The method of network intrusion detection based on descriptive statistics model and Logistic model

In order to improve the efficiency of network intrusion detection, we want to find simpler models and detection rules, so we research the network intrusion detection with the descriptive statistics model and Logistic model. We pay attention to the features law about discrete distribution and concentrated distribution, and answer the question, which is better of relative optimal results between the descriptive statistics model and Logistic model. Firstly, for finding the features law about discrete distribution and concentrated distribution, we analysis the netflows with every feature. In this situation, the satisfactory accuracy can be given. Secondly, considering the redundant information with principal component analysis, the principal components are used as new variables to establish the logistic model. Using confusion matrix and ROC curve, the optimal cutting value and the corresponding accuracy can be obtained. Finally, by the experiments and evaluation with dataset CIC-IDS2017, the descriptive statistics model is the optimal model, which the corresponding accuracy rate is 99.93%.