Abstract:

Aiming at the problem of lower efficiency of network intrusion detection learning algorithms at present, a concept called relative distance is proposed in this paper, and then competitive activation and similarity measurement are constructed based on it. On that basis we put forward an improved network intrusion detection algorithm. The advantage of the improved algorithm is: (1) The relative distance can distinguish the terms of column with a large range very well and realize normalization in a lower complexity; (2) Competitive activation of relative distance can process the data which includes the characteristics in a lower computation complexity without converting characters into integers; (3)The algorithm needs no reset. Examination results on the KDD Cup99 sets show that the improved algorithm can reduce the learning time and the testing time significantly while maintaining the accuracy of detection compared to other approaches.

Key words: intrusion detection；competitive activation；relive distance；similarity measurement