Research on SDN intrusion detection based on online ensemble learning algorithm

The traditional block learning algorithm cannot update the classification model dynamically, and there are a lot of normal behavior data and a small amount of intrusion behavior data in the SDN network data stream, that is, the SDN network data stream is unbalanced data stream. In view of this, this paper constructs an adaptive SDN intrusion detection model, and then aims at the problem of unbalanced network data stream The bagging algorithm is improved to reduce the impact of data stream imbalance on the performance of the integrated classifier through the improvement of unbalanced detection, dynamic penalty factor, selection integration and so on. The improved online integrated learning algorithm is applied to the adaptive SDN network intrusion detection. By using NSL-KDD data set to simulate SDN network data stream, the experimental results show that the algorithm can improve the detection accuracy, especially the recognition rate of unknown intrusion behavior.