Network security attack classification detection method and system based on random forest

Abstract

The invention provides a network security attack classification detection method and system based on a random forest, and relates to the technical field of network security. The method comprises the following steps: collecting network flow data; determining target network traffic data through a time-based sliding window algorithm; extracting a plurality of network traffic characteristics in the target network traffic data; calculating an average entropy value of the network flow characteristics; judging whether the average entropy value of the network flow characteristics is within a preset entropy value range or not; if yes, preliminarily determining the target network traffic data as normal traffic data; otherwise, preliminarily determining the target network traffic data as abnormal traffic data, and entering the next step; performing data processing on the abnormal traffic data; and carrying out classification detection on the processed abnormal flow data through an improved random forest algorithm to obtain an accurate detection result. The feature importance can be deeply analyzed, the classification efficiency is high, and the time consumed in the classification process is short.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security attack classification detection method and system based on random forest. Background Art

[0002] With the rapid development of Internet technology, the types and complexity of network attacks are also increasing. Network security issues have become a core issue of common concern in various industries. Especially driven by emerging technologies such as cloud computing, big data, and the Internet of Things, the scale of network traffic has shown exponential growth, and the traffic structure has become increasingly complex, resulting in more diverse and more hidden forms of network attacks. Therefore, how to effectively and accurately classify and detect network security attacks has become a key technical challenge that needs to be urgently solved in the field of network security.

[0003] In existing technical solutions, traditional network security attack classification detection methods have high computational complexity when processing large-scale, multi-dimensional network traffic data and are unable to quickly respond to sudden network attacks.

[0004] In addition, when faced with massive network traffic data, existing detection methods lack in-depth analysis of feature importance, resulting in low classification efficiency and a time-consuming classification process, making it difficult to meet the needs of real-time classification of network security attacks. Summary of the invention

[0005] In order to solve the technical problems that traditional network security attack classification detection methods have high computational complexity and a long classification process when processing large-scale, multi-dimensional network traffic data, cannot quickly respond to sudden network attacks, and lack in-depth analysis of feature importance when facing massive network traffic data, resulting in low classification efficiency and difficulty in meeting the needs of real-time classification of network security attacks, the present invention provides a network security attack classification detection method and system based on random forest.

[0006] The technical solution provided by the embodiment of the present invention is as follows:

[0007] First aspect:

[0008] An embodiment of the present invention provides a network security attack classification detection method based on random forest, comprising:

[0009] S1: collect network traffic data;

[0010] S2: Determine the target network traffic data through a time-based sliding window algorithm;

[0011] S3: extracting multiple network traffic features from the target network traffic data;

[0012] S4: Calculate the average entropy value of the network traffic characteristics;

[0013] S5: Determine whether the average entropy value of the network traffic feature is within a preset entropy value range; if so, preliminarily determine the target network traffic data as normal traffic data, and return to S1 to continue detection; otherwise, preliminarily determine the target network traffic data as abnormal traffic data, and proceed to the next step;

[0014] S6: Processing the abnormal traffic data;

[0015] S7: Use the improved random forest algorithm to classify and detect the processed abnormal traffic data, obtain accurate detection results, and return to S1 to continue detection.

[0016] Second aspect:

[0017] An embodiment of the present invention provides a network security attack classification detection system based on random forest, comprising: a memory and one or more processors;

[0018] One or more application programs are stored in the memory, and the one or more application programs are suitable for being executed by the one or more processors to implement the above-mentioned random forest-based network security attack classification detection method.

[0019] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0020] In the present invention, the target network traffic data is determined by a time-based sliding window algorithm. When processing large-scale, multi-dimensional network traffic data, the data processing scale is effectively reduced and the computational complexity is reduced. By extracting multiple network traffic features in the target network traffic data and calculating the average entropy value of the network traffic features, it is preliminarily determined that the target network traffic data is normal traffic data or abnormal traffic data, and it is capable of quickly responding to sudden network attacks. Through the improved random forest algorithm, classification detection is performed, and the importance of features can be deeply analyzed. The classification efficiency is high, and the classification process is short, which can meet the needs of real-time classification of network security attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram of a flow chart of a network security attack classification detection method based on random forest provided in an embodiment of the present invention;

[0023] Figure 2 A schematic diagram of the structure of a random forest-based network security attack classification detection system provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0024] The technical solution of the present invention is described below in conjunction with the accompanying drawings.

[0025] In the embodiments of the present invention, words such as "exemplarily" and "for example" are used to indicate examples, illustrations or explanations. Any embodiment or design described as "example" in the present invention should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of the word "example" is intended to present the concept in a specific way. In addition, in the embodiments of the present invention, the meaning expressed by "and / or" can be both, or it can be either of the two.

[0026] In order to make the technical problems, technical solutions and advantages to be solved by the present invention more clear, a detailed description will be given below with reference to the accompanying drawings and specific embodiments.

[0027] Reference Manual Attached Figure 1 , shows a flow chart of a random forest-based network security attack classification detection method provided in an embodiment of the present invention.

[0028] The embodiment of the present invention provides a network security attack classification detection method based on random forest, which can be implemented by a network security attack classification detection device based on random forest, and the network security attack classification detection device based on random forest can be a terminal or a server. The processing flow of the network security attack classification detection method based on random forest can include the following steps:

[0029] S1: Collect network traffic data.

[0030] Optionally, network traffic data transmitted over the network is collected in real time using a network packet capture tool (such as Wireshark or tcpdump).

[0031] Among them, Wireshark is a graphical network protocol analysis tool that can capture and display the contents of data packets transmitted in the network in real time. It supports the analysis of hundreds of network protocols and provides powerful filtering and search functions, allowing users to quickly locate data packets or network events of interest. Wireshark's intuitive user interface allows network administrators, security experts, and network application developers to easily perform network debugging and network security analysis.

[0032] Among them, tcpdump is a command line interface packet analysis tool that runs on various Unix-like operating systems. It can capture packets on network interfaces and provide options to filter and display detailed information about these captured packets. tcpdump is more suitable for script use or network monitoring and troubleshooting in environments where GUI is not available.

[0033] In the present invention, a network packet capture tool is used to capture data flows in the network in real time, ensuring that the acquired data is up to date, thereby more accurately reflecting the network status and traffic characteristics. This is essential for timely discovery and response to network security threats. The packet capture tool can capture detailed information of each data packet (such as source IP, destination IP, port number, protocol type, etc.), making subsequent data analysis and feature extraction more detailed, and helping to improve the accuracy of network security detection.

[0034] S2: Determine the target network traffic data through a time-based sliding window algorithm.

[0035] It should be noted that the time-based sliding window algorithm is a dynamic data processing technology used to monitor and analyze data streams in real time. In this algorithm, data is managed and processed in fixed-size time windows. Whenever new data arrives, the window slides forward to retain the latest data and remove obsolete data. This method can effectively capture and analyze the time series characteristics of data and is suitable for scenarios such as traffic monitoring, anomaly detection, and trend analysis. It ensures that the analysis results reflect the current state rather than historical data, thereby improving the response speed and accuracy of the system.

[0036] In the present invention, the sliding window algorithm can process and analyze network traffic data in real time, ensuring that the system can quickly respond to changes in network status and promptly identify potential security threats or abnormal activities. The dynamic characteristics of the sliding window enable the algorithm to capture the changing trends and patterns of traffic in real time, providing a more accurate analysis of network traffic behavior, especially in the face of rapidly changing network environments. By removing outdated data, the sliding window ensures that the analysis results reflect the current network status rather than historical data, thereby improving the timeliness and accuracy of decision-making.

[0037] In a possible implementation, S2 specifically includes sub-steps S201 and S202:

[0038] S201: Inserting network traffic data into the sliding window.

[0039] S202: Determine whether the collection time of the network traffic data is greater than the preset duration of the sliding window. If so, remove the network traffic data in the sliding window. Otherwise, retain the network traffic data in the sliding window and use the retained network traffic data as the target network traffic data.

[0040] It should be noted that those skilled in the art can set the preset duration according to actual needs, and the present invention is not limited thereto.

[0041] In the present invention, by inserting network traffic data into the sliding window in real time, the system can quickly capture the latest traffic information and ensure that the analysis is based on the current state, thereby improving the response speed to network attacks and abnormal traffic. It is determined whether the data collection time exceeds the preset time, so that the sliding window can be automatically updated to remove outdated data. In this way, the system can focus on the latest traffic characteristics and reduce the impact of redundant data. The mechanism of retaining valid data ensures that the analysis is based on the most relevant traffic information, enhances the accuracy of traffic monitoring and anomaly detection, and reduces the risk of false positives and false negatives.

[0042] S3: Extract multiple network traffic features from the target network traffic data.

[0043] It should be noted that network traffic characteristics refer to various attributes or indicators used to describe and analyze network traffic data. These characteristics can help identify traffic behavior patterns and potential security threats.

[0044] Optionally, the network traffic characteristics specifically include: source IP address, destination IP address, source port, destination port, transport protocol (such as TCP, UDP), packet size, traffic duration, traffic direction (inbound or outbound), number of sessions, flag bits (such as TCP flag bits), and byte and packet counts in the traffic.

[0045] In the present invention, extracting multiple network traffic features enables the system to analyze network traffic from multiple perspectives, which helps to fully understand the behavior patterns of traffic and identify the difference between normal and abnormal traffic. By analyzing the features, potential security threats such as DDoS attacks, intrusions, and data leaks can be identified in a timely manner. This feature extraction capability can help network security protection systems respond to various attacks more quickly and effectively. Different traffic features can help build models to identify abnormal behavior in traffic, further improving the system's adaptability when facing unknown threats.

[0046] S4: Calculate the average entropy value of network traffic characteristics.

[0047] In the present invention, entropy is used as an important indicator in information theory to measure the uncertainty and complexity of network traffic characteristics. By calculating the average entropy value, the diversity and degree of change of traffic data can be effectively understood, which helps to identify potential abnormal behaviors. By calculating the average entropy value, the complex information of multiple traffic characteristics can be condensed into a value, thereby simplifying the data analysis process and improving data processing efficiency.

[0048] In a possible implementation, S4 specifically includes sub-steps S401 to S403:

[0049] S401: Calculate the entropy value of each network traffic feature using the Shannon entropy formula.

[0050] It should be noted that the Shannon entropy formula is a mathematical tool used in information theory to measure the uncertainty or randomness of information, proposed by Claude Shannon. The formula quantifies the complexity and amount of information by calculating the probability distribution of all possible values ​​of a random variable.

[0051] Optionally, the entropy value of each network traffic feature is calculated according to the following formula:

[0052]

[0053] Among them, H(O) represents the entropy value of network traffic feature O, O represents the network traffic feature in the target network traffic data, and p(o i ) represents the probability of occurrence of the ith characteristic value of the network traffic feature, o i represents the i-th eigenvalue of the network traffic feature, and n represents the total number of eigenvalues ​​of the network traffic feature.

[0054] S402: normalizing the entropy value of each network traffic feature to obtain a normalized entropy value of each network traffic feature.

[0055] Optionally, the entropy value of each network traffic feature is normalized according to the following formula to obtain a normalized entropy value of each network traffic feature:

[0056]

[0057] Among them, H 0 (O) represents the normalized entropy value of network traffic feature O.

[0058] S403: Calculate the average entropy value of the network traffic feature according to the normalized entropy value of each network traffic feature.

[0059] Optionally, the average entropy value of the network traffic feature is calculated according to the following formula:

[0060]

[0061] Among them, H avg represents the average entropy value of network traffic features, M represents the total number of network traffic features, O m Represents the mth network traffic feature.

[0062] In the present invention, by calculating the entropy value, abnormal patterns in traffic can be effectively identified. When the entropy value of certain features is significantly higher than the normal level, it may indicate the presence of potential security threats, such as network attacks. This information can be used for real-time monitoring and response. Normalizing the entropy value can eliminate the scale differences between different features, making each feature more comparable in subsequent analysis. This standardization helps to improve the performance and stability of machine learning models. By calculating the average entropy value, the information of multiple features is condensed into one indicator, which simplifies the data processing process. The average entropy value provides a measure of feature importance, which helps to screen out the most useful features for classification tasks, optimize model construction, and improve prediction accuracy.

[0063] S5: Determine whether the average entropy value of the network traffic feature is within the preset entropy value range. If so, the target network traffic data is preliminarily determined as normal traffic data, and return to S1 to continue detection. Otherwise, the target network traffic data is preliminarily determined as abnormal traffic data, and proceed to the next step.

[0064] It should be noted that those skilled in the art can set the size of the preset entropy value range according to actual needs, and the present invention is not limited here.

[0065] In the present invention, by setting the entropy value range, the normality and abnormality of network traffic can be quickly judged, helping the system to timely identify potential security threats, such as network attacks or data leaks, thereby improving the response speed. By real-time monitoring and evaluating the entropy value of network traffic characteristics and comparing it with the preset threshold, potential abnormalities or attack behaviors can be identified early. This early detection helps prevent the spread and damage of security threats. By determining whether the traffic is normal, the system can effectively allocate resources and attention, focus on real threats, avoid excessive intervention in normal activities, and thus optimize the use of security resources.

[0066] S6: Process the abnormal traffic data.

[0067] In the present invention, through data cleaning and normalization and other processing steps, noise and inconsistent data can be effectively removed, errors can be corrected, and missing values ​​can be filled. This not only improves the quality of the data, but also provides accurate and clean data input for subsequent analysis and machine learning models, thereby improving the reliability and accuracy of the analysis results.

[0068] In a possible implementation, S6 specifically includes sub-steps S601 and S602:

[0069] S601: Clean up abnormal traffic data.

[0070] Optionally, data cleaning includes: removing duplicate records, processing missing values, and removing noisy data.

[0071] Among them, removing duplicate records specifically involves checking whether there are duplicate data records in the abnormal traffic data and deleting redundant copies to ensure the uniqueness of each data. Processing missing values ​​specifically involves identifying missing values ​​in the data and handling them according to the specific situation. Common methods include filling missing values ​​(such as using the mean, median or mode) or directly deleting records containing missing values. Removing noise data specifically involves identifying and deleting abnormal values ​​or erroneous data that may interfere with the analysis results. These data may be caused by sensor failures, data transmission errors, etc.

[0072] S602: Normalize the abnormal traffic data after data cleaning.

[0073] Optionally, the abnormal traffic data after data cleaning is normalized according to the following formula:

[0074]

[0075] in, Represents the normalized network traffic characteristics The i-th eigenvalue of Represents network traffic characteristics The i-th eigenvalue of Indicates the network traffic characteristics in abnormal traffic data. Min means taking the minimum value, and max means taking the maximum value.

[0076] In the present invention, by removing duplicate records, processing missing values ​​and noise data, the uniqueness and accuracy of the data are ensured, and the overall quality of the data set is improved. This cleaning process removes inaccurate factors that may affect the analysis results, making subsequent data processing and analysis more reliable. Cleaning noise and inconsistencies in the data helps to reduce errors and biases and improve the accuracy of model training and prediction. Data normalization processing makes all feature values ​​on the same scale, which is crucial for most machine learning algorithms because these algorithms usually assume that all input data have the same scale. Normalized data helps to avoid the algorithm bias towards certain features due to differences in feature scales, thereby improving the overall performance of the model.

[0077] S7: Use the improved random forest algorithm to classify and detect the processed abnormal traffic data, obtain accurate detection results, and return to S1 to continue detection.

[0078] It should be noted that the random forest algorithm is an integrated learning method, mainly used for classification and regression tasks. It improves the accuracy and robustness of the model by building multiple decision trees and combining their prediction results. During the training process, the random forest uses the bootstrap method to randomly sample from the original data set, generate multiple subsets, and build independent decision trees for each subset. In addition, it also randomly selects features when the nodes of each tree split to increase the diversity of the model and reduce overfitting. Finally, the random forest determines the final prediction by voting or averaging the results of all decision trees, thereby improving the stability and accuracy of the model. This algorithm performs well in processing high-dimensional data and large-scale data sets, and is widely used in finance, medical care, network security and other fields.

[0079] Furthermore, the random forest algorithm is improved by introducing feature importance evaluation and dynamic feature selection mechanisms. Specifically, the improvement method includes real-time calculation of the contribution of each feature to the classification, thereby dynamically adjusting the feature set so that each tree can use the most relevant features for splitting. This method can not only improve the classification performance of the model, but also reduce computational overhead and the risk of overfitting. At the same time, the Out-Of-Bag Error is combined to optimize the number and structure of decision trees, so that the algorithm can automatically adjust parameters on different training sets, further improving the adaptability and accuracy of the model.

[0080] Among them, the decision tree is a machine learning model for classification and regression, which represents the decision-making process through a tree structure. Each internal node represents a test of a feature, the branch represents the test result, and the leaf node represents the final classification or prediction result. The decision tree starts from the root node, splits the data according to the value of the feature, and is recursively constructed layer by layer until the stopping condition is met (such as reaching the maximum depth or the number of node samples is less than the threshold). Due to its intuitive, easy to understand, easy to explain and visualized characteristics, decision trees are widely used in data analysis, feature selection and model interpretation. However, a single decision tree is prone to overfitting, so it is often used in combination with other techniques (such as random forests) to improve the robustness and accuracy of the model.

[0081] In the present invention, by introducing feature importance evaluation and dynamic feature selection mechanism, the algorithm can select the most relevant features when constructing each decision tree, which helps to improve the model's ability to recognize complex data patterns, thereby improving the overall classification accuracy. Real-time calculation of feature contribution and dynamic adjustment of feature sets can avoid the use of unnecessary features in the construction of each tree, which not only improves computational efficiency but also reduces memory and processing time consumption. By combining out-of-bag error to evaluate model performance and dynamically adjust the number and structure of decision trees, the model can better adapt to different data sets and changing data distributions, thereby enhancing the generalization ability of the model.

[0082] In a possible implementation, S7 specifically includes sub-steps S701 to S715:

[0083] S701: construct an initial forest consisting of multiple decision trees, where the decision tree includes multiple nodes.

[0084] S702: Calculate the entropy value of each node:

[0085]

[0086] Among them, E represents the entropy value of the node, and p(c) represents the probability of class label c in the node.

[0087] S703: Randomly select multiple network traffic features in the abnormal traffic data.

[0088] S704: According to the entropy value of each node, the nodes are divided using randomly selected network traffic features to obtain a left child node and a right child node of each node.

[0089] S705: Calculate the quality of node division based on the network traffic feature according to the entropy value of the left child node and the entropy value of the right child node:

[0090] Q(i,j)=exp{-(E l +E r )}

[0091] Among them, Q(i,j) represents the quality of the division of the jth network traffic feature on the i-th node, and E l Represents the entropy value of the left child node, E r Represents the entropy value of the right child node.

[0092] S706: Calculate the local weight of the network traffic feature in the decision tree according to the quality of the node division based on the network traffic feature:

[0093]

[0094] Among them, w kj represents the local weight of the jth network traffic feature in the kth decision tree, Q k (i, j) represents the partition quality of the jth network traffic feature on the i-th node in the k-th decision tree, and N represents the total number of nodes in the decision tree.

[0095] S707: Calculate the standardized weight of the decision tree based on the out-of-bag error:

[0096]

[0097] Among them, η krepresents the standardized weight of the kth decision tree, δ k Represents the out-of-bag error of the kth decision tree, and max represents the maximum value.

[0098] Among them, Out-Of-Bag Error (OOB Error) is a method used to evaluate model performance in random forests and other ensemble learning algorithms. Since random forests use bootstrap random sampling data when constructing each decision tree, it means that each tree will not use all samples during training. Usually about one-third of the data is not selected. These unselected data are called out-of-bag samples. The out-of-bag error predicts the out-of-bag samples of each tree and calculates the classification or regression error of these samples, thereby providing an unbiased model evaluation indicator. Compared with the traditional cross-validation method, the out-of-bag error has the advantages of high computational efficiency and simple implementation, so it is widely used in random forest model optimization and selection.

[0099] S708: Calculate the global weight of the network traffic feature according to the local weight of the network traffic feature in the decision tree and the standardized weight of the decision tree:

[0100]

[0101] Among them, ω j represents the global weight of the j-th network traffic feature, and K represents the total number of decision trees.

[0102] S709: Sort the network traffic features according to their global weights.

[0103] S710: According to the sorting result, the first u 0 The network traffic features are marked as important features, and the first important feature set Γ is constructed 1 Mark the remaining network traffic features as irrelevant features and construct the first irrelevant feature set U 1 .

[0104] S711: Discard the first irrelevant feature set U according to the first preset condition 1 The second irrelevant feature set U is constructed by using some network traffic features in 2 .

[0105] In a possible implementation manner, the first preset condition is specifically:

[0106] ω a <μ n -2σ n

[0107] Among them, ω arepresents the global weight of the ath network traffic feature in the first irrelevant feature set, μ n represents the mean of the global weights of all network traffic features in the first irrelevant feature set, σ n Represents the standard deviation of the global weights of all network traffic features in the first irrelevant feature set.

[0108] S712: According to the second preset condition, the second irrelevant feature set U 2 Some network traffic features in are added to the first important feature set Γ 1 In the above example, we construct the third irrelevant feature set U 3 And the second important feature set Γ 2 .

[0109] In a possible implementation manner, the second preset condition is specifically:

[0110] ω b ≥min(ω c )

[0111] Among them, ω b represents the global weight of the bth network traffic feature in the second irrelevant feature set, ω c It represents the global weight of the cth network traffic feature in the first important feature set, and min represents the minimum value.

[0112] S713: Determine the third irrelevant feature set U 3 The first irrelevant feature set U 1 The number of network traffic features changes to Δv, and the second most important feature set Γ 2 With the first important feature set Γ 1 The number of network traffic features changes is Δu.

[0113] S714: Based on the third irrelevant feature set U 3 The first irrelevant feature set U 1 The number of network traffic features and the second most important feature set Γ 2 With the first important feature set Γ 1 The number of network traffic features changes, and the number of decision trees is determined by:

[0114] B new =B 0 +λ u Δu+λ v Δv

[0115] Among them, B new Indicates the increase or decrease in the number of decision trees, B 0 represents the initial number of decision trees, λ uThe decision coefficient representing the change in the number of network traffic features between the second important feature set and the first important feature set, Δu represents the change in the number of network traffic features between the second important feature set and the first important feature set, λ v The decision coefficient representing the quantity change of the network traffic features of the third irrelevant feature set and the first irrelevant feature set, Δv represents the quantity change of the network traffic features of the third irrelevant feature set and the first irrelevant feature set.

[0116] S715: Repeat sub-steps S702 to S714 until the number of network traffic features in the third irrelevant feature set is less than the preset number of features, and then the algorithm is terminated to obtain an accurate detection result.

[0117] It should be noted that those skilled in the art can set the size of the preset feature quantity according to actual needs, and the present invention is not limited here.

[0118] In the present invention, by calculating the entropy value and partition quality of each feature, and determining the local and global weights of the features accordingly, the features that are most helpful for classification can be identified more accurately. This method helps to optimize the construction of decision trees and avoid the noise and complexity introduced by irrelevant features. The weight of each tree is evaluated and adjusted according to the out-of-bag error, and the number of decision trees is adjusted according to the actual classification effect, so that the model can be more refined to adapt to different data characteristics and changes, thereby improving the generalization ability of the model and the accuracy of the overall classification. By repeatedly adjusting and optimizing the composition of the decision tree, it is ensured that each iteration is working towards improving the classification accuracy, and ultimately achieving the purpose of accurately detecting abnormal traffic.

[0119] In a possible implementation, the random forest-based network security attack classification detection method further includes:

[0120] S8, with the goal of minimizing the error between the actual detection results and the true detection results of abnormal traffic data, the parameters of the improved random forest algorithm are optimized through the cuckoo search algorithm.

[0121] It should be noted that the cuckoo search algorithm is an optimization algorithm based on the parasitic reproduction behavior of cuckoos in nature, and is mainly used to solve complex global optimization problems. The algorithm simulates the behavior of cuckoos parasitizing their eggs in other bird nests, exploring the search space and selecting the optimal solution. In the algorithm, each solution is regarded as a bird's nest, which is randomly generated at the beginning. The cuckoo selects high-quality nests to replace low-quality nests according to the fitness function. The algorithm uses "discovery probability" and "Lévy flight" strategies to perform global and local searches, thereby achieving a better balance between exploration and development in the search process. Due to its strong global search capability and adaptability, the cuckoo search algorithm has been widely used in optimization, machine learning, image processing and other fields.

[0122] Furthermore, the cuckoo search algorithm is improved by introducing an adaptive step size factor and a dynamic discovery probability mechanism. Specifically, the improved method automatically adjusts the step size factor according to the current number of iterations and the search state, so that the algorithm can conduct extensive exploration in the early stage of the search, and increase the fine search for the local optimal solution in the convergence stage.

[0123] In the present invention, the cuckoo search algorithm is known for its efficient global search capability, and can quickly locate potential optimal solutions in parameter space. By adaptively adjusting the step size factor and dynamic discovery probability, the algorithm can flexibly switch between extensive exploration and fine search, which helps to converge to the optimal parameter configuration faster, thereby reducing computing time and resource consumption. By accurately adjusting the parameters of the random forest algorithm, such as the number of decision trees, feature selection methods, and tree depth, the cuckoo search algorithm helps to significantly improve the classification accuracy and robustness of the random forest model. The optimized parameter settings enable the model to better adapt to data characteristics and improve the ability to detect abnormal traffic.

[0124] In a possible implementation, S8 specifically includes sub-steps S801 and S802:

[0125] S801: With the goal of minimizing the error between the actual detection result and the true detection result of abnormal traffic data, an objective function is constructed:

[0126]

[0127] Among them, MSE represents the objective function, θ represents the parameter set of the improved random forest algorithm, R represents the total number of abnormal traffic data, y r represents the true detection result of the rth abnormal traffic data, Represents the actual detection result of the rth abnormal traffic data.

[0128] S802: Optimizing parameters of the improved random forest algorithm through a cuckoo search algorithm according to the objective function.

[0129] In the present invention, the cuckoo search algorithm can adjust the parameters of the random forest algorithm more accurately by using an objective function (MSE) constructed with the goal of minimizing the error between the actual detection result and the true detection result. This refined optimization helps to improve the performance of the algorithm on a specific data set, ensuring high accuracy and low error rate of the classification results. The global optimization capability of the cuckoo search algorithm enables it to explore a wide range of areas in the parameter space, thereby finding the optimal or near-optimal parameter configuration, which directly enhances the performance of the random forest model. The optimized parameter settings make the model more adaptable to the data characteristics, and can effectively improve the accuracy and generalization ability of the model.

[0130] In a possible implementation, S802 specifically includes sub-steps S8021 to S8028:

[0131] S8021: Initialize parameters and set the maximum number of iterations of the cuckoo search algorithm.

[0132] S8022: Randomly generate an initial population, where the initial population includes multiple bird nests, and each bird nest represents a feasible parameter set of the improved random forest algorithm.

[0133] S8023: Using the objective function as the fitness function, calculating the fitness value of each bird's nest, and taking the bird's nest with the maximum fitness value as the current bird's nest.

[0134] S8024: Adaptively adjust the step size factor, discovery probability, and scaling factor based on the current number of iterations:

[0135]

[0136] Among them, α t represents the step size factor at the tth iteration, α max represents the maximum value of the step size factor, T represents the maximum number of iterations, α min represents the minimum value of the step factor, represents the probability of finding the i-th bird nest at the t-th iteration, P max Represents the maximum value of the discovery probability, P min represents the minimum value of the discovery probability, f i t represents the fitness value of the ith bird nest at the tth iteration, represents the maximum fitness value at the tth iteration, The scaling factor of the ith nest at the tth iteration, γ max represents the maximum value of the scaling factor, γ min represents the minimum value of the scaling factor, Represents the minimum fitness value at the tth iteration.

[0137] S8025: Update the current bird's nest through Levy flight operation according to the adaptively adjusted step size factor:

[0138]

[0139] in, represents the i-th bird's nest at the t+1-th iteration, represents the i-th bird nest at the t-th iteration, α represents the step size factor after adaptive adjustment, represents the dot product operation, and levy(β) represents the random step size generated by the Levy flight operation.

[0140] It should be noted that the Levy flight operation is a random step used in optimization algorithms, characterized by its step size following the Levy distribution, which allows the algorithm to perform long-distance exploration. Compared with standard random walks, Levy flights can cover a wide search space more effectively, help the algorithm avoid falling into local optimal solutions, and speed up the process of finding the global optimal solution. This method is particularly useful when solving complex optimization problems because it can explore farther areas, not just the local neighborhood.

[0141] S8026: Calculate the fitness value of the updated bird's nest, and compare the fitness value of the updated bird's nest with the fitness value of the current bird's nest. When the fitness value of the updated bird's nest is greater than the fitness value of the current bird's nest, replace the current bird's nest with the updated bird's nest. When the fitness value of the updated bird's nest is less than or equal to the fitness value of the current bird's nest, keep the current bird's nest unchanged.

[0142] S8027: Generate a random number in the range of 0 to 1, and compare the random number with the adaptively adjusted discovery probability. When the random number is greater than the adaptively adjusted discovery probability, the current bird nest is discovered, and the current bird nest is updated according to the adaptively adjusted scaling factor. When the random number is less than or equal to the adaptively adjusted discovery probability, the current bird nest is not discovered, and the current bird nest remains unchanged.

[0143] Among them, when the random number in S8027 is greater than the adaptively adjusted discovery probability, the current bird nest is discovered, and the current bird nest is updated according to the adaptively adjusted scaling factor, specifically:

[0144]

[0145] in, represents the i-th bird's nest at the t+1th iteration after the current bird's nest is discovered, represents the i-th bird nest at the t-th iteration after the current bird nest is discovered, γ represents the adaptively adjusted scaling factor, and represents two individuals l randomly selected from the population at the tth iteration after the current bird nest is discovered 1 and l 2 .

[0146] S8028: Repeat sub-steps S8025 to S8027 until the maximum number of iterations is reached.

[0147] In the present invention, the cuckoo search algorithm effectively finds the optimal or approximately optimal parameter settings through a combination of global and local searches, which can significantly improve the performance of the random forest model on a specific data set and enhance classification accuracy and robustness. By adaptively adjusting the step size factor and the probability of discovery, the algorithm can flexibly adjust the search strategy according to the current iteration, adapt to various complex optimization scenarios, and improve search efficiency. The effective global optimization algorithm reduces the number and time of trial and error required for parameter adjustment, thereby reducing the consumption of computing resources. Through the optimized parameters, the random forest algorithm can respond to actual network security threats faster and more accurately, and detect and respond to abnormal behaviors in a timely manner.

[0148] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0149] In the present invention, the target network traffic data is determined by a time-based sliding window algorithm. When processing large-scale, multi-dimensional network traffic data, the data processing scale is effectively reduced and the computational complexity is reduced. By extracting multiple network traffic features in the target network traffic data and calculating the average entropy value of the network traffic features, it is preliminarily determined that the target network traffic data is normal traffic data or abnormal traffic data, and it is capable of quickly responding to sudden network attacks. Through the improved random forest algorithm, classification detection is performed, and the importance of features can be deeply analyzed. The classification efficiency is high, and the classification process is short, which can meet the needs of real-time classification of network security attacks.

[0150] Reference Manual Attached Figure 2 , showing a structural schematic diagram of a network security attack classification detection system based on random forest provided by the present invention.

[0151] The present invention also provides a random forest-based network security attack classification detection system 30 , comprising: a memory 303 and one or more processors 301 .

[0152] One or more application programs are stored in the memory 303 , and the one or more application programs are suitable for being executed by the one or more processors 301 to implement the random forest-based network security attack classification detection method described in the method embodiment.

[0153] The network security attack classification detection system 30 based on random forest includes: a processor 301 and a memory 303. The processor 301 and the memory 303 are connected, for example, through a bus 302.

[0154] The structure of the random forest-based network security attack classification detection system 30 does not constitute a limitation on the embodiment of the present invention.

[0155] Processor 301 may be a CPU, a general purpose processor, a DSP, an ASIC, an FPGA or other programmable logic device, a transistor logic device, a hardware component or any combination thereof. It may implement or execute various exemplary logic blocks, modules and circuits described in conjunction with the disclosure of the present invention. Processor 301 may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of a DSP and a microprocessor, etc.

[0156] The bus 302 may include a path to transmit information between the above components. The bus 302 may be a PCI bus or an EISA bus, etc. The bus 302 may be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0157] The memory 303 can be a ROM or other type of static storage device that can store static information and instructions, a RAM or other type of dynamic storage device that can store information and instructions, or an EEPROM, a CD-ROM or other optical disk storage, an optical disk storage (including a compressed optical disk, a laser disk, an optical disk, a digital versatile disk, a Blu-ray disk, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store the desired program code in the form of instructions or data structures and can be accessed by a computer, but is not limited to these.

[0158] It should be noted that the random forest-based network security attack classification detection system 30 can implement the above-mentioned random forest-based network security attack classification detection method and can achieve the same or similar technical effects. To avoid repetition, the present invention will not go into details.

[0159] The beneficial effects brought about by the technical solution provided by the embodiment of the present invention include at least:

[0160] In the present invention, the target network traffic data is determined by a time-based sliding window algorithm. When processing large-scale, multi-dimensional network traffic data, the data processing scale is effectively reduced and the computational complexity is reduced. By extracting multiple network traffic features in the target network traffic data and calculating the average entropy value of the network traffic features, it is preliminarily determined that the target network traffic data is normal traffic data or abnormal traffic data, and it is capable of quickly responding to sudden network attacks. Through the improved random forest algorithm, classification detection is performed, and the importance of features can be deeply analyzed. The classification efficiency is high, and the classification process is short, which can meet the needs of real-time classification of network security attacks.

[0161] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art can easily think of changes or substitutions within the technical scope disclosed by the present invention, which should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention should be based on the protection scope of the claims.

[0162] There are a few points to note:

[0163] (1) The drawings of the embodiments of the present invention only relate to the structures related to the embodiments of the present invention, and other structures may refer to the general design.

[0164] (2) For the sake of clarity, in the drawings used to describe the embodiments of the present invention, the thickness of the layers or regions is exaggerated or reduced, that is, these drawings are not drawn according to the actual scale. It is understood that when an element such as a layer, film, region or substrate is referred to as being "on" or "under" another element, the element may be "directly" "on" or "under" the other element or there may be intermediate elements.

[0165] (3) In the absence of conflict, the embodiments of the present invention and the features therein may be combined with each other to obtain new embodiments.

[0166] The above are only specific embodiments of the present invention, but the protection scope of the present invention is not limited thereto. The protection scope of the present invention shall be based on the protection scope of the claims.

Claims

1. A network security attack classification detection method based on random forest, characterized in that: include: S1: collect network traffic data; S2: Determine the target network traffic data through a time-based sliding window algorithm; S3: extracting multiple network traffic features from the target network traffic data; S4: Calculate the average entropy value of the network traffic characteristics; S5: Determine whether the average entropy value of the network traffic feature is within a preset entropy value range; if so, preliminarily determine the target network traffic data as normal traffic data, and return to S1 to continue detection; Otherwise, the target network traffic data is preliminarily determined to be abnormal traffic data, and the process proceeds to S6; S6: Processing the abnormal traffic data; S7: Use the improved random forest algorithm to classify and detect the processed abnormal traffic data, obtain accurate detection results, and return to S1 to continue detection.

2. The network security attack classification detection method based on random forest according to claim 1 is characterized in that: The S2 specifically includes: S201: inserting the network traffic data into a sliding window; S202: Determine whether the collection time of the network traffic data is greater than the preset duration of the sliding window; if so, remove the network traffic data in the sliding window; otherwise, retain the network traffic data in the sliding window and use the retained network traffic data as the target network traffic data.

3. The network security attack classification detection method based on random forest according to claim 1 is characterized in that: The network traffic characteristics specifically include: source IP address, destination IP address, source port, destination port, transport protocol, packet size, traffic duration, traffic direction, number of sessions, flag bits, and byte and packet counts in the traffic.

4. The network security attack classification detection method based on random forest according to claim 1 is characterized in that: The S4 specifically includes: S401: Calculate the entropy value of each of the network traffic features using the Shannon entropy formula; S402: normalizing the entropy values ​​of the network traffic features to obtain normalized entropy values ​​of the network traffic features; S403: Calculate the average entropy value of the network traffic feature according to the normalized entropy value of each of the network traffic features.

5. The network security attack classification detection method based on random forest according to claim 1 is characterized in that: The S6 specifically includes: S601: Cleaning the abnormal traffic data; S602: Normalize the abnormal traffic data after data cleaning.

6. The network security attack classification detection method based on random forest according to claim 1 is characterized in that: The S7 specifically includes: S701: constructing an initial forest consisting of a plurality of decision trees, wherein the decision trees include a plurality of nodes; S702: Calculate the entropy value of each node: Among them, E represents the entropy value of the node, and p(c) represents the probability of class label c in the node; S703: Randomly select multiple network traffic features in the abnormal traffic data; S704: dividing the nodes according to the entropy values ​​of the nodes using randomly selected network traffic features to obtain left child nodes and right child nodes of each node; S705: Calculate the quality of the node division by the network traffic feature according to the entropy value of the left child node and the entropy value of the right child node: Q(i,j)=exp{-(E l +E r )} Among them, Q(i,j) represents the quality of the division of the jth network traffic feature on the i-th node, and E l Represents the entropy value of the left child node, E r Represents the entropy value of the right child node; S706: Calculate the local weight of the network traffic feature in the decision tree according to the quality of the node division by the network traffic feature: Among them, w kj represents the local weight of the jth network traffic feature in the kth decision tree, Q k (i,j) represents the quality of the division of the i-th node by the j-th network traffic feature in the k-th decision tree, and N represents the total number of nodes in the decision tree; S707: Based on the out-of-bag error, calculate the standardized weight of the decision tree: Among them, η k represents the standardized weight of the kth decision tree, δ k represents the out-of-bag error of the k-th decision tree, and max represents the maximum value; S708: Calculate the global weight of the network traffic feature according to the local weight of the network traffic feature in the decision tree and the standardized weight of the decision tree: Among them, ω j represents the global weight of the jth network traffic feature, and K represents the total number of decision trees; S709: Sort each network traffic feature according to the global weight of the network traffic feature; S710: According to the sorting result, mark the first u0 network traffic features as important features to construct a first important feature set Γ1; mark the remaining network traffic features as irrelevant features to construct a first irrelevant feature set U1; S711: According to a first preset condition, discard some network traffic features in the first irrelevant feature set U1, and construct a second irrelevant feature set U2; S712: According to a second preset condition, some network traffic features in the second irrelevant feature set U2 are added to the first important feature set Γ1 to construct a third irrelevant feature set U3 and a second important feature set Γ2; S713: Determine that the change in the number of network traffic features between the third irrelevant feature set U3 and the first irrelevant feature set U1 is Δv, and the change in the number of network traffic features between the second important feature set Γ2 and the first important feature set Γ1 is Δu; S714: Determine the increase or decrease value of the number of decision trees according to the change in the number of network traffic features between the third irrelevant feature set U3 and the first irrelevant feature set U1 and the change in the number of network traffic features between the second important feature set Γ2 and the first important feature set Γ1: B new =B0+λ u Δu+λ v Δv Among them, B new represents the increase or decrease in the number of decision trees, B0 represents the initial number of decision trees, and λ u The decision coefficient representing the change in the number of network traffic features between the second important feature set and the first important feature set, λ v A decision coefficient representing a change in the number of network traffic features of the third irrelevant feature set and the first irrelevant feature set; S715: Repeat sub-steps S702 to S714 until the number of network traffic features in the third irrelevant feature set is less than the preset number of features, and then the algorithm is terminated to obtain the accurate detection result.

7. The network security attack classification detection method based on random forest according to claim 6 is characterized in that: The first preset condition is specifically: oh a <m n -2s n Among them, ω a represents the global weight of the ath network traffic feature in the first irrelevant feature set, μ n represents the mean of the global weights of all network traffic features in the first irrelevant feature set, σ n Represents the standard deviation of the global weights of all network traffic features in the first irrelevant feature set.

8. The network security attack classification detection method based on random forest according to claim 6 is characterized in that: The second preset condition is specifically: oh b ≥min(ω c ) Among them, ω b represents the global weight of the bth network traffic feature in the second irrelevant feature set, ω c It represents the global weight of the cth network traffic feature in the first important feature set, and min represents the minimum value.

9. The network security attack classification detection method based on random forest according to claim 1 is characterized in that: Also includes: S8, optimizing the parameters of the improved random forest algorithm by using a cuckoo search algorithm with the goal of minimizing the error between the actual detection result and the true detection result of the abnormal traffic data.

10. A network security attack classification detection system based on random forest, characterized in that: include: memory and one or more processors; One or more applications are stored in the memory, and the one or more applications are suitable for being executed by the one or more processors to implement the random forest-based network security attack classification detection method according to any one of claims 1 to 9.

Images