Satellite network data anomaly detection method based on CNN and RWav-KAN

Abstract

The invention relates to the technical field of network security and satellite internet, and provides a satellite network anomaly detection method based on CNN and RWav-KAN. Aiming at the complex characteristics of large scale, high dimension, strong time correlation, dynamic non-stability and the like of satellite network data (including communication data, telemetry data and control data), firstly, spatial information characteristics are extracted by using a convolutional neural network (CNN), and a local mode is captured; then, frequency domain features are extracted through a residual wavelet Colmogolov-Arnodel network (RWav-KAN), and multi-frequency components are captured by adopting wavelet transform, so that the recognition capability of the complex traffic mode is enhanced; and finally, multi-scale features are fused through a dual-channel RWav-KAN structure, and a Softmax classifier is combined, so that the generalization performance and the detection accuracy of the model are remarkably improved. According to the satellite network anomaly detection method, the spatial feature extraction capability of the CNN and the multi-scale frequency domain analysis capability of the RWav-KAN are fused, the feature extraction and multi-scale analysis problems in satellite network anomaly detection are effectively solved, and a new technical means is provided for satellite network safety protection.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a satellite network data anomaly detection method based on CNN and RWav-KAN. Background Art

[0002] With the rapid development of mobile Internet technology, network traffic has expanded dramatically. Network traffic data is characterized by its temporality, dynamism, and diversity, making it difficult for traditional detection methods based on statistical learning to capture key features, especially when dealing with massive complex traffic and advanced network attacks. The goal of network intrusion detection is to identify potential threats through traffic data analysis, but its effectiveness is limited by the efficiency of data processing and feature extraction. Therefore, efficiently extracting and analyzing key features of network traffic has become the key to improving the performance of network intrusion detection.

[0003] In recent years, deep learning methods, especially convolutional neural networks (CNNs), have been widely used in the field of network intrusion detection due to their characteristics of parameter sharing, local connections, and hierarchical feature learning. Kolmogorov-Arnold Network (KAN) uses a learnable univariate activation function and is based on the Kolmogorov-Arnold representation theorem to capture complex relationships with fewer parameters, showing superior parameter efficiency and interpretability. Wav-KAN combines wavelet transform to improve multi-resolution analysis capabilities and effectively identify multi-scale anomalies in network traffic data.

[0004] However, the CNN model has some limitations when processing network traffic data, such as difficulty in capturing multi-scale features at the same time, gradient vanishing problem, and limited generalization ability. To solve these problems, the present invention proposes a satellite network data anomaly detection method based on CNN and RWav-KAN. After using CNN to effectively extract the spatial features of network traffic, a dual-channel RWav-KAN structure is adopted. Through the residual connection of Wav-KAN and CNN, different scale features of high frequency and low frequency are captured respectively, thereby improving the accuracy and generalization ability. Summary of the invention

[0005] The purpose of the present invention is to provide a satellite network data anomaly detection method based on CNN and RWav-KAN, which extracts the spatial features of network traffic data through one-dimensional convolution and further captures multi-scale features using dual-channel RWav-KAN to improve the accuracy and efficiency of detection.

[0006] To achieve the above object, the present invention provides the following technical solutions:

[0007] A satellite network data anomaly detection method based on CNN and RWav-KAN includes the following steps:

[0008] Step 1: Clean and standardize the data set to remove noise and unify the data scale;

[0009] Step 2: Use a one-dimensional convolutional layer to extract local key patterns of the preprocessed data and capture spatial features;

[0010] Step 3: Use the RWav-KAN model to further extract features, capturing both high-frequency and low-frequency components of the input data, and enhancing the model’s ability to recognize complex patterns.

[0011] Step 4: After activation by the ReLU function, the different scale features extracted by the dual-channel RWav-KAN are integrated to improve the nonlinear expression ability of the model.

[0012] Step 5: Use the Softmax function to normalize and generate the probability distribution of the classification results

[0013] Compared with the prior art, the present invention combines convolutional neural network (CNN), Wav-KAN and residual network structure, and proposes a satellite network data anomaly detection method based on CNN and RWav-KAN. The present invention has the following beneficial effects:

[0014] (1) The present invention combines Wav-KAN with CNN and forms the RWav-KAN module through residual connection. This module not only retains the advantages of Wav-KAN in multi-resolution analysis, but also makes full use of the efficiency of CNN in spatial feature extraction. The residual connection effectively alleviates the gradient vanishing problem in deep networks, accelerates model training, and improves convergence speed and stability.

[0015] (2) The present invention adopts a dual-channel RWav-KAN structure, and each channel uses a different wavelet basis to capture the high-frequency and low-frequency components in the data respectively. By integrating multi-scale features, the recognition ability of complex network traffic patterns is enhanced, and the generalization performance of the model is improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 A schematic diagram of a satellite network data anomaly detection method based on CNN and RWav-KAN of the present invention

[0017] Figure 2 The data preprocessing operation flow chart of the present invention is

[0018] Figure 3 The overall structure diagram of a satellite network data anomaly detection method based on CNN and RWav-KAN of the present invention is shown in FIG.

[0019] Figure 4This is a structural diagram of the RWav-KAN module of the present invention. DETAILED DESCRIPTION

[0020] The content of the present invention is further described below in conjunction with the drawings and embodiments, but the present invention is not limited thereto.

[0021] like Figure 1 As shown, the present invention provides a satellite network data anomaly detection method based on CNN and RWav-KAN, comprising the following steps:

[0022] Step 1: Preprocess the data of the network intrusion detection dataset

[0023] Step 2: Extract spatial features through a one-dimensional convolutional layer (Conv1D), followed by batch normalization (BatchNorm), ReLU activation, and max pooling (MaxPool1D) to generate an optimized feature representation

[0024] Step 3: Perform multi-resolution analysis through the RWav-KAN module, using residual connections to capture high- and low-frequency features of the data at the same time, thereby enhancing the model's feature extraction capabilities

[0025] Step 4: Use the ReLU function to activate and fuse the different scale features of the dual-channel RWav-KAN to improve the nonlinear expression ability of the model

[0026] Step 5: Use the Softmax function to normalize and obtain the final classification result

[0027] Furthermore, the network intrusion detection datasets mentioned above include NSL-KDD, CIC-IDS2017, UNSW-NB15 and InSDN datasets.

[0028] Further, in the above-mentioned satellite network data anomaly detection method based on CNN and RWav-KAN, the step 1 performs the following steps: Figure 2 As shown, the following steps are included:

[0029] Step 11: For the network intrusion data X = {x1, x2, x3, ..., x i ,…,x n}Data cleaning is required. Specifically, first, for each feature x i Check for default values ​​and outliers. For missing values ​​in normal traffic data, choose to directly delete these records to maintain data quality. For a small number of samples in the attack category, a more cautious strategy is adopted: numerical features are filled with mean or median according to their distribution characteristics; for categorical features, the mode is used to replace missing values.

[0030] Step 12: Encode all non-numeric data items so that the data can be processed by the neural network. Specifically, taking the NSL-KDD dataset as an example, the text features such as "protocol_type", "service", "flag" and "label" are converted into numerical form through label encoding or one-hot encoding.

[0031] Step 13: Implement minimum-maximum normalization on numerical features to eliminate the impact of different feature scale differences on model training. Ensuring that all feature values ​​are scaled to the range of [0,1] helps improve model training efficiency and prediction accuracy.

[0032] Step 14: To address the data imbalance problem in the dataset, the synthetic minority oversampling technique (SMOTE) is used. Specifically, cluster analysis is performed on each minority class to identify core samples. For each core sample, we select K = 5 nearest neighbors and calculate the feature differences between them to generate new synthetic samples. This process continues until the number of minority class samples reaches a certain proportion of the total number of samples, thereby ensuring a more balanced distribution of classes in the dataset for subsequent model training.

[0033] Further, Figure 3 It is an overall structural diagram of a satellite network data anomaly detection method based on CNN and RWav-KAN provided by the present invention, and step 2 as mentioned above includes:

[0034] The spatial features are extracted through a one-dimensional convolutional layer (Conv1D), followed by batch normalization (BatchNorm), ReLU activation function and maximum pooling (MaxPool1D) to generate optimized feature representations, laying the foundation for the subsequent processing of the RWav-KAN module. Specifically, Conv1D is first used to perform convolution operations on the preprocessed data to extract local patterns; then, BatchNorm is used to stabilize and accelerate the training process; then, the ReLU activation function is used to introduce nonlinearity to enhance the model's ability to capture complex features; finally, MaxPool1D is used to reduce the feature dimension, while retaining key information and reducing computational complexity.

[0035] X c =MaxPool1D(ReLU(BatchNorm(Conv1S(X))))

[0036] Among them, MaxPool1D is a one-dimensional maximum pooling layer, ReLU is a ReLU activation function, BatchNorm is a batch normalization layer, and Conv1D is a one-dimensional convolutional neural network.

[0037] Further, in the above-mentioned satellite network data anomaly detection method based on CNN and RWav-KAN, in step 3, Figure 4 As shown in the figure, the RWav-KAN module combines Wav-KAN with a 1D convolutional layer through a residual connection. This module not only realizes multi-resolution analysis of high and low frequency components in the data, but also improves the recognition and generalization capabilities of the model when processing complex network traffic data. Specifically, the input data is divided into two paths: one through the Wav-KAN module and the other through the 1D convolutional layer. The data in the Wav-KAN path first passes through a Wav-KAN layer to extract preliminary features, then introduces nonlinearity through the ReLU activation function, and then passes through another Wav-KAN layer to further refine the features. At the same time, the 1D convolutional path retains the features of the original input. Finally, the outputs of the two paths are merged at the addition node to generate an output that combines high and low frequency information.

[0038] The calculation formula of the Wav-KAN module is as follows:

[0039]

[0040] Among them, X c is the output of the convolutional layer in step 2, Ψ i is the learnable function of the output node, ψ i,j is the wavelet basis connecting input node j and output node i, x j is the jth component of the input vector X.

[0041] The calculation formula of the RWav-KAN module is as follows:

[0042] f Rwav-KAN (X) = f wav-kan (ReLU(f wav-kan (X c )))+Conv1D(X c )

[0043] Among them, X c is the spatial feature extracted in step 2, f RWav-KAN (X) is the output of RWav-KAN, f wav-kan (X c ) is the output of the Wav-KAN module, Conv1D(X c ) is the output of a one-dimensional convolutional neural network.

[0044] Through this structure, RWav-KAN not only retains the advantages of Wav-KAN in multi-resolution analysis, but also makes full use of the efficiency of 1D convolutional layers in spatial feature extraction. The Wav-KAN module captures both high-frequency and low-frequency components of the input data through wavelet transform, while the 1D convolutional layer further extracts local patterns in space. The introduction of residual connections not only enhances the model's ability to recognize complex patterns, but also alleviates the gradient vanishing problem in deep networks through jump connections, accelerating the model training process.

[0045] Furthermore, in the satellite network data anomaly detection method based on CNN and RWav-KAN as described above, step 4 comprises:

[0046] The output of RWav-KAN is first activated by the ReLU function, introducing nonlinearity, which enables the model to learn more complex feature combinations. Subsequently, these activated features are fused through the addition node to generate a comprehensive feature representation that combines high- and low-frequency information. The formula is as follows:

[0047]

[0048] X sum =X1+X2

[0049] in, is the output of the first channel RWav-KAN, is the output of the second channel RWav-KAN, X sum It is the fusion result of dual channel output.

[0050] Specifically, the dual-channel RWav-KAN structure uses multiple wavelet bases in the Wav-KAN model to extract features of input data at different scales. Each channel processes the input through a specific wavelet basis to capture different patterns and details, thereby generating complementary feature representations, which not only enhances the model's ability to recognize complex patterns, but also improves the model's generalization ability and detection accuracy by combining features at different scales.

[0051] Further, in the satellite network data anomaly detection method based on CNN and RWav-KAN as described above, step 5 comprises:

[0052] In step 5, after the feature extraction and fusion of the previous layers, the model generates a comprehensive feature representation for classification. In order to map these features to specific categories, the Softmax function is used, which is a commonly used activation function for multi-classification problems.

[0053] The Softmax function is defined as:

[0054]

[0055] Where K is the total number of categories, is the output value corresponding to category i.

[0056] Specifically, the Softmax function converts the output of the model (usually a real vector) into a probability distribution, with each output node corresponding to a category. This conversion ensures that the sum of the probabilities of all categories is 1, thus forming a valid probability distribution.

Claims

1. A satellite network data anomaly detection method based on CNN and RWav-KAN, characterized in that: The following steps are involved: Step 1: Clean and standardize the satellite network data to remove noise and unify the data scale; Step 2: Use the convolutional layer to extract local key patterns of the preprocessed data and capture spatial features; Step 3: Use the RWav-KAN model to further extract features, capturing both high-frequency and low-frequency components of the input data, and enhancing the model’s ability to recognize complex patterns; Step 4: After activation by the ReLU function, the different scale features extracted by the dual-channel RWav-KAN are fused; Step 5: Use the Softmax function to normalize and generate the probability distribution of the classification results.

2. According to claim 1, a satellite network data anomaly detection method based on CNN and RWav-KAN is characterized in that: The execution process of step 1 includes the following operations: Step 11: Perform data cleaning on the satellite network data, including detecting default values ​​and outliers, and processing missing values; Step 12: Encode the non-numerical features and convert them into numerical form using label encoding or one-hot encoding; Step 13: Perform minimum-maximum normalization on numerical features to eliminate the impact of feature scale differences on model training; Step 14: To address the data imbalance problem, synthetic minority oversampling technique (SMOTE) is used.

3. The satellite network data anomaly detection method based on CNN and RWav-KAN according to claim 1, characterized in that: In step 2, spatial features are extracted through convolutional layers, followed by batch normalization, ReLU activation, and max pooling to generate optimized feature representations for further processing by the RWav-KAN module. The calculation formula is as follows: X c =MaxPool1D(ReLU(BatchNorm(Conv(X)))) Among them, MaxPool represents the maximum pooling layer, ReLU represents the ReLU activation function, BatchNorm represents the batch normalization layer, and Conv represents the convolutional layer.

4. The satellite network data anomaly detection method based on CNN and RWav-KAN according to claim 1, characterized in that: In step 3, the (Wavelet Kolmogorov-Arnold Networks, Wav-KAN) is combined with the convolutional layer through residual connections to construct the RWav-KAN module. The calculation of RWav-KAN is as follows: f RWav-KAN (X c )=f wav-kan (ReLU(f wav-kan (X c )))+Conv(X c ) Among them, X c is the spatial feature extracted in step 2, f RWav-KAN (X) is the output of RWav-KAN, f wav-kan (x c ) is the output of the Wav-KAN module, Conv(X c ) is the output of the convolutional neural network.

5. The satellite network data anomaly detection method based on CNN and RWav-KAN according to claim 1, characterized in that: The step 4 includes: the output of RWav-KAN is first activated by the ReLU function to introduce nonlinearity so that the model can learn more complex feature combinations. Subsequently, these activated features are fused through the addition node to generate a comprehensive feature representation that combines high and low frequency information. The calculation formula is as follows: X sum =X1+X2 in, is the output of the first channel RWav-KAN, is the output of the second channel RWav-KAN, X sum It is the fusion result of dual channel output.

6. The satellite network data anomaly detection method based on CNN and RWav-KAN according to claim 1, characterized in that: In step 5, the Softmax function is used to normalize the features of the dual-channel fusion results to generate the probability distribution of the classification results. The Softmax formula is as follows: Where K is the total number of categories, is the output value corresponding to category i.

Images