noise points, and coarse clustering methods are used to improve the U2R and R2L of a few samples. At the same time, down-sampling the DOS and Normal types with more records, and then mixes the synthetic U2R and R2L type records and the data obtained by down-sampling with the Probe type data to form a new balanced data set . The data distribution of the balanced data set processed by this scheme is shown in Table 2 below:

type of data amount of training data Normal 9727 DoS 7829 Probe 4107 R2L 1126 U2R 1093

Table 2

Specifically, 10-fold cross-validation is used for the unbalanced training set obtained by random sampling, and the data in the data set is equally divided into 10 parts, one part is selected as the verification set, and the remaining nine parts are used for training, and iterates 10 times in turn. Finally, the average experimental result of 10 models is used as the result of the whole model, and the test set is used for testing, and the model trained in this training set is named AdaboostM1. Using 10-fold cross-validation for the balanced data set, and using random forest as the base classifier, random forest can handle high-dimensional data without feature selection, and can balance the error for unbalanced data sets, so it can be combined with AdaboostM1. The model trained on the balanced dataset is named SAdaboostM1, and the model trained on the original dataset is named AdaboostM1.

Use the test set to test the two models respectively. The confusion matrix obtained by the SAdaboostM1 model is shown in Table 3 below, and the confusion matrix obtained by the AdaboostM1 model is shown in Table 4 below. Table 5 shows the false negative rate results of each category obtained by testing the AdaboostM1 model and the SAdaboostM1 model on the test set. Table 6 shows the accuracy results of each category obtained by testing the AdaboostM1 model and the SAdaboostM1 model on the test set.

table 3

Table 4

Classifier R2L DOS PROBE U2R AdaboostM1 84.4 2.9 36.1 88.7 SAdaboostM1 58.6 2.6 15.5 67.2

table 5

Classifier R2L DOS PROBE U2R AdaboostM1 15.6 97.1 73.9 13.3 SAdaboostM1 30.3 97.4 81.6 42.8

Table 6

From Table 5 and Table 6, it can be seen that after using this scheme to process the samples, the noise is reduced, and the problem of few-category sample errors caused by sample imbalance is solved. Under the premise of not changing the original overall accuracy, the accuracy of U2R and R2L has been greatly improved, and the false negative rate has been reduced.

The following compares the ROC curves of U2R and R2L on the two models. The ROC curve of the minority class U2R in the dataset on the SAdaboostM1 model is shown on the left in Figure 3, AUC=0.9779, while the ROC curve on the AdaboostM1 model is shown on the right in Figure 3. The ROC curve of the minority class R2L in the dataset on the SAdaboostM1 model is shown on the left side of Figure 4, with AUC=0.7091. The ROC curve of the minority class R2L in the dataset on the AdaboostM1 model is shown on the right side of Figure 4, with AUC=0.6486.

To sum up, there are various attack behaviors in the network environment, and the number of collected attack data type samples is not balanced, so it is difficult to judge the attack behavior of a few categories. Therefore, this scheme uses Canopy to remove noise points, reducing the number of samples in the synthesis of a few categories. The error at the point, the coarse clustering method artificially synthesizes the data of a certain category with a small amount of attack data (R2L and U2R), increases the proportion of data, and reduces the number of categories with a large proportion of samples (DOS and Normal) at the same time. number, and then train the AdaboostM1 classifier with the balanced dataset to compare with the model trained on the AdaboostM1 classifier under the original dataset. The experiment shows that without reducing the accuracy of the overall dataset, the accuracy of the minority class U2R attack is increased by 29%, the accuracy of the R2L attack is increased by 15%, and the average false negative rate is reduced by 28%. Under the premise of the classification accuracy of most categories, it can effectively improve the accuracy of few categories, reduce the average false negative rate, and effectively solve the problem of misclassification of minority categories in network intrusion detection.

The above are only the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, without departing from the concept of the present invention, several improvements and modifications can also be made, and these improvements and modifications should also be regarded as are within the protection scope of the present invention.

Claims (4)

1. a detection method for intrusion data, is characterized in that, specifically comprises the steps: 1) The steps of obtaining a balanced data set: Use the coarse clustering method to calculate the distance from the sample point to the cluster center point from the training data according to the Euclidean distance, and divide it into multiple cluster subsets, which will contain fewer sample points and farther distances. The clustered subsets of the intrusion data are regarded as noise points, and these noise data are deleted; then different categories of intrusion data are randomly sampled and dimensionality reduction is performed to reduce the overfitting of different categories of intrusion data models, and the training set is adjusted by oversampling method. Perform intra-class balance, increase the number of samples in some categories, and obtain a balanced data set; 2) Data classification step: the balanced data set is classified by the classifier, and the classifier adjusts the weight of the number of misclassified samples to improve the generalization performance of the classification model; among them, the AdaBoost M1 method is used to train the classifier for multiple iterations. The weak classifier of , and each trained weak classifier will participate in the next iterative training; according to the results of the previous iteration, the weight of the misclassified sample points in the training set is increased, and the correctly classified sample points are reduce the weight of the classifier to enter the next iteration and improve the classification performance of the classifier; the classifier generated in the next iteration pays more attention to the wrong samples classified by the classifier of the previous iteration, so as to increase the correct rate of sample classification; finally, according to each The classifier generated by the next iteration votes to determine the classification result; 3) Classifier evaluation step: evaluate the classifier through confusion matrix, false negative rate, accuracy rate, and ROC curve; confusion matrix is used to compare the classification results with the actual results, and visualize the indicators of the classifier performance; The false negative rate and accuracy rate are calculated by the following formulas: False negative rate = TP/(FP+TN) Accuracy = (TP+TN)/(TP+TN+FN+FP) Among them, FP is judged as a positive sample, but is actually a negative sample; FN is judged as a negative sample, but is actually a positive sample; TN is judged as a negative sample, but is actually a negative sample; TP is judged as a negative sample Positive samples are actually positive samples; The ROC curve is usually used to represent the effect of the model classifier. In the best state, the ROC should be in the upper left corner, which indicates a high true positive rate at a lower false positive rate; the horizontal axis of the ROC curve is the false positive rate FPR, the vertical axis true positive rate TPR; TPR=TP/((TP+FN)) The true positive rate represents the ratio of the number of normal samples predicted by the model as normal samples to the number of all predicted normal samples; FRP=FP/((FP+TN)) The false positive rate represents the ratio of the number of normal samples predicted by the model as attack types to the total number of samples predicted as attack types. 2. a kind of detection method for intrusion data according to claim 1, is characterized in that: the classifier that each iteration produces obtains the proportion when finally forming the strong classifier according to the classification error rate; the lower the classification error rate is , the higher the weight. 3. a kind of detection method for intrusion data according to claim 1 is characterized in that: rough clustering method uses Euclidean distance to calculate the distance from sample point to centroid, and compares with set distance thresholds T ₁ , T ₂ , and finally filter out the interference points in the dataset according to the number of sample points in each category and the distance from each centroid, and delete the noise sample points; the specific steps are as follows: 1.1.1) Randomly arrange the original sample set into a sample list L={x ₁ ,x ₂ ,...,x _n }, and set the initial distance thresholds T ₁ and T ₂ according to the cross-validation parameter adjustment (T ₁ >T ₂ ) ; 1.1.2) Randomly select a sample point _xi from the list L, i∈(1,n), as the centroid of the first Canopy cluster, and delete _xi from the list; 1.1.3) Randomly select a sample point x _p from the list L, p∈(1,n)p≠i, calculate the distance from x _p to all centroids, and check the minimum distance D _min ; If T ₂ ≤ D _min ≤ T ₁ , give x _p a weak label, indicating that D _min belongs to this canopy cluster, and join it; if D _min <T ₂ , give x _p a strong label, indicating that D _min belongs to this canopy cluster cluster, and close to the centroid; and delete x _p from the list; if D _min >T ₁ , then x _p forms a new cluster, and delete x _p from the list; 1.1.4) Repeat step 1.1.3) until the number of elements in the list becomes zero, delete the clusters with few sample points in the canopy cluster, and delete the noise points with more than double the majority class sample points near the minority class sample points. 4. A kind of detection method for intrusion data according to claim 1, it is characterized in that: the oversampling method searches for a minority class sample point randomly, finds a point in the k nearest classes from the sample point, and performs repeated interpolation , forming multiple new minority class samples, and adding the new minority class samples to the data set; the specific steps include the following: 1.2.1) Select a minority class sample i from the data set, the feature vector is x _i , i∈{1,...,T}; 1.2.2) Find the k nearest neighbors of sample x _i from all T samples of the minority category, denoted as x _i(near) , near∈{1,…,k}; 1.2.3) Randomly select a sample x _i(nn ) from the k nearest neighbors, and then generate a random number λ ₁ between (0,1) to synthesize a new sample x _i1 : x _i1 =x _i +λ ₁ ·(x _i(nn) -x _i ) (1) 1.2.4) Repeat step 1.2.3) N times, thereby synthesizing N new samples: x _inew , new∈{1,...,N}.

Images