The fast‐developing computer network not only brings convenience to people but also brings security problems to people due to the appearance of various abnormal flows. However, various current detection systems for abnormal network flows have more or less flaws, such as the most common intrusion detection system (IDS). Due to the lack of self‐learning capabilities of market‐oriented IDS, developers and maintenance personnel have to update the virus database of the system in real time to make the system work normally. With the emergence of machine learning and data mining in recent years, new ideas and methods have emerged in the detection of abnormal network flows. In this paper, the random forest algorithm is introduced into the detection of abnormal samples, and the concept of abnormal point scale is proposed to measure the abnormal degree of the sample based on the similarity of the samples, and the abnormal samples are screened out according to this scale. Simulation experiments show that compared with the other two distance‐based abnormal sample detection techniques, the random forest‐based abnormal sample detection has greater advantages than the other two methods in terms of improving the accuracy of the model and reducing the computing time.
Read full abstract