Network intrusion detection method based on improved BYOL self-supervised learning

Abstract

The invention discloses a network intrusion detection method for improving BYOL self-supervised learning, and the method comprises the following steps: 1, carrying out the preprocessing of a UNSW-NB15 intrusion detection data set, and carrying out the one-hot coding processing and data normalization processing of character type data; step 2, training an improved BYOL intrusion detection model, and step 3, testing the improved BYOL intrusion detection model, inputting a preprocessed test data set into a feature extraction encoder f theta to obtain a feature representation of each piece of data in the data set, and inputting the feature representation into a classifier to obtain a classification result of each piece of data. The method has the advantages that BoTNet of a multi-head attention mechanism is introduced to suppress features with small contribution to classification in intrusion detection data, and features with large contribution to classification are increased, so that various performance indexes of the model are enhanced; and a BYOL loss function is optimized, so that the model training process is more stable and the convergence speed is accelerated, and the stability and robustness of the model are enhanced.

Description

technical field [0001] The invention relates to a network intrusion detection method for improving BYOL self-supervised learning, and belongs to the technical field of network intrusion detection. Background technique [0002] With the advent of the information age and the popularization of the Internet, all aspects of our lives have undergone great changes. While the Internet has brought us great convenience, it has also brought various network security issues. How to avoid these security problems has become the focus of close attention in the industry. As an important part of the network security system, intrusion detection was first proposed by Anderson, who defined intrusion attempts or threats as: potential, premeditated, unauthorized An attempt to authorize access to information, to manipulate information, and to render the system unreliable or unusable. The earliest intrusion detection model was proposed by Denning. The model mainly generates several contours of the ...

AI Technical Summary

Problems solved by technology

In the past, most researchers used pattern matching algorithms to analyze data, and feature selection usually included three schemes, namely filtering methods (such as information gain and correlation coefficient algorithms); encapsulation methods (such as genetic algorithms and particle swarm optimization methods). Algorithm[); embedded methods (such as LASSO regression algorithm), feature extraction uses linear transformation methods, such as principal component analysis (Principal Component Analysis, PCA) and linear discriminant analysis, etc., and nonlinear transformation methods, such as kernel-based method Principal component analysis, etc., but the above methods all have certain defects, for example, the genetic algorithm is prone to premature convergence, and the meaning of each feature dimension of the principal component in the PCA algorithm has certain ambiguity, which is not as strong as the interpretability of the original sample, etc.

[0003] Traditional NIDS also has a lot of problems: poor detection ability for unknown attacks, high false alarm rate, and high resource occupation. In view of the advantages of machine learning algorithms, such as easy understanding and explanation, strong generalization ability, and simple implementation, traditional machine learning Algorithms such as Support Vector Machine (Support Vector Machine, SVM), Decision Tree (Decision Tree, DT) and K Nearest Neighbor algorithm (K Nearest Neighbor) are introduced into the field of intrusion detection to improve the efficiency of intrusion detection, reduce the false negative rate and false positive rate

Although unsupervised learning does not require labeled data, the features learned by unsupervised learning are only applicable to this data set and cannot be transferred to other data sets, which undoubtedly limits the generalization ability of the model.

Images