Underwater acoustic communication intrusion detection method and system based on CNN-LSTM

Abstract

The present invention relates to a method and system for underwater acoustic communication intrusion detection based on CNN-LSTM. The method comprises: constructing an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and a shore-based communication server; conducting a simulated attack on the underwater sensor network based on the intrusion attack system, and collecting attack data in the underwater sensor network in real time; performing iteration and intrusion detection in an improved CNN-LSTM fusion model to obtain a target CNN-LSTM fusion model for underwater acoustic communication intrusion detection; the improved CNN-LSTM fusion model connects CNN and LSTM models via an intermediate layer component. Since network layer intrusions, MAC layer and physical layer abnormal attacks are taken into account, intrusion detection is performed using the improved CNN-LSTM fusion model, thereby improving the model's detection capability for various network attacks, thereby improving the accuracy of underwater acoustic communication intrusion detection.

Description

Technical Field

[0001] The present invention relates to the technical field of underwater acoustic network communication, and in particular to a method and system for underwater acoustic communication intrusion detection based on CNN-LSTM. Background Art

[0002] In recent years, with growing global attention to maritime security, the ocean has become a core area of ​​international strategic competition. Underwater network security plays a unique role in my country's strategically important national defense. Underwater sensor networks (UWSNs) face numerous threats during deployment, including deep-sea noise, frequency shift, bit errors, propagation delay, channel openness, and multipath effects, increasing the risk of network attacks and interference. To maintain stable marine communications and network security, anomaly detection has become a crucial tool. Existing research primarily focuses on intrusion detection and identification at the network layer, neglecting the issues of anomaly attacks and low detection metrics at the MAC and physical layers.

[0003] Therefore, the traditional underwater acoustic communication intrusion detection method has the problem of low intrusion detection accuracy because it is aimed at intrusion detection and identification at the network layer. Summary of the Invention

[0004] Based on this, in order to solve the above technical problems, a CNN-LSTM-based underwater acoustic communication intrusion detection method and system are provided to improve the accuracy of underwater acoustic communication intrusion detection.

[0005] A method for underwater acoustic communication intrusion detection based on CNN-LSTM, the method comprising:

[0006] Based on underwater communication nodes, relay nodes, and shore-based communication servers, an underwater sensor network intrusion attack system consisting of a routing layer, a MAC layer, and a physical layer is constructed. The attack system is used to simulate an underwater sensor network with shore-based communication server equipment.

[0007] Based on the intrusion attack system, a simulated attack is performed on the underwater sensor network, attack data in the underwater sensor network is collected in real time, and the attack data is processed using the FFT algorithm and sliding window mechanism to obtain an attack data set; a communication transmission data set across the physical layer, MAC layer, and routing layer is constructed;

[0008] Input the attack dataset and the transmission dataset into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model;

[0009] Perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results;

[0010] Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

[0011] In one embodiment, the method further comprises:

[0012] Obtain various evaluation indicators;

[0013] Tracking changes in validation loss during the training phase of the target CNN-LSTM fusion model based on each of the evaluation metrics;

[0014] A performance evaluation is performed on the target CNN-LSTM fusion model based on the loss change to obtain an evaluation result.

[0015] In one embodiment, the evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

[0016] In one embodiment, the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM;

[0017] The method further comprises:

[0018] Collecting water test data and inputting the water test data into the improved CNN-LSTM fusion model;

[0019] Extracting features from the water test data using the CNN part of the improved CNN-LSTM fusion model, and performing data processing on the extracted features to obtain processed time series data;

[0020] The time series data is trained and processed through the LSTM part in the improved CNN-LSTM fusion model, and the detection results during the training process are output.

[0021] In one embodiment, in the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function construction;

[0022] The LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and a cross entropy loss function is used as a model evaluation indicator.

[0023] In one embodiment, the training process of the improved CNN-LSTM fusion model includes:

[0024] Obtain and preprocess the ocean dataset, convert the data type of the processed ocean dataset to generate the target dataset;

[0025] Inputting the target data set into a classification and recognition model, classifying the elements in the target data set and assigning data labels to obtain an input data set;

[0026] The input data set is divided into a training set, a validation set and a test set, and the improved CNN-LSTM fusion model is trained based on the training set, the validation set and the test set.

[0027] In one embodiment, obtaining an ocean dataset and preprocessing it, converting the data type of the processed ocean dataset to generate a target dataset includes:

[0028] Acquiring an ocean dataset, performing denoising processing on the ocean dataset, and filling empty value cells in the ocean dataset to obtain a processed ocean dataset;

[0029] The cell contents in the processed ocean dataset are converted into text format, and the category data are mapped to fixed numerical values ​​to generate a target dataset.

[0030] In one embodiment, the target data set is input into a classification and recognition model, and the elements in the target data set are classified and assigned data labels to obtain an input data set, including:

[0031] Inputting the target data set into a classification recognition model, and identifying normal data and abnormal data through the classification recognition model;

[0032] Assigning normal numerical labels to the normal data and abnormal sample labels to the abnormal data through the classification recognition model;

[0033] Normal data with normal numerical labels and abnormal data with abnormal sample labels are used as input data sets.

[0034] In one embodiment, the attack dataset and the transmission dataset are input into an improved CNN-LSTM fusion model for iteration and intrusion detection, including:

[0035] Searching for data carrying the abnormal sample label from the attack data set as abnormal attack data, and searching for data carrying the normal value label from the transmission data set as normal transmission data;

[0036] The abnormal attack data and normal transmission data are input into the improved CNN-LSTM fusion model, and it is iterated through the improved CNN-LSTM fusion model.

[0037] A CNN-LSTM-based underwater acoustic communication intrusion detection system, the system comprising:

[0038] An attack system establishment module is used to build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and to simulate an underwater sensor network with shore-based communication server equipment through the attack system;

[0039] A simulated attack module is used to simulate an attack on the underwater sensor network based on the intrusion attack system, collect attack data from the underwater sensor network in real time, and process the attack data using an FFT algorithm and a sliding window mechanism to obtain an attack data set; and construct a communication transmission data set across the physical layer, MAC layer, and routing layer;

[0040] A model optimization module is used to input the attack dataset and the transmission dataset into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model;

[0041] A detection module, configured to perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results;

[0042] Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

[0043] The above-mentioned CNN-LSTM-based underwater acoustic communication intrusion detection method and system constructs an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer, and conducts simulated attacks to collect attack data. Since the intrusion of the network layer and abnormal attacks of the MAC layer and the physical layer are taken into consideration, the efficiency and convenience of collecting attack data can be improved; the CNN and LSTM models are connected through the intermediate layer components to obtain an improved CNN-LSTM fusion model, which uses CNN for feature extraction and LSTM for processing time series data, thereby improving the model's detection ability for various network attacks, thereby improving the accuracy of underwater acoustic communication intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is a diagram showing the application environment of an underwater acoustic communication intrusion detection method based on CNN-LSTM in one embodiment;

[0045] Figure 21 is a flow chart of a method for underwater acoustic communication intrusion detection based on CNN-LSTM in one embodiment;

[0046] Figure 3 A schematic diagram of a cross-layer intrusion detection solution for an underwater sensor network according to an embodiment;

[0047] Figure 4 Schematic diagram of an improved CNN-LSTM fusion model architecture in one embodiment;

[0048] Figure 5 1. A flowchart of an experimental process of an underwater acoustic communication intrusion detection method based on CNN-LSTM in one embodiment;

[0049] Figure 6 1. A structural block diagram of an underwater acoustic communication intrusion detection system based on CNN-LSTM in one embodiment;

[0050] Figure 7 FIG. 1 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solutions and advantages of this application more clear, the following further describes this application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain this application and are not intended to limit this application.

[0052] The underwater acoustic communication intrusion detection method based on CNN-LSTM provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1As shown, the application environment includes a computer device 110. The computer device 110 can build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and simulate an underwater sensor network with shore-based communication server equipment through the attack system; the computer device 110 can simulate an attack on the underwater sensor network based on the intrusion attack system, collect attack data in the underwater sensor network in real time, and use the FFT algorithm and sliding window mechanism to process the attack data to obtain an attack data set; build a communication transmission data set across the physical layer, MAC layer, and routing layer; the computer device 110 can convert the attack data set, transmission data set, and physical layer into a data set; The data set is input into the improved CNN-LSTM fusion model for iteration and intrusion detection, and the improved CNN-LSTM fusion model is adjusted and optimized based on the output results to obtain a target CNN-LSTM fusion model. The computer device 110 can perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results. The improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through intermediate layer components, redeploys the convolution layer, the maximum pooling layer, and the activation function components, and is optimized through the fully connected layer and the softmax layer. The computer device 110 can be, but is not limited to, various personal computers, laptops, smart phones, robots, and other devices.

[0053] In one embodiment, Figure 2 As shown, a method for underwater acoustic communication intrusion detection based on CNN-LSTM is provided, which includes the following steps:

[0054] Step 202: Based on underwater communication nodes, relay nodes, and shore-based communication servers, an underwater sensor network intrusion attack system consisting of a routing layer, a MAC layer, and a physical layer is constructed, and the attack system is used to simulate an underwater sensor network with shore-based communication server equipment.

[0055] To address the problem of abnormal attack detection on a single routing layer, we can build an underwater sensor network intrusion attack system based on underwater networking equipment such as underwater communication nodes, relay nodes, and shore-based communication servers, which consists of a routing layer, a MAC layer, and a physical layer.

[0056] Next, the attack system can simulate an underwater network with shore-based server equipment and conduct underwater acoustic replay attacks, MAC attacks, and cross-node server malicious attacks by setting an attack transmission protocol. Specifically, regarding the principle construction and experimental environment field construction of the cross-layer intrusion detection scheme in the ocean underwater acoustic transmission protocol stack, as well as the experimental results of the ocean underwater sensor network network, the prototype model construction and testing in this embodiment mainly uses a GPD single-chip microcomputer chip development board, an audio power amplifier device, and an audio power chip transceiver device to build three sets of underwater sensor network physical layer sound signal transmission attack systems. One set of equipment acts as the sender of underwater sound signals, another set of equipment acts as the receiver of underwater sound signals, and the last set of equipment acts as the attacker of underwater sound signals. As the initiator of attack data, certain attack data signals can be set through computer equipment to disrupt and confuse normal underwater sensor network data transmission.

[0057] In this embodiment, a prototype attack system of the receiver, sender, and attacker is built to collect and transmit normal communication data and abnormal transmission data. By sorting out the normal data and abnormal data streams transmitted at the bottom physical layer, they are encapsulated and transmitted to the MAC layer and routing layer in the underwater sensor network protocol stack, forming cross-layer data transmitted from the bottom physical layer to the upper layer as part of the overall data set. There is no need for manual real-time collection and analysis of ocean acoustic data, which improves the efficiency of underwater acoustic communication intrusion detection.

[0058] Among them, a prototype underwater acoustic communication system was built to implement a preliminary scheme for physical-layer data transmission and collection in underwater acoustic networks, which was experimentally verified to be feasible. Based on components such as a GPD microcontroller development board, an audio power amplifier, a voice module, and an audio power chip transceiver, the prototype constructed a three-node underwater sensor network acoustic signal transmission system. The system is divided into three parts: one acts as the transmitter of the sound signal, another as the receiver, and the third is designed as the attacker, used to launch attack signals to interfere with and confuse the standard underwater sensor network data transmission process. The construction and testing of the underwater acoustic communication prototype primarily aimed to experimentally verify the feasibility and efficiency of the physical-layer data communication and collection mechanism, paving the way for the subsequent deployment of communication devices, receivers, and jamming equipment. It also explored potential security vulnerabilities and their impact on marine underwater acoustic networks.

[0059] Using a physical layer prototype model testing scheme, three sets of hardware transceiver devices and attack devices were constructed to verify data feasibility and the feasibility of attack experiments to collect physical layer sound signals. To collect real-world transmission data in a large-scale device test field within an underwater sensor network, physical layer data transmission experiments were conducted on the prototype device in school waters. The prototype device embedded a PDB6016 microcomputer chip in a SOP16 package, designed as a system-on-chip (SoC). It integrated a CPU 8051 microprocessor, a USB interface, a design that eliminates the need for an external crystal oscillator, a dual-channel high-resolution 24-bit DAC, and a mono 16-bit ADC, suitable for personal computers. Within the hardware device, a Class AB, mono, bridge-tied power amplifier chip (8002A) was soldered onto the PDB6016B chip. The 8002A achieves high-quality audio output without requiring extensive peripherals, and its SOP package makes it particularly suitable for low-power portable devices. The WT588D voice sampling module is also soldered in. It supports 2Mbit-32Mbit SPI-Flash. It features a 13-bit / DA converter and 12-bit / PWM audio processing, supporting 6K-22KHz WAV audio. It has two output modes: DAC / PWM. It can load up to 500 audio segments for editing. This maximizes the functionality of the WT588D voice module and allows for arbitrary insertion of silence, with a duration ranging from 10ms to 25 minutes. This can be used to simulate delay attacks and signal repetition detection in ocean acoustics, among other malicious and generalized attacks.

[0060] The physical layer prototype device design and implementation uses Altium Designer 2023 for PCB circuit design and plate making, unified wiring package pin design, PCB board making and polishing, and finally the development board chip and sensor welding and serial port debugging and design code burning; the physical layer prototype device design and implementation uses PCB main chip board and SMD capacitors of different specifications, a total of 10 soldered on the main board, four SMD resistors, 3 8002A audio sampling modules, 3 USB-A SMD USB driver-free amplifiers, 3 16-pin PDB6016 audio sound signal modules, 3 WT588D voice modules, 3 4 ohm 2W waterproof full diffusion speakers, among which the waterproof speakers support sampling sound and diffusion in underwater environments, several 28AWG waterproof audio cables, and finally use the same shell packaging.

[0061] In underwater sensor networks, underwater acoustic communication systems convert information such as text, voice, and images into electrical signals, which are then digitized using an encoder. Transducers then convert these electrical signals into acoustic signals, which propagate through the water medium to the receiving end. The receiving transducer then converts the acoustic signals back into electrical signals, which are then interpreted by an electrical receiver as sound, text, and image information. This process relies on the principle of sound generation, namely the vibration of objects. In the marine environment, the medium for information transmission changes from air to seawater. This involves specialized transmitting and receiving devices, namely underwater acoustic transducers, which convert acoustic energy into electrical energy. This allows for the transmission and reception of acoustic signals of varying frequencies and intensities across these different media, thereby enabling data reception and transmission.

[0062] The experiment used the above three sets of identical underwater acoustic physical layer prototype equipment and connected them with three mobile personal PCs. Three experimental objects were set respectively, namely the speak data sender, the listen data receiver, and the hark malicious attacker. The equipment was tested in an underwater environment. After the sample was set, the listen receiver interface was opened first, and then the speak sender was opened to wait for synchronization. The hark attack was interfered with. The established attack sample value was used to simulate the attacker transmitting abnormal data. The other two devices were modulated to receive, collect and decode the data. The PC was used to collect malicious attack data and normal transmission data.

[0063] The cross-layer communication acquisition experiment employed prototype equipment to capture underwater acoustic signals at the physical layer and their received signals. The data generated by the physical layer, including packets, was then further processed through modulation and demodulation. Based on this, a comprehensive attack simulation range encompassing the physical, media access control (MAC), and routing layers was established within a Kali Linux environment. The range aimed to capture and store data transmitted within this cross-layer system using packet capture tools, enabling comprehensive data flow acquisition and recording. Three identical personal computers (PCs) were deployed as the hardware platform. At the physical layer, data was transmitted using external ports and then packaged and transmitted through the upper-layer protocol stack. Using Kali Linux attack tools, attack traffic targeting the MAC layer and malicious traffic injecting text into the routing layer were designed to simulate attacks. Using Wireshark, a widely used network packet analysis software, as a data acquisition tool, the Kali Linux environment successfully established an attack simulation range spanning the physical, MAC, and routing layers. This range not only simulated and attacked both normal and abnormal data flows, but also captured, analyzed, and stored the transmissions.

[0064] Underwater acoustic communication systems are designed for underwater information exchange, transmitting information through the propagation of sound waves through water. The main process includes data encoding, signal modulation, sound wave transmission and propagation, and signal reception and demodulation. First, the information, data set, or sound is converted into an electrical signal using digital signal processing techniques, including sampling, quantization, and encoding. Next, the electrical signal is modulated using various techniques such as FM, PM, AM, OFDM, and PSK to adjust the signal characteristics to suit water propagation and reduce interference. The modulated signal is converted into sound waves through a transducer. When propagating through water, it encounters challenges such as attenuation, multipath, ambient noise, and the Doppler effect. The receiving transducer receives the sound waves, converts them back into electrical signals, and then demodulates and demodulates them.

[0065] Fast Fourier Transform (FFT), an algorithmically efficient implementation mechanism of Discrete Fourier Transform (DFT), plays a vital role in the field of underwater acoustic communications and provides the core technical foundation for the analysis and optimization of signal transmission processes.

[0066] Using prototype equipment, preliminary verification of physical layer underwater acoustic signal transmission acquisition was conducted, and replay attacks and transmission delay attacks were simulated at the physical layer. This work aims to conduct large-scale acquisition and analysis of normal signal waveforms and malicious interference signal waveforms transmitted at the physical layer. Preliminary experimental results show that in order to obtain more realistic and effective data testing and evaluate the performance of underwater communication detection under real sea conditions, a comprehensive underwater sensor network equipment was deployed in the target sea area using the system architecture design of the real sea underwater acoustic communication detection solution. The communication experiment set up the underwater sensor network and communication equipment at different distances. In order to obtain real data under controlled variables, the design included data collection of underwater acoustic communications at the same depth but different distances. This deployment strategy aims to collect a real data set that can be used for analysis by precisely controlling the experimental variables. Specifically, the system focuses on evaluating the underwater acoustic communication system's resilience to physical layer attacks, primarily replay and delay attacks, and frequency band interference attacks. It also assesses the system's resilience to MAC and ARP attacks, as well as routing layer text attacks, when transmitting physical layer data to upper-layer protocol stacks, shore-based and central service nodes, and receiving devices containing server nodes. The system also collects data for improved model training and detection. Furthermore, the system will assess the transmission efficiency and accuracy of both normal and jamming signals in actual marine environments.

[0067] Step 204: simulate an attack on the underwater sensor network based on the intrusion attack system, collect attack data in the underwater sensor network in real time, and use the FFT algorithm and sliding window mechanism to process the attack data to obtain an attack data set; construct a communication transmission data set across the physical layer, MAC layer, and routing layer.

[0068] The constructed attack system can simulate attacks on underwater sensor networks and collect attack data from them in real time. Specifically, the attack system can provide a large amount of real-time attack data to the improved CNN-LSTM fusion model, rapidly improving the model's iteration rate and detection performance. By collecting attack data in real time, an attack dataset is constructed. Then, based on the constructed communication transmission dataset across the physical layer, MAC layer, and routing layer, the improved CNN-LSTM fusion model is trained and adjusted using the attack dataset and transmission dataset to attack the underwater sensor network. This improves the model's detection accuracy.

[0069] When conducting a simulated attack, Figure 3 As shown, the data is first sampled, and the data set is reconstructed based on the sampled data. The upper-layer device transmission is continued through the collected physical layer signal, and normal communication data and abnormal transmission data are transmitted in the protocol stack. By sorting out the normal data and abnormal data streams transmitted at the bottom of the physical layer, they are encapsulated and transmitted to the MAC layer and routing layer in the underwater sensor network protocol stack, and the receiving device and the shore-based node with server function in the upper-layer protocol stack are continued to be detected. The transmission data is sampled, and the cross-layer data transmitted from the bottom physical layer to the upper layer is used as part of the overall data set.

[0070] Data processing involves decoding and analyzing the data collected from underwater acoustic communication devices and communication boards, generating a large number of time-series underwater acoustic time-domain graphs. This is a typical type of time series data and plays an indispensable role in ocean underwater acoustic transmission. Here, the time series ocean underwater acoustic transmission data is input into a data rule tool using a sliding window mechanism. This mechanism can transform the time series into regularly segmented windowed data. A sequence reconstruction method based on the sliding window mechanism has become an efficient data processing method. By systematically segmenting and reorganizing the original time series data, and defining the sliding window size and window movement scale, the sliding window is sequentially traversed and intercepted until the entire time series set is traversed. This results in the processed three ocean water test datasets: Ocean-100m-16fsk-200VOL, Ocean-150m-16fsk-200VOL, and Ocean-200m-16fsk-200VOL. The sliding window sequence reconstruction method has great practical value and convenience in the application of time series analysis and prediction due to its simplicity. It can provide a label set for complex time series analysis, effectively extract the temporal features contained in the data, and lay the foundation for subsequent intrusion detection.

[0071] In step 206, the attack dataset and the transmission dataset are input into the improved CNN-LSTM fusion model for iteration and intrusion detection, and the improved CNN-LSTM fusion model is adjusted and optimized according to the output results to obtain a target CNN-LSTM fusion model.

[0072] like Figure 3 As shown in the figure, the proposed improved CNN-LSTM fusion model is deployed sequentially with marine communication data transceivers at different distances through the cross-layer intrusion detection solution architecture of the underwater acoustic protocol stack. The Ocean-100m-16fsk-200VOL ocean water test dataset, Ocean-150m-16fsk-200VOL ocean water test dataset, and Ocean-200m-16fsk-200VOL ocean water test dataset are used for transmission communication collection and processing. Based on the cross-layer intrusion detection solution of the underwater acoustic protocol stack, the internal structure of the optimized and improved CNN-LSTM fusion model is used to enhance the model's ability to detect communication anomalies in ocean data and conduct specific performance evaluations. By controlling the training parameter settings of each model and conducting comparative experiments with other deep learning models, the comprehensive performance indicators such as recall, precision, F1 score, and accuracy are evaluated. By increasing the distance of ocean underwater acoustic communication, it is concluded that the optimized and improved CNN-LSTM fusion model also has excellent robustness. It is concluded that the optimized and improved CNN-LSTM fusion model is superior to other models in ocean cross-layer communication transmission, and at the same time exhibits more stable and excellent detection efficiency, which also greatly improves the improvement of the CNN-LSTM algorithm.

[0073] In one embodiment, the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM. The improved model inherits the advantages of the CNN model in processing feature data using convolution and pooling and the advantages of the LSTM model in processing time series data, making it more suitable for processing underwater acoustic communication data.

[0074] In this embodiment, in order to improve the prediction accuracy of the baseline model LSTM, a CNN-LSTM fusion model is constructed for cross-layer data intrusion detection in ocean-oriented underwater sensor networks. Figure 4As shown in this paper, a CNN-LSTM fusion model was proposed to detect intrusions in UWSN networks, utilizing a deep learning architecture combining convolutional neural networks (CNNs), long short-term memory (LSTMs), and CNN-LSTMs. Using an experimental dataset from an ocean test field platform, the study determined normal and abnormal data in ocean node transmissions. Comparative experimental analysis was conducted and compared with other studies in the literature. The CNN-LSTM fusion model achieved the highest and best intrusion detection accuracy in the dataset. The improved CNN-LSTM fusion model significantly improved intrusion detection accuracy and other performance.

[0075] In this embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method provided may also include a model training process, and the specific process includes: collecting water test data and inputting the water test data into the improved CNN-LSTM fusion model; extracting features of the water test data through the CNN part of the improved CNN-LSTM fusion model, and performing data processing on the extracted features to obtain processed time series data; training and processing the time series data through the LSTM part of the improved CNN-LSTM fusion model, and outputting the detection results during the training process.

[0076] Among them, in order to solve the problem of anomaly detection in underwater cross-layer communication data transmission, the unique advantages of CNN and LSTM are integrated and combined to build a dual-model connection architecture. In the CNN-LSTM integrated architecture, the first part uses CNN to extract features from sampled data; the second part uses LSTM to process the time series data after sampling.

[0077] In one embodiment, Figure 4 As shown in the figure, in the improved CNN-LSTM fusion model, the CNN part is equipped with a convolution layer, a maximum pooling layer, and an activation function; the LSTM part is built after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and the cross entropy loss function is used as the model evaluation indicator.

[0078] That is, in this embodiment, in the improved CNN-LSTM fusion model, the first part of the CNN model sets two convolutional layers, two maximum pooling layers and an activation function component, and then constructs an LSTM network; finally, optimization processing is performed by deploying a fully connected layer and a softmax layer, and the cross entropy loss function is used as the evaluation indicator.

[0079] In the analysis of underwater sensor anomaly attack data, the imbalance between the number of normal and abnormal samples poses a challenge to detection accuracy. Therefore, the cross-entropy loss function is used to distinguish the classification difficulty of samples by using the predicted probability. The weight distribution is optimized in the iterative process, which reduces the focus on easy-to-classify samples and concentrates resources on identifying difficult-to-distinguish abnormal samples, thereby improving the accuracy of the classification task. The expression of the cross-entropy loss function can be expressed as: Among them, L refers to the loss function, θ represents the parameter set of the model, N is the total number of samples, and y i represents the true label value of the i-th sample, x i is the corresponding input feature, and f(x i ;θ) represents the value based on the input x i and the model prediction output of parameters θ.

[0080] Among them, the cross entropy loss function evaluates the inconsistency between the model output probability and the true distribution. It is crucial for classification tasks, imposes severe penalties on incorrect predictions, and is sensitive to probability fine-tuning, thereby quickly improving learning efficiency and accuracy. The calculation formula can be expressed as: Where N is the number of samples, y i is the true label of the i-th sample, It represents the predicted probability that the i-th sample is judged as the positive class.

[0081] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided, which may also include a training process of an improved CNN-LSTM fusion model. The specific process includes: obtaining an ocean data set and preprocessing it, converting the data type of the processed ocean data set to generate a target data set; inputting the target data set into a classification and recognition model, classifying the elements in the target data set and assigning data labels to obtain an input data set; dividing the input data set into a training set, a validation set, and a test set, and training the improved CNN-LSTM fusion model based on the training set, the validation set, and the test set.

[0082] like Figure 4As shown, intrusion detection is based on sampled water test data input, and the CNN-LSTM fusion model architecture is improved by adding intermediate layer components to the CNN model and the LSTM model. The main advantage of the CNN model is that it uses multi-layer convolution settings and pooling processing to extract local features of the data, thereby reducing the number of parameters and internal calculation complexity in the data setting, and improving the ability to generalize and identify features; LSTM is a very special type of recurrent neural network. When processing data containing time tags and time series tags, it can use its own memory units to remember the unique information processed in the previous step and apply it to the prediction of subsequent time steps. In this embodiment, the improved model proposed integrates the advantages of the CNN model using convolution layers and pooling layers to process data features and the advantages of the LSTM model in processing time series data, which greatly improves its performance in marine communication intrusion detection.

[0083] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided, which may also include a data preprocessing process, the specific process including: obtaining an ocean data set, denoising the ocean data set, and filling the empty value cells in the ocean data set to obtain a processed ocean data set; converting the cell content in the processed ocean data set into text format, and mapping the category data to a fixed numerical value to generate a target data set.

[0084] Data preprocessing can include two stages to address issues inherent in collected ocean datasets. Specifically, some key feature columns are subject to significant noise and missing values. These issues hinder the direct application of the data to learning algorithms, as missing information can affect model accuracy and reliability. To address this challenge, cells with empty values ​​in all feature columns are first processed by filling them with "0" values ​​to indicate missing information. Data type conversion is then performed to convert the in-memory cell contents into text format, and categorical data is mapped to fixed values ​​for numerical processing. By employing min-max normalization techniques, data scaling is unified, improving the efficiency and generative power of neural network models. This allows for precise adjustment of the data range to suit model requirements while maintaining relative data relationships. In this process, the preprocessing process improves data consistency and ensures that feature values ​​remain within their original range after transformation, which is crucial for subsequent classification and model training.

[0085] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method provided may also include a process of assigning data labels, and the specific process includes: inputting the target data set into a classification recognition model, and identifying normal data and abnormal data through the classification recognition model; assigning normal numerical labels to normal data and abnormal sample labels to abnormal data through the classification recognition model; and using normal data with normal numerical labels and abnormal data with abnormal sample labels as input data sets.

[0086] Among them, the elements in the data set are classified and assigned labels or identifiers. Here, the data set data is labeled normal and abnormal, with normal values ​​labeled "1" and abnormal samples labeled "2" to facilitate subsequent analysis or model training. The data processing denoising and data label classification process generally starts with defining a set of labels or categories based on the research purpose or the required analysis results. The labels should accurately reflect the phenomena or characteristics observed in the data set, which is crucial to ensuring the accuracy of subsequent labeling. Specifically, one or more labels can be assigned to each element based on the characteristics of the data element and the defined label category, and the data elements can be identified and classified through a pre-trained model; then it is crucial to ensure the consistency and accuracy of the label assignment, and the labeling results are compared and coordinated; finally, data cleaning and preprocessing are performed: After labeling, the data may need to be further cleaned and preprocessed to ensure data quality, including correcting incorrect labels, handling missing values, or removing outliers.

[0087] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided that can also include a data set segmentation process to promote the effectiveness of model training and evaluation. Specifically, the entire data set can be subdivided into three independent subsets, namely a training set, a validation set, and a test set, wherein the training set accounts for 60% of the total data and provides basic data for the model to learn; the validation set and the test set each account for 20%, which are used for model tuning and performance evaluation, respectively. Through this method, it is intended to establish a solid framework to support the model development process, ensure the maximization of its learning ability while avoiding overfitting or underfitting problems. In addition, by evaluating the model performance on an independent test set, the model's generalization ability for unknown data can be more accurately estimated.

[0088] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided, which may also include an intrusion detection process, the specific process including: searching for data carrying abnormal sample labels from an attack data set as abnormal attack data, and searching for data carrying normal numerical labels from a transmission data set as normal transmission data; inputting the abnormal attack data and the normal transmission data into an improved CNN-LSTM fusion model, and iterating through the improved CNN-LSTM fusion model.

[0089] During the CNN-LSTM intrusion detection experiment and analysis, we designed and implemented an innovative intrusion detection algorithm using convolutional neural networks (CNN), long short-term memory networks (LSTM), and an improved fusion model, CNN-LSTM. Leveraging the unique capabilities of these three deep learning frameworks to identify and classify network security threats, we constructed and optimized CNN, LSTM, and a modified CNN-LSTM model, improving intrusion detection accuracy.

[0090] Step 208: Perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output the underwater acoustic communication intrusion detection result; wherein, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through intermediate layer components, redeploys the convolution layer, the maximum pooling layer, and the activation function components, and is optimized through the fully connected layer and the softmax layer.

[0091] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method provided may also include a process of performing performance evaluation on the model, the specific process including: obtaining various evaluation indicators; tracking and verifying loss changes during the training phase of the target CNN-LSTM fusion model according to the various evaluation indicators; and performing performance evaluation on the target CNN-LSTM fusion model based on the loss changes to obtain evaluation results.

[0092] Among them, the evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

[0093] In this embodiment, a series of performance evaluations were conducted on the improved CNN-LSTM fusion model to verify its effectiveness as an intrusion detection system. The performance evaluation was based on a series of carefully selected metrics, including accuracy, precision, recall, F1 score, and loss, ensuring a comprehensive and multi-dimensional evaluation. The predictive performance of different models on different test sets was evaluated using multiple evaluation metrics to verify the effectiveness and feasibility of the improved CNN-LSTM fusion model. The improved CNN-LSTM fusion model was used to conduct a real-world analysis of a marine network node framework in a real-world marine water test site to validate the model's performance evaluation metrics. The experimental data used samples transmitted from an underwater sensor network attack system. In particular, a comprehensive holistic evaluation was considered to carefully evaluate the model's detection capabilities for various cyberattacks. Specifically, a continuous monitoring mechanism was introduced to evaluate the model's performance during the training phase by tracking changes in loss during the validation process. A clear training termination condition was set: if the validation loss did not improve over 50 consecutive training cycles, the training process would be automatically terminated. This measure not only prevents the possibility of overtraining, but also ensures the efficiency and clarity of model training. Therefore, once the training process is terminated, the model evaluation activity also ends, ensuring the real-time and relevance of the evaluation process.

[0094] In one embodiment, when conducting an experiment on a method for underwater acoustic communication intrusion detection based on CNN-LSTM, the experimental process is as follows: Figure 5 As shown, there are three experimental stages: the first experimental stage, the second experimental stage, the third experimental stage, and the fourth experimental stage. The first experimental stage may include: data preprocessing, data format conversion, data denoising, and data normalization; the second experimental stage may include: data set division, including division into training set, test set, and validation set; the third experimental stage may include: training optimization and parameter adjustment of the improved CNN-LSTM fusion model; and the fourth experimental stage may include: performance evaluation, detection accuracy, loss calculation, and result classification.

[0095] In this embodiment, for intrusion detection and identification at the network layer, a cross-layer underwater sensor network intrusion attack system is built, and underwater acoustic communication intrusion attack detection is performed through an improved CNN-LSTM fusion model architecture. The specific work includes addressing the problem of abnormal attack detection that the current research mainly focuses on a single routing layer, and building an underwater sensor network intrusion attack system based on underwater networking equipment such as underwater communication nodes, relay nodes, and shore-based communication servers, and constructed by a routing layer, a MAC layer, and a physical layer; the attack system simulates an underwater network with shore-based server equipment, and performs underwater acoustic replay attacks, MAC attacks, and cross-node server malicious attacks by setting an attack transmission protocol, and collects attack data in the network in real time, uses the FFT algorithm and sliding window mechanism to process data samples, and constructs a communication transmission data set across the physical layer, MAC layer, and routing layer; the attack system can provide a large amount of real-time attack data for the underwater acoustic communication intrusion detection model to quickly improve the number of model iterations and detection performance.

[0096] Based on a cross-layer intrusion attack system for underwater sensor networks, this paper proposes an improved underwater acoustic communication intrusion detection algorithm based on a CNN-LSTM fusion model architecture, using both abnormal attack data and normal transmission data collected by the system as the data driver for a deep learning model. By connecting the CNN and LSTM models through intermediate layer components, re-deploying the convolutional layers, max pooling layers, and activation function components, and optimizing them with fully connected layers and softmax layers, the improved algorithm inherits the advantages of the CNN model in processing feature data using convolution and pooling, and the LSTM model in processing time series data, making it more suitable for processing underwater acoustic communication data. By controlling experimental parameters and conducting comparative model performance experiments, the improved CNN-LSTM fusion model was evaluated using detection rate, precision, recall rate, and F1 score as performance evaluation metrics.

[0097] It should be understood that, although the various steps in the above flow chart are shown in sequence as indicated by the arrows, these steps are not necessarily performed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and these steps can be performed in other orders. Moreover, at least a portion of the steps in the above flow chart may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily performed at the same time, but can be performed at different times, and the execution order of these sub-steps or stages is not necessarily to be performed in sequence, but can be performed in turn or alternately with other steps or at least a portion of the sub-steps or stages of other steps.

[0098] In one embodiment, Figure 6As shown, a CNN-LSTM-based underwater acoustic communication intrusion detection system is provided, including: an attack system establishment module 610, a simulated attack module 620, a model optimization module 630 and a detection module 640, wherein:

[0099] The attack system establishment module 610 is used to build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and simulate an underwater sensor network with shore-based communication server equipment through the attack system;

[0100] The simulated attack module 620 is used to simulate attacks on the underwater sensor network based on the intrusion attack system, collect attack data from the underwater sensor network in real time, and process the attack data using the FFT algorithm and sliding window mechanism to obtain an attack data set; and construct a communication transmission data set across the physical layer, MAC layer, and routing layer;

[0101] Model optimization module 630, configured to input the attack dataset and the transmission dataset into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model based on the output results to obtain a target CNN-LSTM fusion model;

[0102] Detection module 640, configured to perform underwater acoustic communication intrusion detection based on a target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results;

[0103] Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through intermediate layer components, redeploys the convolution layer, maximum pooling layer and activation function components, and is optimized through the fully connected layer and softmax layer.

[0104] In one embodiment, the detection module 640 is further configured to obtain various evaluation metrics; based on the various evaluation metrics, track changes in validation loss during the training phase of the target CNN-LSTM fusion model; and perform a performance evaluation of the target CNN-LSTM fusion model based on the loss changes to obtain evaluation results. The evaluation metrics include accuracy, precision, recall, F1 score, and loss value.

[0105] In one embodiment, the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM; the model optimization module 630 is also used to collect water test data and input the water test data into the improved CNN-LSTM fusion model; the water test data is feature extracted by the CNN part in the improved CNN-LSTM fusion model, and the extracted features are processed to obtain processed time series data; the time series data is trained and processed by the LSTM part in the improved CNN-LSTM fusion model, and the detection results during the training process are output.

[0106] In one embodiment, in the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function construction; the LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and the cross entropy loss function is used as the model evaluation indicator.

[0107] In one embodiment, the model optimization module 630 is also used to obtain and preprocess an ocean data set, perform data type conversion on the processed ocean data set, and generate a target data set; input the target data set into a classification and recognition model, classify the elements in the target data set and assign data labels to obtain an input data set; divide the input data set into a training set, a validation set, and a test set, and train the improved CNN-LSTM fusion model based on the training set, the validation set, and the test set.

[0108] In one embodiment, the model optimization module 630 is also used to obtain an ocean dataset, perform denoising on the ocean dataset, and fill in empty cells in the ocean dataset to obtain a processed ocean dataset; convert the cell contents in the processed ocean dataset into text format, and map the category data to fixed numerical values ​​to generate a target dataset.

[0109] In one embodiment, the model optimization module 630 is also used to input the target data set into the classification recognition model, identify normal data and abnormal data through the classification recognition model; assign normal numerical labels to normal data and assign abnormal sample labels to abnormal data through the classification recognition model; and use normal data with normal numerical labels and abnormal data with abnormal sample labels as input data sets.

[0110] In one embodiment, the detection module 640 is also used to search for data carrying abnormal sample labels from the attack data set as abnormal attack data, and to search for data carrying normal numerical labels from the transmission data set as normal transmission data; the abnormal attack data and the normal transmission data are input into the improved CNN-LSTM fusion model, and iterated through the improved CNN-LSTM fusion model.

[0111] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, memory, network interface, display screen and input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal via a network connection. When the computer program is executed by the processor, a method for underwater acoustic communication intrusion detection based on CNN-LSTM is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covering the display screen, or a key, trackball or touchpad provided on the computer device housing, or an external keyboard, touchpad or mouse.

[0112] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different component arrangement.

[0113] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of the underwater acoustic communication intrusion detection method based on CNN-LSTM are implemented.

[0114] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the underwater acoustic communication intrusion detection method based on CNN-LSTM are implemented.

[0115] Those skilled in the art will appreciate that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in various forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0116] The technical features of the above embodiments can be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above-described embodiments merely represent several implementation methods of the present application. While the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art could make various modifications and improvements without departing from the spirit of the present application, all of which fall within the scope of protection of the present application. Therefore, the scope of protection of the present patent application shall be determined by the appended claims.

Claims

1. A method for underwater acoustic communication intrusion detection based on CNN-LSTM, characterized in that: The method comprises: Based on underwater communication nodes, relay nodes, and shore-based communication servers, an underwater sensor network intrusion attack system consisting of a routing layer, a MAC layer, and a physical layer is constructed. The attack system is used to simulate an underwater sensor network with shore-based communication server equipment. Based on the intrusion attack system, a simulated attack is performed on the underwater sensor network, attack data in the underwater sensor network is collected in real time, and the attack data is processed using the FFT algorithm and sliding window mechanism to obtain an attack data set; a communication transmission data set across the physical layer, MAC layer, and routing layer is constructed; Input the attack dataset and the transmission dataset into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model; the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM; in the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function; the LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and a cross-entropy loss function is used as a model evaluation indicator; The method further includes: collecting water test data and inputting the water test data into the improved CNN-LSTM fusion model; performing feature extraction on the water test data using the CNN part of the improved CNN-LSTM fusion model, and performing data processing on the extracted features to obtain processed time series data; performing training processing on the time series data using the LSTM part of the improved CNN-LSTM fusion model, and outputting detection results during the training process; Perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results; Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

2. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 1 is characterized in that: The method further comprises: Obtain various evaluation indicators; Tracking changes in validation loss during the training phase of the target CNN-LSTM fusion model based on each of the evaluation metrics; A performance evaluation is performed on the target CNN-LSTM fusion model based on the loss change to obtain an evaluation result.

3. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 2 is characterized in that: The evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

4. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 1 is characterized in that: The training process of the improved CNN-LSTM fusion model includes: Obtain and preprocess the ocean dataset, convert the data type of the processed ocean dataset to generate the target dataset; Inputting the target data set into a classification and recognition model, classifying the elements in the target data set and assigning data labels to obtain an input data set; The input data set is divided into a training set, a validation set and a test set, and the improved CNN-LSTM fusion model is trained based on the training set, the validation set and the test set.

5. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 4 is characterized in that: Obtain and preprocess the ocean dataset, convert the data type of the processed ocean dataset, and generate the target dataset, including: Acquiring an ocean dataset, performing denoising processing on the ocean dataset, and filling empty value cells in the ocean dataset to obtain a processed ocean dataset; The cell contents in the processed ocean dataset are converted into text format, and the category data are mapped to fixed numerical values ​​to generate a target dataset.

6. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 4 is characterized in that: Inputting the target data set into the classification and recognition model, classifying the elements in the target data set and assigning data labels to obtain the input data set, including: Inputting the target data set into a classification recognition model, and identifying normal data and abnormal data through the classification recognition model; Assigning normal numerical labels to the normal data and abnormal sample labels to the abnormal data through the classification recognition model; Normal data with normal numerical labels and abnormal data with abnormal sample labels are used as input data sets.

7. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 6 is characterized in that: The attack dataset and the transmission dataset are input into the improved CNN-LSTM fusion model for iteration and intrusion detection, including: Searching for data carrying the abnormal sample label from the attack data set as abnormal attack data, and searching for data carrying the normal value label from the transmission data set as normal transmission data; The abnormal attack data and normal transmission data are input into the improved CNN-LSTM fusion model, and it is iterated through the improved CNN-LSTM fusion model.

8. A CNN-LSTM-based underwater acoustic communication intrusion detection system, characterized in that: The system comprises: An attack system establishment module is used to build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and to simulate an underwater sensor network with shore-based communication server equipment through the attack system; A simulated attack module is used to simulate an attack on the underwater sensor network based on the intrusion attack system, collect attack data from the underwater sensor network in real time, and process the attack data using an FFT algorithm and a sliding window mechanism to obtain an attack data set; and construct a communication transmission data set across the physical layer, MAC layer, and routing layer; A model optimization module is configured to input the attack dataset and the transmission dataset into an improved CNN-LSTM fusion model for iteration and intrusion detection, and to adjust and optimize the improved CNN-LSTM fusion model based on the output results to obtain a target CNN-LSTM fusion model; the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM; in the improved CNN-LSTM fusion model, the CNN portion is provided with a convolution layer, a maximum pooling layer, and an activation function construction; the LSTM portion is constructed after the CNN portion, and a fully connected layer and a softmax layer are deployed after the LSTM portion, and a cross-entropy loss function is used as a model evaluation indicator; The model optimization module is further used to collect water test data and input the water test data into the improved CNN-LSTM fusion model; extract features from the water test data through the CNN part of the improved CNN-LSTM fusion model, and perform data processing on the extracted features to obtain processed time series data; train the time series data through the LSTM part of the improved CNN-LSTM fusion model, and output the detection results during the training process; A detection module, configured to perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results; Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

Images