Network intrusion detection method, device and equipment

Abstract

The invention discloses a network intrusion detection method based on a multi-agent depth deterministic strategy gradient model, and relates to the technical field of computer network security. The method comprises the steps of obtaining to-be-detected network flow data; inputting to-be-detected network traffic data into the neural network model based on the multi-agent depth deterministic strategy gradient, and detecting abnormal network traffic, wherein the determination of the neural network model based on the multi-agent depth deterministic strategy gradient comprises the following steps: obtaining a network traffic training sample; training an Actor network and a Critic network through a network traffic training sample by adopting a multi-agent depth deterministic strategy gradient; updating the Actor network parameters by adopting a strategy gradient; and updating the Critic network parameters by adopting a loss function. According to the multi-agent depth deterministic strategy gradient, a simple and rapid neural network is adopted, and the method is easier to deploy in a harsh network environment; and the detection accuracy of a small number of traffic samples can be improved in an adversarial learning mode.

Description

technical field [0001] The present invention relates to the technical field of network intrusion detection, and more specifically to a network intrusion detection method, device and equipment based on a multi-agent deep deterministic policy gradient (Multi-Agent Deep Deterministic Policy Gradient, MADDPG) model. Background technique [0002] Network intrusion detection is currently the most widely used and most effective data-driven network security active defense method, based on real-time network traffic data to establish a corresponding attack evaluation mechanism, so as to realize the detection and prevention of attack behavior. Traditional intrusion detection methods usually detect whether the current network connection is in a normal state or an attack risk state by comparing established network behavior patterns or rules. With the upgrading of the Internet environment, network traffic data presents massive, high-dimensional, complex and unbalanced characteristics, and...

AI Technical Summary

Problems solved by technology

However, due to its complex internal structure and long training and prediction time, it cannot be deployed in harsh network environments.

In addition, although it can deal with complex high-dimensional traffic data, it is difficult to solve the problem of low accuracy of abnormal attack traffic identification caused by unbalanced data sets

Images