基于GBDT优化算法的局域网入侵定位与检测研究

Research on LAN Intrusion Location and Detection Based on GBDT Optimization Algorithm

摘要:

入侵检测方法可以在局域网攻击造成广泛破坏之前发现攻击,并据此制定相应的防御措施。为保证局域网的运行安全,提出基于GBDT优化算法的局域网入侵定位与检测方法。考虑局域网的组成结构与工作原理,构建局域网数学模型。在该模型下,根据不同入侵类型的攻击原理,设置入侵检测标准。局域网实时运行数据采集与预处理,从时域和频域两个方面提取局域网的运行特征。利用GBDT优化算法构建局域网入侵分类器,匹配局域网运行数据特征,追踪局域网入侵源位置,最终得出入侵源定位与入侵状态、类型的检测结果。通过性能测试实验,发现与传统方法相比,优化设计方法的入侵定位误差降低了5.75m,入侵类型与入侵数量的正确检测率分别提高13.8%和15.4%,即优化设计方法在定位与检测性能方面具有明显优势。

Abstract:

Intrusion detection methods can detect local area network attacks before causing widespread damage, and develop corresponding defense measures accordingly. To ensure the operational security of the local area network, a local area network intrusion localization and detection method based on the GBDT optimization algorithm is proposed. Consider the composition structure and working principle of the local area network, and construct a mathematical model of the local area network. Under this model, intrusion detection standards are set based on the attack principles of different intrusion types. Real time operation data collection and preprocessing of the local area network, extracting the operational characteristics of the local area network from both time-domain and frequency-domain aspects. Using the GBDT optimization algorithm to construct a local area network intrusion classifier, matching the characteristics of local area network operation data, tracking the location of local area network intrusion sources, and ultimately obtaining the detection results of intrusion source localization, intrusion status, and type. Through performance testing experiments, it was found that compared with traditional methods, the optimized design method reduced the intrusion localization error by 5.75m, and improved the correct detection rates of intrusion types and intrusion quantities by 13.8% and 15.4%, respectively. This indicates that the optimized design method has significant advantages in localization and detection performance.