CNN-GRU hierarchical neural network-based network intrusion detection method

Abstract

The invention relates to a network intrusion detection method based on a CNN-GRU hierarchical neural network, and the method comprises the steps: capturing a network flow data package, namely, a to-be-classified data package, through Wreshark software; performing data packet marking, preprocessing and data cleaning on the to-be-classified data packets, analyzing the data packets into decimal data, and converting the decimal data into a 40 * 40 single-channel grey-scale map to obtain a sample complete set; dividing the sample complete set into a training set and a test set, taking the single-channel grey-scale map matrix as an input vector, and establishing a CNN-GRU hierarchical neural network classification model through the training set; and after model training is completed, transmitting data of the test set are into the model, the model predicts the input data according to parameters obtained through training, and unknown network traffic is classified to judge whether the unknown network traffic is attack traffic. Experimental results show that the accuracy of the method for classifying the normal traffic and the attack traffic reaches 99.92%.

Description

technical field [0001] The invention relates to the technical field of network security, in particular to a network intrusion detection method based on a CNN-GRU layered neural network. Background technique [0002] With the rapid development of the Internet, a large number of devices and personnel have joined the Internet environment. At the same time, issues related to network traffic security have increased. Among them, network attackers often paralyze the network according to the loopholes on the Internet, causing immeasurable losses to users. In the past, such attacks often caused economic losses to enterprises, but now they include the theft of personal privacy, which has caused great harm to the rights and interests of most network users. [0003] In order to avoid such problems, we often need to be able to detect attacks by analyzing traffic data generated by network users. The key challenge is how to effectively identify traffic data with offensive behavior. Bec...

AI Technical Summary

Problems solved by technology

Traditional payload-based methods can no longer handle the increasing amount of encrypted traffic today, and traditional machine learning models are often used in machine learning-based network intrusion detection

But the common problem encountered is that it is difficult to find suitable functions as the reference standard of the network. Machine learning models usually require more quantifiable features as training references, which are not suitable for classification training with unclear features.

When using machine learning methods for classification, it will further lead to a bottleneck in accuracy, which is difficult to improve

Images