Network Intrusion Detection Based on Active Semi-supervised Learning

With the increasing scale and automation of network attacks, traditional detection methods have been unable to meet the demand for intrusion detection in the current network environment, and we always face with the scarcity of label data in the network environment. In view of this situation, this paper proposes a network intrusion detection algorithm based on active semi-supervised learning, by setting a minimum class-distance threshold for active learning and a highest classification threshold for semi-supervised learning, then selecting unlabeled samples with rich information content, which labeled and added to the training set to retrain the model, and iterating repeatedly until meet the established conditions. The proposed algorithm combines the weak sensitivity of semi-supervised learning to labels and the selectivity of active learning for implicit information. The experimental results on the CTU and CICIDS2017 datasets show that the various indicators of the combined algorithm have been significantly improved.