Abstract:The commonly used method for network intrusion is based on pattern matching systems, but these systems do not have high detection accuracy when facing large-scale high-speed network traffic environments. In addition, when facing a wide variety of network attacks, relying solely on a certain network security technology is difficult to ensure network security. Therefore, a distributed network intrusion prevention system based on the Spark framework and dynamic information security theory model was innovatively proposed to improve the detection efficiency of network intrusion and solve these issues. The architecture and functional structure of the network intrusion prevention system were constructed by improving the random forest algorithm and Spark. In addition, the dynamic network intrusion prevention system was designed on the basis of the Policy Protection Detection Response (P2DR) model and the Protection Detection Reaction Recovery (PDRR) model to cope with the diverse network attacks and make up for the lack of dynamic defense based on improved forest algorithm and Spark. The test results showed that the network intrusion prevention system based on the improved random forest algorithm and Spark had a maximum detection time of 13,593 ms, a minimum detection time of 13,318 ms, and an average detection time of 13,468 ms when the data were 6000 pieces. The average success rate of the dynamic network intrusion prevention system based on the dynamic information security theory model was 87.72%, the average detection rate was 71.68%, and the average false alarm rate was 17.23%. The F1 values corresponding to the improved random forest algorithm under 7 different attack types of data were 0.985, 0.983, 0.876, 0.843, 0.797, 0.983, and 0.890, respectively, which were significantly better than the comparison algorithm. It can be seen that the dynamic network intrusion prevention system based on the improved random forest algorithm, Spark, and the dynamic information security theoretical model, has good performance and can effectively detect network intrusions, providing technical support for solving network intrusion problems in reality. The contribution of the research is reflected in the improvement of the detection performance of network intrusion detection systems and the reduction of detection time and false alarm rates.

Improving Efficiency of Web Application Firewall to Detect Code Injection Attacks with Random Forest Method and Analysis Attributes HTTP Request

Efficient Based on Improved Random Forest Defense System Against Application‐Layer DDoS Attacks

Deep Learning Technique-Enabled Web Application Firewall for the Detection of Web Attacks

Enhancing Web Application Security: A Deep Learning and NLP-based Approach for Accurate Attack Detection

Weighted transformer neural network for web attack detection using request URL

Evolutionary Multi-Task Injection Testing on Web Application Firewalls

Automated Network Intrusion Detection for Internet of Things: Security Enhancements

An Efficient Network Intrusion Detection Approach Based on Deep Learning

Design and Implementation of Adaptive Intrusion Detection System Based on Web Access Behavior Relevancy

Efficient and Low Overhead Website Fingerprinting Attacks and Defenses based on TCP/IP Traffic

An AI-Powered Network Threat Detection System

Research on the technology of detecting the SQL injection attack and non-intrusive prevention in WEB system

A Web Attack Detection Method Based on DistilBERT and Feature Fusion for Power Micro-Application Server

Study of Intrusion Detecton Mondels for Web Applications

Network intrusion detection using oversampling technique and machine learning algorithms

An Intrusion Detection Model Based on Improved Random Forests Algorithm

A Multi-level Random Forest Model-Based Intrusion Detection Using Fuzzy Inference System for Internet of Things Networks

SQL Injection Attack Detection and Prevention Techniques Using Deep Learning

Real-time Distributed-Random-Forest-Based Network Intrusion Detection System Using Apache Spark

Design of distributed network intrusion prevention system based on Spark and P2DR models

Research on Principle Techniques for Network Intrusion Detection Based on Data Mining and Analysis Approach