Research on Intrusion Detection Technology Based on Ensemble Learning and Decision Tree Algorithm

With the development and progress of network technology, network played an increasingly important role in modern life, but with the wide application of network, network security incidents also come, and the overall number of each year has maintained a continuous rising trend. In the face of increasing network intrusion threats, how to effectively identify malicious traffic from network traffic became more and more important, and the research in the field of intrusion detection has developed from the traditional single machine learning algorithm to the combination of multiple algorithms. In this paper, Tree-ensemble, which is a combination of Ensemble learning and decision Tree algorithm, was proposed to carry out the research on intrusion detection technology. KDD99 was selected as the intrusion detection data set, the eigenvalue selection algorithm based on random forest is used to sort the importance of features, and 44 eigenvalues are selected as the classification features of normal traffic and malicious traffic. Decision tree, Random forest, Extreme tree, AdaBoosting Adaptive Boosting, Gradient Boosting Decision Tree, XGBoost, Ensemble Voting (soft-voting),Ensemble Stacking (Logistic Regression as meta-classifier) were used to build a classification model for security analysis of data KDD99. Among the constructed classification models, the XGBoost algorithm model performed best, and the models constructed by the collective voting (soft voting) and set superposition (logistic regression as a meta-classifier) methods performed well.