A network intrusion detection method, system, electronic device and storage medium

Abstract

The application discloses a network intrusion detection method and system, electronic equipment and a storage medium. The method inputs to-be-detected data into a plurality of trained classifiers to perform network intrusion detection, and obtains an intrusion detection result output by each trained classifier. A firefly algorithm is used to perform firefly position optimization on each first firefly population to obtain a target firefly individual. The target firefly individuals of each first firefly population are combined to form a new population, and a target firefly individual meeting a target condition in the new population is found out. The target firefly individual in the new population is added to each first firefly population as a second firefly population for next iteration until the firefly algorithm reaches a maximum iteration number, and the position of the target firefly individual is obtained. According to a plurality of weight coefficients and the intrusion detection result output by each trained classifier, a final intrusion detection result is calculated. The application can improve the accuracy of network intrusion detection.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection technology, and in particular to a network intrusion detection method, system, electronic device, and storage medium. Background Technology

[0002] To address the imbalanced sample problem in network intrusion detection scenarios, existing technologies typically employ either oversampling or undersampling methods alone. For oversampling, one approach is an intrusion detection system based on adaptive synthetic oversampling and LightGBM. This method primarily uses the ADASYN oversampling technique to increase the number of minority attack samples, thus mitigating the low detection rate of minority attacks caused by imbalanced training data. Another approach is an online oversampling principal component analysis algorithm for intrusion detection, which allows for the identification of anomalies in target instances based on changes in the generated dominant feature vectors. For undersampling, one approach is cluster-based, using density-based clustering to learn the intrusion detection dataset to identify intrusion behaviors. Yet another approach uses a cluster-based undersampling random forest classifier to balance the imbalanced sample size, thereby improving intrusion detection accuracy.

[0003] Existing undersampling techniques waste data, and the data retained by undersampling cannot effectively represent the characteristics of the samples. On the other hand, existing oversampling techniques often introduce too much data that deviates from the sample distribution characteristics, thus making the intrusion detection effect worse. Summary of the Invention

[0004] This invention aims to address at least one of the technical problems existing in the prior art. To this end, this invention proposes a network intrusion detection method, system, electronic device, and storage medium, which can solve the problems of data waste, sampled data not effectively representing sample characteristics, and the introduction of too much data deviating from the sample distribution characteristics, thereby improving the accuracy of network intrusion detection.

[0005] In a first aspect, embodiments of the present invention provide a network intrusion detection method, the network intrusion detection method comprising:

[0006] Acquire the data to be detected, a number of positive samples, and a number of negative samples;

[0007] The data to be detected is input into multiple trained classifiers for network intrusion detection, and the intrusion detection result output by each trained classifier is obtained; wherein, the training method of the multiple classifiers is as follows:

[0008] Calculate the number of the first undersampled group and the number of the second oversampled group based on the number of positive samples and the number of negative samples;

[0009] Undersample the positive samples based on the first set of numbers to obtain the undersampled dataset of the first set of numbers; each set of the undersampled dataset contains the same number of positive samples and negative samples;

[0010] Based on the second set of numbers, the remaining positive samples after undersampling are oversampled to obtain the oversampled dataset of the second set of numbers; each set of the oversampled dataset contains the same number of positive samples and negative samples;

[0011] A classifier is trained separately for each of the undersampled and oversampled datasets to obtain multiple trained classifiers.

[0012] Initialize the firefly algorithm parameters and obtain multiple firefly individuals. Group the firefly individuals to obtain multiple first firefly populations. Then, use the firefly algorithm to optimize the firefly positions in each first firefly population to obtain target firefly individuals that meet the target conditions in each first firefly population after position optimization.

[0013] The target firefly individuals from each of the first firefly populations are grouped into a new population. Target firefly individuals in the new population that meet the target conditions are identified, and these individuals are added to each of the first firefly populations as the second firefly population for the next iteration. This process continues until the firefly algorithm reaches its maximum iteration count, yielding the position of the target firefly individual. The position of the target firefly individual includes multiple weight coefficients, each corresponding to a different classifier.

[0014] The final intrusion detection result is calculated based on the multiple weight coefficients and the intrusion detection results output by each trained classifier.

[0015] Compared with the prior art, the first aspect of the present invention has the following beneficial effects:

[0016] This method calculates the number of undersampled first groups and oversampled second groups based on the number of positive and negative samples. Positive samples are undersampled according to the first group number, and the remaining positive samples after undersampling are oversampled according to the second group number. This creates multiple balanced groups through oversampling and undersampling, thus solving problems such as data waste, ineffective representation of sample features by sampled data, and the introduction of excessive data deviating from the sample distribution characteristics. Furthermore, training a classifier with a balanced dataset improves the accuracy of intrusion detection. The method initializes the firefly algorithm parameters and obtains multiple firefly individuals. These individuals are then grouped to obtain multiple first firefly populations. The firefly algorithm is then used to optimize the firefly positions in each first firefly population, resulting in target firefly individuals that meet the target conditions within each optimized first firefly population. By dividing several firefly individuals into several populations, different populations can perform parallel computations without interference. This improves the training speed of the firefly algorithm and accelerates its convergence. It combines target firefly individuals from each first firefly population into a new population, identifies target firefly individuals in the new population that meet the target conditions, and adds these target firefly individuals to each first firefly population as the second firefly population for the next iteration. This process continues until the firefly algorithm reaches its maximum number of iterations and obtains the location of the target firefly individuals. By combining target firefly individuals from different populations into a new population, information exchange between different populations is achieved, enabling the search for a better solution and improving the accuracy of the target firefly individual's location. Based on multiple weight coefficients and the intrusion detection results output by each trained classifier, the final intrusion detection result is calculated. Because the accuracy of the target firefly individual's location is improved, and the target firefly individual's location includes multiple weight coefficients, the accuracy of the final intrusion detection result calculated based on these weight coefficients is further enhanced.

[0017] According to some embodiments of the present invention, the classifier employs a Naive Bayes classifier.

[0018] According to some embodiments of the present invention, the step of undersampling positive samples based on the first set of numbers to obtain an undersampled dataset of the first set of numbers includes:

[0019] Based on the first set of numbers, a random non-repeating undersampling method is used to undersample the number of positive samples to obtain the undersampled dataset of the first set of numbers.

[0020] According to some embodiments of the present invention, the step of oversampling the remaining positive samples after undersampling based on the second set of numbers to obtain the oversampled dataset of the second set of numbers includes:

[0021] Based on the second set of numbers, the SMOTE oversampling method is used to oversample the remaining positive samples after undersampling to obtain the oversampled dataset of the second set of numbers.

[0022] According to some embodiments of the present invention, the step of optimizing the firefly positions in each of the first firefly populations using the firefly algorithm to obtain target firefly individuals in each of the first firefly populations that meet the target conditions after position optimization includes:

[0023] Calculate the attraction of each individual firefly in each of the first firefly populations to nearby firefly individuals.

[0024] Calculate the fitness value of the current position of each firefly individual in each of the first firefly populations;

[0025] Based on the attraction level, the brightest firefly individual is selected, and its position is updated by randomly moving its position to obtain the first position;

[0026] For firefly individuals other than the one with the highest brightness, each firefly individual finds a nearby firefly individual with high attraction to itself and moves closer to the firefly individual with high attraction to obtain a second position;

[0027] Calculate the fitness value of the first position or the second position. If the fitness value of the first position or the second position is better than the fitness value of the current position before flight, then the firefly individual flies to the first position or the second position.

[0028] By comparing the fitness values ​​of each firefly position after position optimization, the individual firefly with the best fitness value in each of the first firefly populations is obtained.

[0029] According to some embodiments of the present invention, the step of forming a new population from the target firefly individuals in each of the first firefly populations, identifying the target firefly individuals in the new population that meet the target conditions, and adding the target firefly individuals in the new population to each of the first firefly populations as the second firefly population for the next iteration, until the firefly algorithm reaches the maximum number of iterations to obtain the position of the target firefly individual, includes:

[0030] The target firefly individuals of each of the first firefly populations are combined into a new population, and the firefly position is optimized by the firefly algorithm in the new population to obtain the first target firefly individuals in the new population that meet the target conditions after position optimization.

[0031] The first target firefly individuals in the new population are added to each first firefly population as the second firefly population for the next iteration;

[0032] For each second firefly population, the firefly algorithm is used to optimize the firefly positions, and the target firefly individuals in each second firefly population that meet the target conditions are obtained after position optimization.

[0033] The target firefly individuals in each second firefly population are grouped into a new population. The second target firefly individuals in the new population that meet the target conditions are identified. The second target firefly individuals in the new population are added to each second firefly population as the third firefly population for the next iteration. This process continues until the firefly algorithm reaches the maximum number of iterations and the location of the target firefly individuals is obtained.

[0034] According to some embodiments of the present invention, the final intrusion detection result is calculated using the following formula:

[0035]

[0036] Where i represents the i-th group, P i P represents the number of positive samples. j W represents the number of negative samples. i R represents the weight coefficient of the i-th group. i Result represents the intrusion detection result output by the i-th classifier, and Result represents the final intrusion detection result.

[0037] Secondly, embodiments of the present invention also provide a network intrusion detection system, the network intrusion detection system comprising:

[0038] The data acquisition module is used to acquire the data to be detected, a number of positive samples, and a number of negative samples;

[0039] An intrusion detection module is used to input the data to be detected into multiple trained classifiers for network intrusion detection, and obtain the intrusion detection result output by each trained classifier; the intrusion detection module includes a data calculation submodule, an undersampling submodule, an oversampling submodule, and a data training submodule, wherein:

[0040] The data calculation submodule is used to calculate the number of the first undersampled group and the number of the second oversampled group based on the number of positive samples and the number of negative samples.

[0041] The undersampling submodule is used to undersample positive samples based on the first set of numbers to obtain an undersampled dataset of the first set of numbers; each set of the undersampled dataset contains the same number of positive samples and negative samples;

[0042] The oversampling submodule is used to oversample the remaining positive samples after undersampling according to the second set of numbers to obtain the oversampled dataset of the second set of numbers; each set of the oversampled dataset contains the same number of positive samples and negative samples;

[0043] The data training submodule is used to train a classifier separately for each group of the undersampled dataset and the oversampled dataset to obtain multiple trained classifiers.

[0044] The location optimization module is used to initialize the firefly algorithm parameters and obtain multiple firefly individuals, group the multiple firefly individuals to obtain multiple first firefly populations, and use the firefly algorithm to optimize the firefly location in each first firefly population to obtain the target firefly individuals in each first firefly population that meet the target conditions after location optimization.

[0045] The weight coefficient acquisition module is used to form a new population from the target firefly individuals in each of the first firefly populations, identify the target firefly individuals in the new population that meet the target conditions, and add the target firefly individuals in the new population to each of the first firefly populations as the second firefly population for the next iteration, until the firefly algorithm reaches the maximum number of iterations to obtain the position of the target firefly individual; the position of the target firefly individual includes multiple weight coefficients, and the multiple weight coefficients correspond to each of the classifiers;

[0046] The detection result acquisition module is used to calculate the final intrusion detection result based on the multiple weight coefficients and the intrusion detection result output by each trained classifier.

[0047] Thirdly, embodiments of the present invention also provide an electronic device, comprising:

[0048] At least one memory;

[0049] At least one processor;

[0050] At least one computer program;

[0051] The at least one computer program is stored in the at least one memory, and the at least one processor executes the at least one computer program to implement the network intrusion detection method described in the first aspect above.

[0052] Fourthly, embodiments of the present invention also provide a storage medium, which is a computer-readable storage medium storing a computer program for causing a computer to execute the network intrusion detection method described in the first aspect above.

[0053] It is understood that the beneficial effects of the second to fourth aspects compared with the related technologies are the same as the beneficial effects of the first aspect compared with the related technologies. Please refer to the relevant description in the first aspect above, which will not be repeated here. Attached Figure Description

[0054] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the description of the embodiments taken in conjunction with the following drawings, in which:

[0055] Figure 1 This is a flowchart of a network intrusion detection method according to an embodiment of the present invention;

[0056] Figure 2 This is a flowchart of step S200 in an embodiment of the present invention;

[0057] Figure 3 This is a schematic diagram illustrating the reconstruction of a dataset by combining oversampling and undersampling according to an embodiment of the present invention;

[0058] Figure 4 This is a flowchart of undersampling according to an embodiment of the present invention;

[0059] Figure 5 This is a flowchart of oversampling according to an embodiment of the present invention;

[0060] Figure 6 This is a structural diagram of a network intrusion detection system according to an embodiment of the present invention;

[0061] Figure 7 This is a structural diagram of a submodule in an intrusion detection module according to an embodiment of the present invention;

[0062] Figure 8 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0063] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0064] In the description of this invention, the use of terms such as "first," "second," etc., is for the purpose of distinguishing technical features only and should not be construed as indicating or implying relative importance, or implicitly indicating the number of technical features indicated, or implicitly indicating the order of the technical features indicated.

[0065] In the description of this invention, it should be understood that the orientation descriptions, such as up, down, etc., are based on the orientation or positional relationship shown in the drawings and are only for the convenience of describing this invention and simplifying the description, and are not intended to indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.

[0066] In the description of this invention, it should be noted that, unless otherwise explicitly defined, terms such as "setting," "installation," and "connection" should be interpreted broadly, and those skilled in the art can reasonably determine the specific meaning of the above terms in this invention in conjunction with the specific content of the technical solution.

[0067] To address the imbalanced sample problem in network intrusion detection scenarios, existing technologies typically employ either oversampling or undersampling methods alone. For oversampling, one approach is an intrusion detection system based on adaptive synthetic oversampling and LightGBM. This method primarily uses the ADASYN oversampling technique to increase the number of minority attack samples, thus mitigating the low detection rate of minority attacks caused by imbalanced training data. Another approach is an online oversampling principal component analysis algorithm for intrusion detection, which allows for the identification of anomalies in target instances based on changes in the generated dominant feature vectors. For undersampling, one approach is cluster-based, using density-based clustering to learn the intrusion detection dataset to identify intrusion behaviors. Yet another approach uses a cluster-based undersampling random forest classifier to balance the imbalanced sample size, thereby improving intrusion detection accuracy.

[0068] Existing undersampling techniques waste data, and the data retained by undersampling cannot effectively represent the characteristics of the samples. On the other hand, existing oversampling techniques often introduce too much data that deviates from the sample distribution characteristics, thus making the intrusion detection effect worse.

[0069] To address the aforementioned issues, this invention calculates the number of undersampled first groups and oversampled second groups based on the number of positive and negative samples. Positive samples are undersampled according to the first group number, and oversampled according to the second group number. This process creates multiple balanced groups, thus resolving issues of data waste, ineffective representation of sample features by sampled data, and the introduction of excessive data deviating from the sample distribution. Furthermore, training a classifier with a balanced dataset improves the accuracy of intrusion detection. The invention initializes the firefly algorithm parameters and obtains multiple firefly individuals. These individuals are then grouped to create multiple first firefly populations. The firefly algorithm is then used to optimize the firefly positions within each first firefly population, resulting in target firefly individuals that meet the target conditions. By dividing several firefly individuals into several populations, parallel computation between different populations is achieved without interference. This improves the training speed of the firefly algorithm and accelerates its convergence. The target fireflies from each first firefly population are grouped into a new population. Target fireflies meeting the target criteria in the new population are identified and added to each first firefly population as the second firefly population for the next iteration. This process continues until the firefly algorithm reaches its maximum iteration count, yielding the location of the target fireflies. By combining target fireflies from different populations into a new population, information exchange between different populations is achieved, enabling the search for a better solution and improving the accuracy of the target firefly location. The final intrusion detection result is calculated based on multiple weight coefficients and the intrusion detection results output by each trained classifier. Since the accuracy of the target firefly location is improved, and the target firefly location includes multiple weight coefficients, the accuracy of the final intrusion detection result calculated based on these weight coefficients is further enhanced.

[0070] Reference Figures 1 to 2 This invention provides a network intrusion detection method, which includes, but is not limited to, steps S100 to S500, wherein:

[0071] Step S100: Obtain the data to be detected, a number of positive samples, and a number of negative samples;

[0072] Step S200: Input the data to be detected into multiple trained classifiers for network intrusion detection, and obtain the intrusion detection result output by each trained classifier; wherein, the training method of multiple classifiers is as follows:

[0073] Step S210: Calculate the number of the first undersampled group and the number of the second oversampled group based on the number of positive samples and the number of negative samples;

[0074] Step S220: Undersample the positive samples according to the first set of numbers to obtain the undersampled dataset of the first set of numbers; each undersampled dataset contains the same number of positive samples and negative samples;

[0075] Step S230: Oversample the remaining positive samples after undersampling according to the second set of numbers to obtain the oversampled dataset of the second set of numbers; each oversampled dataset contains the same number of positive samples and negative samples;

[0076] Step S240: Train a classifier separately for each undersampled dataset and oversampled dataset to obtain multiple trained classifiers;

[0077] Step S300: Initialize the firefly algorithm parameters and obtain multiple firefly individuals. Group the firefly individuals to obtain multiple first firefly populations. Then, use the firefly algorithm to optimize the firefly positions in each first firefly population to obtain the target firefly individuals that meet the target conditions in each first firefly population after position optimization.

[0078] Step S400: Form a new population from the target fireflies of each first firefly population, find the target fireflies in the new population that meet the target conditions, and add the target fireflies in the new population to each first firefly population as the second firefly population for the next iteration, until the firefly algorithm reaches the maximum number of iterations, and obtain the position of the target firefly individual; the position of the target firefly individual includes multiple weight coefficients, and the multiple weight coefficients correspond to each classifier;

[0079] Step S500: Calculate the final intrusion detection result based on multiple weight coefficients and the intrusion detection results output by each trained classifier.

[0080] In steps S100 to S500 of some embodiments, to improve the accuracy of intrusion detection, this embodiment inputs the data to be detected into multiple trained classifiers for network intrusion detection, and obtains the intrusion detection result output by each trained classifier. To address the problems of data waste, the inability of sampled data to effectively represent sample features, and the introduction of too much data deviating from the sample distribution characteristics, this embodiment calculates the number of undersampled first groups and the number of oversampled second groups based on the number of positive samples and the number of negative samples. Positive samples are undersampled based on the number of the first group, and positive samples are oversampled based on the number of the second group, forming multiple balanced groups through oversampling and undersampling. To improve the training speed of the firefly algorithm and accelerate algorithm convergence, this embodiment initializes the firefly algorithm parameters and obtains multiple firefly individuals, then groups several firefly individuals. Multiple first firefly populations are obtained; and the firefly algorithm is used to optimize the firefly positions in each first firefly population to obtain target firefly individuals that meet the target conditions in each first firefly population after position optimization. In order to further improve the accuracy of intrusion detection results, this embodiment forms a new population by combining the target firefly individuals in each first firefly population, finds the target firefly individuals that meet the target conditions in the new population, and adds the target firefly individuals in the new population to each first firefly population as the second firefly population for the next iteration, until the firefly algorithm reaches the maximum number of iterations and obtains the position of the target firefly individual. The position of the target firefly individual includes multiple weight coefficients, which correspond to each classifier. The final intrusion detection result is calculated based on the multiple weight coefficients and the intrusion detection results output by each trained classifier.

[0081] It should be noted that the target firefly in this embodiment is the optimal firefly, and the optimal firefly in the group is the firefly with the highest brightness.

[0082] In some embodiments, the classifier is a Naive Bayes classifier.

[0083] This embodiment employs the Naive Bayes classifier. Since the multiple datasets constructed through a combination of undersampling and oversampling are balanced small-sample datasets, the Naive Bayes algorithm typically outperforms other classification algorithms on small datasets. This is because the Naive Bayes algorithm does not require estimating many parameters, can handle high-dimensional datasets, and has a high tolerance for missing data. In the Naive Bayes classification algorithm, if a feature value is missing in the training set, that feature is only ignored when calculating the probability, rather than discarding the entire sample. This tolerance allows the Naive Bayes algorithm to effectively classify data even with missing data.

[0084] In some embodiments, undersampling of positive samples based on a first set of numbers yields an undersampled dataset of the first set of numbers, including:

[0085] Based on the first set of numbers, a random non-repeating undersampling method is used to undersample a number of positive samples to obtain the undersampled dataset of the first set of numbers.

[0086] In this embodiment, a random non-repeating undersampling method is used to undersample a number of positive samples according to the number of negative samples, thereby constructing a first set of balanced undersampled datasets, which solves the problems of data waste and the inability of sampled data to effectively represent sample features.

[0087] In some embodiments, the remaining positive samples after undersampling are oversampled according to the second set of numbers to obtain an oversampled dataset of the second set of numbers, including:

[0088] Based on the second set of numbers, the SMOTE oversampling method is used to oversample the remaining positive samples after undersampling to obtain the oversampled dataset of the second set of numbers.

[0089] In this embodiment, the SMOTE oversampling method is used to oversample the remaining positive samples after undersampling according to the number of negative samples, thereby constructing a second set of balanced oversampled datasets, which solves the problem of introducing too much data that deviates from the sample distribution characteristics.

[0090] In some embodiments, the firefly algorithm is used to optimize the firefly positions for each first firefly population to obtain target firefly individuals in each first firefly population that meet the target conditions after position optimization, including:

[0091] Calculate the attraction of each individual firefly in each first firefly population to nearby firefly individuals;

[0092] Calculate the fitness value of the current position of each firefly individual in each first firefly population;

[0093] Based on the attraction level, select the firefly with the highest brightness and update its position by randomly moving it to obtain the first position;

[0094] For all firefly individuals except the one with the highest brightness, each firefly individual finds a nearby firefly individual with high attraction to itself and moves closer to the firefly individual with high attraction to obtain a second position;

[0095] Calculate the fitness value of the first or second position. If the fitness value of the first or second position is better than the fitness value of the current position before flight, then the firefly individual flies to the first or second position.

[0096] By comparing the fitness values ​​of each firefly position after position optimization, the individual firefly with the best fitness value in each first firefly population is obtained.

[0097] In this embodiment, by dividing several individual fireflies into several populations, the different populations can perform parallel computations without interfering with each other, thereby improving the training speed of the firefly algorithm and accelerating algorithm convergence.

[0098] In some embodiments, the target firefly individuals in each first firefly population are grouped into a new population. The target firefly individuals in the new population that meet the target criteria are identified, and these target firefly individuals are added to each first firefly population as the second firefly population for the next iteration. This process continues until the firefly algorithm reaches its maximum iteration count, obtaining the location of the target firefly individuals, including:

[0099] Each target firefly individual in the first firefly population is combined into a new population. The firefly algorithm is used to optimize the firefly positions in the new population to obtain the first target firefly individual in the new population that meets the target conditions after position optimization.

[0100] The first target firefly individual in the new population is added to each first firefly population as the second firefly population for the next iteration;

[0101] For each second firefly population, the firefly algorithm is used to optimize the firefly positions, and the target firefly individuals in each second firefly population that meet the target conditions are obtained after position optimization.

[0102] Each second firefly population forms a new population from the target firefly individuals. The second target firefly individuals in the new population that meet the target conditions are then identified. These second target firefly individuals are added to each second firefly population as the third firefly population for the next iteration. This process continues until the firefly algorithm reaches its maximum number of iterations, at which point the location of the target firefly individuals is obtained.

[0103] In this embodiment, by combining target firefly individuals from different populations into a new population, information exchange between different populations is achieved, thereby enabling the search for a better solution and improving the accuracy of the location of the target firefly individuals.

[0104] In some embodiments, the final intrusion detection result is calculated using the following formula:

[0105]

[0106] Where i represents the i-th group, P i P represents the number of positive samples. j W represents the number of negative samples. i R represents the weight coefficient of the i-th group. iResult represents the intrusion detection result output by the i-th classifier, and Result represents the final intrusion detection result.

[0107] In this embodiment, the accuracy of the location of the target firefly individual is improved, and the location of the target firefly individual includes multiple weighting coefficients, which further improves the accuracy of the final intrusion detection result calculated based on multiple weighting coefficients.

[0108] To facilitate understanding by those skilled in the art, a set of preferred embodiments is provided below:

[0109] Step S21: Obtain a number of benign and malicious samples, and calculate the ratio of benign samples (i.e., positive samples) to malicious samples (i.e., negative samples): P i :P j .

[0110] Step S22: Calculate the total number of sampling groups = P i / / P j +1 ( / / means division by integer), where P i / / P j A value of 1 indicates that the number of benign and malicious samples is exactly balanced, while a value of 1 indicates that the number of remaining benign samples is less than the number of malicious samples. In this case, the group with fewer benign samples needs to be expanded to achieve a balance between benign and malicious samples. For example:

[0111] Reference Figure 3 , Figure 3 China P i It is P j The number of benign and malicious samples is 4.6 times that of the previous group, so undersampling can generate 4 groups with a balanced number of benign and malicious samples. The remaining 0.6 benign samples in the 5th group need to be oversampled to expand the number of samples so that the number of benign and malicious samples is balanced.

[0112] Step S23: Randomly undersample non-repeating data from the positive samples. The undersampling standard is: the number of positive samples in each group is equal to the number of negative samples, thereby constructing P. i / / P j Group balancing dataset (i.e., undersampled dataset), the undersampling process is as follows Figure 4 .

[0113] Step S24: Since the number of positive samples is often not an integer multiple of the number of negative samples, the remaining dataset after sampling the positive samples is oversampled using SMOTE. The oversampling standard is: the remaining positive samples are oversampled according to the number of negative samples to reconstruct a balanced dataset (i.e., the oversampled dataset). The oversampling process is as follows. Figure 5 .

[0114] Specifically, refer to Figure 3 In the original dataset, the number of benign samples A1 is much greater than the number of malicious samples B. To balance the positive and negative samples, benign samples need to be sampled. First, A1 is randomly undersampled, and the sampled samples are placed into group 1, making the number of benign samples in group 1 the same as the number of malicious samples B. At the same time, all malicious samples B are copied and placed into group 1. The above process is repeated until a balanced dataset of 4 groups of samples is obtained. At this point, there are still some samples remaining in A1. To reduce data waste, this embodiment performs SMOTE oversampling on the remaining samples A2, making the final data volume after oversampling consistent with the data volume of malicious samples B. Similarly, this embodiment places the oversampled dataset into group 5, and also places malicious samples B into group 5. Thus, this embodiment fully utilizes all samples in the original dataset, ensuring that high-quality samples are not lost.

[0115] Step S25: P constructed using the above steps i / / P j Multiple classifiers are trained using one set of undersampled datasets and one set of oversampled datasets. Specifically, this embodiment uses a Naive Bayes classifier with P... i / / P j One set of undersampled datasets and one set of oversampled datasets for P i / / P j +1 classifiers are trained separately. One set of classifiers is trained for each set of datasets. The parameters of each set of classifiers are optimized so that each set of classifiers can perform optimally, and each set of trained classifiers is obtained.

[0116] The datasets constructed through a combination of undersampling and oversampling are all balanced small-sample datasets, and the Naive Bayes algorithm typically outperforms other classification algorithms on small datasets. This is because the Naive Bayes algorithm does not require estimating many parameters and can handle high-dimensional datasets. Furthermore, the Naive Bayes classification algorithm has a high tolerance for missing data: if a feature value is missing in the training set, it is only ignored when calculating the probability, rather than discarding the entire sample. This tolerance allows the Naive Bayes algorithm to perform effective classification even with missing data.

[0117] Step S26: Use the Naive Bayes classifier trained on each intrusion detection dataset to perform intrusion detection separately and output the intrusion detection result R. i .

[0118] Step S27: Multiply the output of each classifier by the corresponding weight coefficient using the following formula, and sum the results to obtain the final intrusion detection result.

[0119]

[0120] Where i represents the i-th group, P i P represents the number of positive samples. j W represents the number of negative samples. i R represents the weight coefficient of the i-th group. i Result represents the intrusion detection result output by the i-th classifier, and Result represents the final intrusion detection result.

[0121] Step S28: Group the fireflies to obtain multiple firefly populations. Initialize the number of fireflies n and initial position L, initial attraction β0, and maximum attraction β for each population. max Minimum attraction β min The light intensity absorption coefficient y, the step size factor α, and the maximum number of iterations T are given. The position L of the firefly represents the weight set W = {W1, W2, ..., W...}. n Since it contains multiple weighting coefficients, the firefly's position is in a high-dimensional space.

[0122] Step S29: Calculate the Euclidean distance between each pair of fireflies and the attraction β of each firefly to surrounding fireflies. r .

[0123]

[0124] Where r represents the Euclidean distance between two fireflies, that is, the distance between firefly i and firefly j.

[0125] Step S30: Calculate the fitness value based on the firefly's location (i.e., calculate the intrusion detection rate after classifier ensemble based on the weight vector of each firefly). Specifically:

[0126] Because the positions of the fireflies represent the weight set (confidence level) W = {W1, W2, ..., W...} n W is a position vector, and each dataset, combined with a classifier, performs intrusion detection on the validation set data, resulting in a detection result set R = {R1, R2, ..., R}. n}, combined with step S207, the actual output result of intrusion detection will be obtained. Since the validation set contains real labels, the accuracy of the actual output result and the real labels is calculated as the fitness value (i.e., intrusion detection rate).

[0127] Step S31: Each firefly finds the individual firefly that attracts it the most and updates its position to move closer to that firefly. The position update formula is as follows:

[0128]

[0129] Among them, Xi Indicates the current position of the firefly, X i ′ represents the updated position, which is the weight coefficient W={W1,W2,...,W n}, where β0 represents the predefined initial attraction, α represents the perturbation step size factor, and rand represents a random number uniformly distributed between [0,1].

[0130] Step S32: The firefly with the highest brightness, i.e. the group optimal, is randomly moved to a different position using the following formula.

[0131] X i =X i +αrand Guass()

[0132] Here, Gauss represents the formula for the Gaussian function.

[0133] Step S33: Calculate the fitness value of the new location reached by the firefly after flying to all other individuals with higher brightness than itself. If the new location is better than the previous location, the firefly will fly to the new location; otherwise, the firefly will stay in the original location.

[0134] In this embodiment, steps S29 to S33 differ from traditional firefly optimization algorithms that treat all fireflies as a single population for training. This embodiment improves upon this by randomly grouping a large number of fireflies into multiple firefly clusters. Subsequent steps, such as calculating the attraction between fireflies and updating their positions (i.e., steps S29 to S33), are performed independently for each population, without interference.

[0135] The improved firefly optimization algorithm in this embodiment adds a population information interaction process to the traditional firefly optimization algorithm in the following steps (the traditional firefly optimization algorithm does not have the concept of grouping fireflies into multiple populations). Therefore, this embodiment can improve the training speed of the firefly optimization algorithm, accelerate the algorithm convergence, and improve the accuracy of the target solution.

[0136] Step S34: After optimizing the firefly positions within each population in each round, combine the target individuals of each group to form a new population, and repeat steps S29 to S33 for this population to find a better solution, and substitute this solution back into all the original populations.

[0137] Step S35: Repeat the above process. If the algorithm reaches the maximum number of iterations, output the location of the target firefly as the solution; otherwise, jump to step S30.

[0138] Reference Figures 6 to 7This invention also provides a network intrusion detection system, which includes a data acquisition module 100, an intrusion detection module 200, a location optimization module 300, a weight coefficient acquisition module 400, and a detection result acquisition module 500, wherein:

[0139] The data acquisition module 100 is used to acquire the data to be detected, a number of positive samples, and a number of negative samples;

[0140] The intrusion detection module 200 is used to input the data to be detected into multiple trained classifiers for network intrusion detection and obtain the intrusion detection result output by each trained classifier. The intrusion detection module includes a data calculation submodule 210, an undersampling submodule 220, an oversampling submodule 230, and a data training submodule 240, wherein:

[0141] The data calculation submodule 210 is used to calculate the number of the first undersampled group and the number of the second oversampled group based on the number of positive samples and the number of negative samples.

[0142] The undersampling submodule 220 is used to undersample the positive samples based on the first set of numbers to obtain the undersampled dataset of the first set of numbers; each undersampled dataset contains the same number of positive samples and negative samples;

[0143] The oversampling submodule 230 is used to oversample the remaining positive samples after undersampling based on the second set of numbers to obtain the oversampled dataset of the second set of numbers; each oversampled dataset contains the same number of positive samples and negative samples;

[0144] The data training submodule 240 is used to train a classifier separately using each undersampled dataset and oversampled dataset to obtain multiple trained classifiers.

[0145] The position optimization module 300 is used to initialize the firefly algorithm parameters and obtain multiple firefly individuals, group the firefly individuals into multiple first firefly populations, and use the firefly algorithm to optimize the firefly positions in each first firefly population to obtain the target firefly individuals that meet the target conditions in each first firefly population after position optimization.

[0146] The weight coefficient acquisition module 400 is used to form a new population from the target firefly individuals of each first firefly population, find the target firefly individuals in the new population that meet the target conditions, and add the target firefly individuals in the new population to each first firefly population as the second firefly population for the next iteration, until the firefly algorithm reaches the maximum number of iterations, and obtain the position of the target firefly individual; the position of the target firefly individual includes multiple weight coefficients, and the multiple weight coefficients correspond to each classifier;

[0147] The detection result acquisition module 500 is used to calculate the final intrusion detection result based on multiple weight coefficients and the intrusion detection result output by each trained classifier.

[0148] It should be noted that since the network intrusion detection system in this embodiment is based on the same inventive concept as the network intrusion detection method described above, the corresponding content in the method embodiment is also applicable to this system embodiment, and will not be described in detail here.

[0149] This application also provides an electronic device, comprising: at least one memory, at least one processor, and at least one computer program. The at least one computer program is stored in the at least one memory, and the at least one processor executes the at least one computer program to implement any of the network intrusion detection methods described in the above embodiments. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0150] Reference Figure 8 , Figure 8 This illustration shows the hardware structure of an electronic device according to another embodiment, the electronic device comprising:

[0151] The processor 810 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0152] The memory 820 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 820 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 820 and called and executed by the processor 810 according to an embodiment of this application for network intrusion detection.

[0153] The input / output interface 830 is used to implement information input and output;

[0154] The communication interface 840 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0155] Bus 850 transmits information between various components of the device (e.g., processor 810, memory 820, input / output interface 830, and communication interface 840);

[0156] The processor 810, memory 820, input / output interface 830 and communication interface 840 are connected to each other within the device via bus 850.

[0157] This application also provides a storage medium, which is a computer-readable storage medium storing a computer program for causing a computer to execute any of the network intrusion detection methods described above.

[0158] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage, flash memory, or other non-transitory solid-state storage. In some embodiments, memory may optionally include memory remotely located relative to the processor, which can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0159] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0160] It will be understood by those skilled in the art that Figure 1 The technical solutions shown do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0161] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0162] Those skilled in the art will understand that all or some of the steps in the methods disclosed above, as well as the functional modules / units in the systems and devices, can be implemented as software, firmware, hardware, or suitable combinations thereof.

[0163] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “having,” and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0164] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0165] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0166] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0167] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0168] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes multiple instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing programs, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0169] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A network intrusion detection method, characterized by, The network intrusion detection method comprises: obtaining a plurality of positive samples and a plurality of negative samples; inputting the to-be-detected data into a plurality of trained classifiers for network intrusion detection to obtain an intrusion detection result output by each trained classifier; wherein the plurality of trained classifiers are trained in the following manner: calculating a first group number of under-sampling and a second group number of over-sampling according to the number of positive samples and the number of negative samples; under-sampling the positive samples according to the first group number to obtain an under-sampling data set of the first group number, comprising: obtaining a plurality of benign samples and malicious samples, calculating the ratio between the benign samples and the malicious samples to obtain a quantity ratio value, and rounding the quantity ratio value and adding one to obtain a total sampling group number, wherein the benign samples are positive samples, the malicious samples are negative samples, the total sampling group number is the sum of the first group number and the second group number, the quantity ratio value is rounded to balance the quantity between the benign samples and the malicious samples, the quantity of the first group number is obtained by rounding the quantity ratio value, and the quantity of the second group number is one group; under-sampling the plurality of positive samples by using a random non-repeating under-sampling method according to the first group number and the number of negative samples to obtain an under-sampling data set of the first group number, wherein each under-sampling data set contains the same number of positive samples and negative samples; over-sampling the remaining positive samples after under-sampling according to the second group number to obtain an over-sampling data set of the second group number, comprising: over-sampling the remaining positive samples after under-sampling by using an SMOTE over-sampling method according to the second group number and the number of negative samples to obtain an over-sampling data set of the second group number, wherein each over-sampling data set contains the same number of positive samples and negative samples; training one classifier for each under-sampling data set and over-sampling data set respectively to obtain a plurality of trained classifiers; initializing parameters of a firefly algorithm and obtaining a plurality of firefly individuals, grouping a plurality of the firefly individuals to obtain a plurality of first firefly populations, and optimizing the positions of fireflies in each first firefly population by using the firefly algorithm to obtain target firefly individuals in each first firefly population that meet a target condition after position optimization; grouping the target firefly individuals of each first firefly population into a new population, finding target firefly individuals in the new population that meet the target condition, and adding the target firefly individuals in the new population to each first firefly population as a second firefly population for next iteration until the firefly algorithm reaches a maximum number of iterations to obtain the positions of target firefly individuals; the positions of target firefly individuals comprise a plurality of weight coefficients, and the plurality of weight coefficients correspond to respective classifiers; calculating a final intrusion detection result according to the plurality of weight coefficients and the intrusion detection result output by each trained classifier.

2. The network intrusion detection method of claim 1, wherein, The classifier uses a Naive Bayes classifier.

3. The network intrusion detection method of claim 1, wherein, The firefly position optimization is performed on each of the first firefly populations by using the firefly algorithm, and target firefly individuals meeting a target condition in each of the first firefly populations after position optimization are obtained, including: An attraction degree of each firefly individual in each of the first firefly populations to nearby firefly individuals is calculated; An adaptability value of a current position of each firefly individual in each of the first firefly populations is calculated; According to the attraction degree, a maximum brightness firefly individual is selected, and a position of the maximum brightness firefly individual is updated by using a random moving position manner to obtain a first position; For other firefly individuals except the maximum brightness firefly individual, each firefly individual finds a firefly individual with a high attraction degree to itself in the vicinity and approaches the firefly individual with the high attraction degree to obtain a second position; An adaptability value of the first position or the second position is calculated, and if the adaptability value of the first position or the second position is better than an adaptability value of the current position before flight, the firefly individual flies to the first position or the second position; Adaptability values of positions of the firefly individuals after position optimization are compared to obtain a firefly individual with an optimal adaptability value in each of the first firefly populations.

4. The network intrusion detection method of claim 3, wherein, The target firefly individuals of each of the first firefly populations are grouped into a new population, target firefly individuals meeting a target condition in the new population are found, and the target firefly individuals in the new population are added to each first firefly population as second firefly populations for next iteration until the firefly algorithm reaches a maximum iteration number, and a position of a target firefly individual is obtained, including: The target firefly individuals of each of the first firefly populations are grouped into a new population, first target firefly individuals meeting a target condition in the new population after position optimization of the new population by using the firefly algorithm are obtained; The first target firefly individuals in the new population are added to each first firefly population as second firefly populations for next iteration; Firefly position optimization is performed on each of the second firefly populations by using the firefly algorithm, and target firefly individuals meeting a target condition in each of the second firefly populations after position optimization are obtained; The target firefly individuals of each of the second firefly populations are grouped into a new population, second target firefly individuals meeting a target condition in the new population are found, and the second target firefly individuals in the new population are added to each second firefly population as third firefly populations for next iteration until the firefly algorithm reaches a maximum iteration number, and a position of a target firefly individual is obtained.

5. The network intrusion detection method of claim 1, wherein, The final intrusion detection result is calculated by using the following formula: in, Indicates the first Group, Indicates the number of positive samples. Indicates the number of negative samples. Indicates the first Group weighting coefficients Indicates the first The intrusion detection results output by the group classifier. This indicates the final intrusion detection result.

6. A network intrusion detection system characterized by, The network intrusion detection system includes: A data acquisition module is configured to acquire to-be-detected data, a plurality of positive samples, and a plurality of negative samples; The intrusion detection module is configured to input the to-be-detected data into a plurality of trained classifiers to perform network intrusion detection and obtain intrusion detection results output by each trained classifier. The data calculation submodule is configured to calculate a first number of under-sampling and a second number of over-sampling according to the number of positive samples and the number of negative samples. The under-sampling submodule is configured to under-sample the positive samples according to the first number to obtain an under-sampling data set of the first number, including: The number of the first number is obtained by rounding the number ratio value, and the number of the second number is one group. According to the first number and the number of negative samples, the random non-repeating under-sampling method is used to under-sample the plurality of positive samples to obtain an under-sampling data set of the first number, and each under-sampling data set contains the same number of positive samples and negative samples. The over-sampling submodule is configured to over-sample the remaining positive samples after under-sampling according to the second number to obtain an over-sampling data set of the second number, including: According to the second number and the number of negative samples, the SMOTE over-sampling method is used to over-sample the remaining positive samples after under-sampling to obtain an over-sampling data set of the second number, and each over-sampling data set contains the same number of positive samples and negative samples. The data training submodule is configured to train one classifier for each under-sampling data set and over-sampling data set respectively to obtain a plurality of trained classifiers. The position optimization module is configured to initialize parameters of a glowworm algorithm and obtain a plurality of glowworm individuals, group a plurality of the glowworm individuals to obtain a plurality of first glowworm populations, and perform glowworm position optimization on each first glowworm population by using the glowworm algorithm to obtain target glowworm individuals in each first glowworm population that meet a target condition after position optimization. The weight coefficient acquisition module is configured to group the target glowworm individuals in each first glowworm population to form a new population, find target glowworm individuals in the new population that meet a target condition, and add the target glowworm individuals in the new population to each first glowworm population as a second glowworm population for next iteration until the glowworm algorithm reaches a maximum number of iterations to obtain positions of target glowworm individuals. The positions of the target glowworm individuals include a plurality of weight coefficients, and the plurality of weight coefficients correspond to the respective classifiers. The detection result acquisition module is configured to calculate a final intrusion detection result according to the plurality of weight coefficients and the intrusion detection result output by each trained classifier.

7. An electronic device, comprising: Comprise: At least one memory; At least one processor; At least one computer program; The at least one computer program is stored in the at least one memory, and the at least one processor executes the at least one computer program to realize: A network intrusion detection method according to any one of claims 1 to 5.

8. A storage medium, the storage medium being a computer-readable storage medium, characterized in that, The computer readable storage medium stores a computer program, and the computer program is used for enabling a computer to execute: A network intrusion detection method according to any one of claims 1 to 5. The computer readable storage medium stores a computer program, and the computer program is used for enabling a computer to execute: A network intrusion detection method according to any one of claims 1 to 5.

Images