查看文章

Intrusion detection technology has received increasing attention in recent years. Many researchers have proposed various intrusion detection systems using machine learning (ML) methods. However, there are two noteworthy factors affecting the robustness of the model. One is the severe imbalance of network traffic in different categories and the other is the nonidentical distribution between training set and test set in feature space. This paper presents a multilevel intrusion detection model framework named multilevel semi-supervised ML (MSML) to address these issues. The MSML framework includes four modules: 1) pure cluster extraction; 2) pattern discovery; 3) fine-grained classification (FC); and 4) model updating. In the pure cluster module, we introduce an concept of “pure cluster” and propose a hierarchical semi-supervised k-means algorithm with an aim to find out all the pure clusters. In the pattern …