Intrusion Detection Method Based on Deep Learning

In order to solve the problem of high false alarm rate and low false alarm rate in massive network data intrusion detection, this paper proposes an intrusion detection model based on convolution neural network, which can improve the classification accuracy by selecting convolution core and data to extract local feature correlation features. Introduction In 2016, China's total digital economy reached 22.6 trillion yuan, accounting for more than 30% of GDP. While the Internet promotes social scientific and technological progress and simplifies users'lives, it poses unprecedented challenges to information security. (1)"China Internet Network Security Report 2017" is the National Computer Network Emergency Technology Processing and Coordination Center (hereinafter referred to as "CNCERT"). According to the situation of CNVD vulnerabilities, the number of new general software and hardware vulnerabilities has increased by more than 20% annually in the past three years. In 2017, (2)the number of CNVD "zero-day" vulnerabilities increased by 75.0% year on year. (3) Extortion software and "mining" Trojan Horse have an increasing trend. First, our country is suffering more and more network attacks. Network attacks generally refer to all attempts to bypass system security policies or penetrate the system in order to obtain, tamper with, destroy information and target networks and systems. The main reasons are network software vulnerabilities and security vulnerabilities of network protocols themselves. The goal of network intrusion detection is to identify the abnormal behavior of network and system. We can treat this problem as a classification problem to solve. The advantages of neural networks, especially convolutional neural networks in self-learning and non-linearization, have made remarkable achievements in image recognition, speech recognition and natural language processing. In view of the excellent feature classification ability of neural networks, scholars at home and abroad have applied neural networks to network attack detection and achieved some results. This paper analyses and compares the performance of current popular deep learning algorithms in NSL-KDD experiments, and proposes an intrusion detection method based on convolutional neural network. Deep Learning Algorithms In 2006, Hinton et al. proposed to build a multi-layer neural network model by simulating human thinking mode and building the ability to recognize things and distinguish things. This process is called in-depth learning. Deep learning has a multi-level learning framework, which makes many abstract transformations of input features. It has the characteristics of deep-seated, non-linear and layer-by-layer feature extraction. Therefore, it has a strong ability of feature expression and can solve more complex problems. Convolutional neural network is a commonly used deep learning algorithm. The difference between convolutional neural network and shallow neural network is that the feature extractor is composed of convolution layer and sub-sampling layer. The convolution layer is locally connected, so a neuron is only connected with several adjacent neurons. The main purpose is to reduce the amount of calculation. The convolution kernel values used in convolution neural networks are usually initialized in the form of decimal matrix, and the decimal matrix is generated randomly, but in the process of network training, it will gradually proceed to the direction of model 2019 9th International Conference on Management and Computer Science (ICMCS 2019) Copyright © (2019) Francis Academic Press, UK DOI: 10.25236/icmcs.2019. 040 197 optimization, and then get a reasonable matrix value. The basic computational unit of in-depth learning is a single neuron. The composition of neurons is shown in the following figure: Figure. 1. Neuronal structure The inputs of neurons are x1, x2, X3 and the outputs are g (x). (1) We decompose formula (1-1) into formula (1-2) and formula (1-3), where formula (1-3) is the activation function Sigmoid function.