Research on Network Intrusion Detection Based on Xgboost

doi:10.3969/j.issn.1671-1122.2018.09.016

Abstract

Abstract:

The application of machine learning in network intrusion detection has attracted wide attention, and the main algorithms used are decision tree, random forest, logistic regression, KNN (K-Nearest Neighbor) and other machine learning models. These algorithms are long published, mature and have limited potential. Xgboost (eXtreme Gradient Boosting) algorithm is relatively new, and has less research in network intrusion detection. Based on intrusion detection data set KDD 99, this paper uses logit, KNN, decision tree, random forest and Xgboost to perform 5 fold cross validation, calculates and compares recognition effects of these algorithms. The test results show that Xgboost algorithm has excellent performance in intrusion detection compared with the existing machine learning algorithms, and has a large space for development in the field of network intrusion detection.

Key words: Xgboost, machine learning, intrusion detection

CLC Number:

TP309

Yang ZHANG, Yuangang YAO. Research on Network Intrusion Detection Based on Xgboost[J]. Netinfo Security, 2018, 18(9): 102-105.

Figures/Tables 3

References 12

[1]	ZHANG Yirong, XIAO Shunping, XIAN Ming, et al.An Overview of Intrusion Detection Technology Based on Machine Learning[J]. Computer Engineering and Application, 2006, 42(2):7-10.
	张义荣, 肖顺平, 鲜明,等. 基于机器学习的入侵检测技术概述[J]. 计算机工程与应用, 2006, 42(2):7-10.
[2]	SHI Tingting, ZHAO Youjian.Overviews of Network Intrusion Evasion and Defense Techniques[J].Netinfo Security, 2016 ,16(1) : 70-74.
	史婷婷, 赵有健. 网络入侵逃逸及其防御和检测技术综述[J]. 信息网络安全, 2016,16(1):70-74.
[3]	PIETRASZEK T, TANNER A.Data Mining and Machine Learning-towards Reducing False Positives in Intrusion Detection[J].Information Security Technical Report, 2005, 10(3):169-183.
[4]	QI Mingyu, LIU Ming, FU Yanming .Research on Network Intrusion Detection Using Support Vector Machines Based on Principal Component Analysis[J]. Netinfo Security, 2015,15(2):15-18.
	戚名钰, 刘铭, 傅彦铭. 基于PCA的SVM网络入侵检测研究[J]. 信息网络安全, 2015,15(2):15-18.
[5]	WU Qingtao, SHAO Zhiqing.Review of Intrusion Detection Research[J]. Computer Application Research, 2005, 22(12):11-14.
	吴庆涛, 邵志清. 入侵检测研究综述[J]. 计算机应用研究, 2005, 22(12):11-14.
[6]	HU Changzhen.Theory and Technology of Network Intrusion Detection [M]. Beijing: Beijing Institute of Technology Press, 2010.
	胡昌振. 网络入侵检测原理与技术[M]. 北京:北京理工大学出版社, 2010.
[7]	ZHANG Xiaohui, LIN Bogang.Research on Internet of Things Security Based on Support Vector Machines with Balanced Binary Decision Tree[J]. Netinfo Security, 2015, 15(8):20-25.
	张晓惠, 林柏钢. 基于平衡二叉决策树SVM算法的物联网安全研究[J]. 信息网络安全, 2015,15(8):20-25.
[8]	CHEN Tianqi, GUESTRIN C.XGBoost: A Scalable Tree Boosting System[C]// ACM.The 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining , August 13-17, 2016, San Francisco, California, USA .New York:ACM, 2016:785-794.
[9]	BUCZAK A L, GUVEN E.A Survey of Data Mining and Machine Learning Methods for Cyber Security Intrusion Detection[J]. IEEE Communications Surveys & Tutorials, 2017, 18(2):1153-1176.
[10]	LIN Weining, CHEN Mingzhi, ZHAN Yunqing, et al.Research on an Intrusion Detection Algorithm Based on PCA and Random-forest Classification[J].Netinfo Security,2017, 17(11):50-54.
	林伟宁, 陈明志, 詹云清,等. 一种基于PCA和随机森林分类的人侵检测算法研究[J]. 信息网络安全, 2017,17(11):50-54.
[11]	MOORTHY M, SATHIYABAMA S.A Study of Intrusion Detection Using Data Mining[C]//IEEE. International Conference on Advances in Engineering, Science and Management, March 30-31, 2012, Nagapattinam, Tamil Nadu, India .NJ: IEEE, 2012:8-15.
[12]	XUE Yu, ZHANG Ying, HUANG Xiaoyan.Research on Classification Decision Algorithm and Performance Evaluation in Network Intrusion Detection[J]. Netinfo Security, 2008,8(9): 39-42.
	薛羽, 张鹰, 黄小燕. 网络入侵检测中的分类决策算法和性能评价研究[J]. 信息网络安全, 2008,8(9):39-42.

[1]	Chun GUO, Changqing CHEN, Guowei SHEN, Chaohui JIANG. A Ransomware Classification Method Based on Visualization [J]. Netinfo Security, 2020, 20(4): 31-39.
[2]	Rong WANG, Chunguang MA, Peng WU. An Intrusion Detection Method Based on Federated Learning and Convolutional Neural Network [J]. Netinfo Security, 2020, 20(4): 47-54.
[3]	Yifeng DU, Yuanbo GUO. A Dynamic Access Control Method for Fog Computing Based on Trust Value [J]. Netinfo Security, 2020, 20(4): 65-72.
[4]	Wenhua LUO, Caidian XU. Network Intrusion Detection Based on Improved MajorClust Clustering [J]. Netinfo Security, 2020, 20(2): 14-21.
[5]	Liuyang HOU, Senlin LUO, Limin PAN, Ji ZHANG. Multi-feature Android Malware Detection Method [J]. Netinfo Security, 2020, 20(1): 67-74.
[6]	Jian KANG, Jie WANG, Zhengxu LI, Guangda ZHANG. A Model for Anomaly Intrusion Detection with Different Feature Extraction Strategies in IoT [J]. Netinfo Security, 2019, 19(9): 21-25.
[7]	Wenying FENG, Xiaobo GUO, Yuanye HE, Cong XUE. Intrusion Detection Model Based on Feedforward Neural Network [J]. Netinfo Security, 2019, 19(9): 101-105.
[8]	Zewen MA, Yang LIU, Hongping XU, Hang YI. DoS Traffic Identification Technology Based on Integrated Learning [J]. Netinfo Security, 2019, 19(9): 115-119.
[9]	Xuli RAO, Pengna XU, Zhide CHEN, Li XU. Network Intrusion Detection with Incomplete Information Based on Deep Learning [J]. Netinfo Security, 2019, 19(6): 53-60.
[10]	Guanheng CHEN, Jinshu SU. Abnormal Traffic Detection Algorithm Based on Deep Neural Network [J]. Netinfo Security, 2019, 19(6): 68-75.
[11]	Chunqi TIAN, Jing LI, Wei WANG, Liqing ZHANG. A Method for Improving the Performance of Spark on Container Cluster Based on Machine Learning [J]. Netinfo Security, 2019, 19(4): 11-19.
[12]	Jinghao LIU, Siping MAO, Xiaomei FU. Intrusion Detection Model Based on ICA Algorithm and Deep Neural Network [J]. Netinfo Security, 2019, 19(3): 1-10.
[13]	Hong CHEN, Yue XIAO, Chenglong XIAO, Jianhu CHEN. The Intrusion Detection Method of SMOTE Algorithm with Maximum Dissimilarity Coefficient Density [J]. Netinfo Security, 2019, 19(3): 61-71.
[14]	Zheng TIAN, Shu LI, Yizhen SUN, Xi LI. Industrial Control System Intrusion Detection Model Based on S7 Protocol [J]. Netinfo Security, 2019, 19(11): 8-13.
[15]	Jianwei HU, Wei ZHAO, Zheng YAN, Rui ZHANG. Analysis and Implementation of SQL Injection Vulnerability Mining Technology Based on Machine Learning [J]. Netinfo Security, 2019, 19(11): 36-42.