Network Intrusion Detection and Dynamic Defense Method Based on Unsupervised Machine Learning

With the rapid development of the Internet, network security issues have become increasingly prominent, and the traditional rule-based and signature-based intrusion detection methods have been unable to meet the complex and changeable forms of network attacks. Therefore, unsupervised machine learning emerges as a potential solution to automatically learn normal patterns of network traffic and detect anomalous behavior. In this study, we first analyze the background and current status of the current field of network intrusion detection and defense. We found that traditional methods face high false positive and false negative rates, and cannot cope with unknown cyber attacks. In order to deal with these problems, we use a clustering algorithm to realize unsupervised network intrusion detection and dynamic defense. Experimental results show that the network intrusion detection and dynamic defense method based on unsupervised machine learning has achieved significant improvements in both accuracy and efficiency. The accuracy of the traditional method is only 68.49%, but the method used in this paper can reach 78.69%. Compared with traditional methods, the method proposed in this paper can better identify unknown network attacks and reduce false positive and false negative rates.