Abstract: Resampling methods are commonly used for dealing with the class-imbalance problem.To improve the detection rate of the minority attack in network intrusion detection and reduce the imbalance ratio.A novel algorithm named Fast Hierarchical Nearest Neighbor（FHNN） is prsented to select representative samples from network data sets.Taking the two-stage strategy with load balancing model for high-speed network intrusion detection system（HNIDS），the training dataset is splited by the protocol and the patterns for each dataset is built.Experimental results show FHNN is very efficient in tacking noise and majority class examples and faster than other methods while taking a linear order.FHNN is efficient method for rapid detection various types of attacks from the mass data.

Key words: imbalanced data, resampling methods, Network Intrusion Detection system, Neighborhood Cleaning Rule, Adaboost algorithm

摘要： 重抽样方法是常用的解决数据非平衡问题的一种有效手段，为提高入侵检测系统的检测效率，降低数据的不平衡程度，提出了快速分层最近邻FHNN重抽样方法，采用两阶段的基于负载均衡策略的高速网络入侵检测模型，按协议类型把KDD’99的训练数据集划分并在每类子集上进行了各种实验。实验结果表明该方法不仅可以很好地删除噪声数据和冗余信息，尤其是类区域内样本，减小数据的不平衡度和样本总量，而且由于算法时间复杂度是线性阶的，在样本数量很大的情况下，运行速度非常快，适合从海量的数据中快速而有效地检测各类攻击。

关键词: 非均衡数据, 重抽样方法, 网络入侵检测系统, NCL算法, AdaBoost算法