Threat behavior detection method based on fuzzy enhanced polynomial neural network

Abstract

A threat behavior detection method based on a fuzzy enhanced polynomial neural network comprises the steps of combination of fuzzy C-means clustering and the polynomial neural network, design of an adaptive optimization mechanism, introduction of an entropy activation function, realization of dynamic edge weighting and fuzzy enhanced feature extraction. And a self-adaptive optimization algorithm for threat behavior detection is designed. According to the method, the efficient threat behavior detection model is constructed by designing the adaptive fuzzy enhanced polynomial neural network, precise recognition of complex threat modes in network traffic is realized, and the detection precision and efficiency are effectively improved. In addition, through generation of the fuzzy rule, visualization of the thinking process of the neural network is realized, and transparency and interpretability of the system are improved. Compared with a traditional method, the method has more advantages in the aspects of detection accuracy and adaptability, the recognition capability on a complex attack mode is improved, and the method is suitable for different network environments and is suitable for threat detection scenes in complex network traffic.

Description

Technical Field

[0001] The present invention relates to the field of network security, and particularly to a threat behavior detection method for a fuzzy enhanced polynomial neural network. Background Art

[0002] Network security and threat detection are two real factors that are generally overlooked in existing network traffic analysis research. There are few studies that deeply explore diverse threat behaviors in complex network traffic. However, the improvement of the accuracy and efficiency of threat behavior detection depends on the basis of classical machine learning algorithms and deep learning models. For example, classical clustering algorithms and neural network technologies have received extensive attention. In addition, fuzzy clustering technology has been successfully applied to the fields of pattern recognition and anomaly detection, which has laid a foundation for threat detection in network traffic. More importantly, the thinking process of a neural network is usually "black box" and difficult to explain. By generating fuzzy rules, the thinking process of the neural network can be visualized, increasing the transparency and interpretability of the system. In summary, it is urgently necessary to design a new method to solve the threat behavior detection problem in a complex network environment. At the same time, it is a practical solution to construct a threat detection model using fuzzy enhanced polynomial neural network technology and visualize the thinking process of the neural network through fuzzy rule generation. Summary of the Invention

[0003] The present invention provides a threat behavior detection method for a fuzzy enhanced polynomial neural network, and its purpose is to overcome the defects of existing threat behavior detection methods in dealing with complex attack patterns and improving detection transparency by introducing a fuzzy enhanced polynomial neural network.

[0004] The technical solution adopted by the present invention is as follows:

[0005] A threat behavior detection method based on a fuzzy enhanced polynomial neural network includes the following steps:

[0006] Step 1, data preprocessing and feature extraction. Preprocess the training data and test data, including reading data, converting data formats, feature extraction, and label encoding, to ensure data consistency and provide correct inputs for subsequent model training.

[0007] Step 2, fuzzy clustering and similarity calculation. Use the fuzzy C-means clustering (FCM) algorithm to perform fuzzy clustering on the data, thereby effectively dividing the data into multiple fuzzy categories. In this process, the cosine similarity method is usually used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, adjust the connection strength between each node through a dynamic weighting method to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity can have stronger connections;

[0008] Step 3: Adaptive Optimization and Model Configuration. Through the self-adaptive optimization algorithm (SSOA), important parameters in fuzzy clustering (such as the number of clusters c and the fuzzy exponent m) are dynamically adjusted, and then the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.) are optimized. This optimization algorithm can automatically select the most suitable parameters according to the characteristics of network traffic, thereby improving the adaptability and accuracy of the model. The optimization process dynamically adjusts the parameters by monitoring the fitness during the training process, enabling the model to automatically adjust according to different data characteristics and ensuring the maximization of the training effect;

[0009] Step 4: Feature Expansion and Neural Network Training. Based on the features obtained from the fuzzy clustering algorithm and polynomial feature expansion technology, a feature set with higher expressive power is constructed and used as the input to be passed into the neural network for training. By using the self-adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the learning ability of the model and enabling it to better handle complex threat patterns;

[0010] Step 5: Model Evaluation and Verification. After the training is completed, a comprehensive performance evaluation of the model is carried out, and various evaluation metrics are calculated, including accuracy, confusion matrix, classification report, etc. Through these metrics, the performance of the model in threat behavior detection is verified, and the results are compared with existing methods to demonstrate the advantages of the method of the present invention in terms of accuracy and efficiency. Finally, the trained model is saved and the actual application verification of the model is carried out to ensure that it can effectively identify and respond to complex network threat behaviors in the actual environment.

[0011] Step 1: Data Preprocessing and Feature Extraction. The training data and test data are preprocessed, including reading data, converting data formats, feature extraction, and label encoding, to ensure data consistency and provide correct inputs for subsequent model training. The specific steps are as follows:

[0012] Step 1.1: Load the existing dataset or generate a new dataset. First, check whether the saved training set and test set (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) exist. If they exist, directly load the existing dataset; if not, generate a new dataset by parsing the PCAP file;

[0013] Step 1.2: Obtain and parse the PCAP files. Use the glob function to get all PCAP files in the specified directory (. / data0), and parse each file in turn. Use the WSL tool to call the argus command to generate binary stream records, and use the ra command to extract feature data (such as source IP, destination IP, protocol, source port, destination port, number of packets, etc.);

[0014] Step 1.3: Data cleaning and label generation. Use the generate_labels function to generate labels based on the characteristics of each packet (such as protocol, source port, destination port, number of packets, number of bytes, etc.). According to the traffic characteristics, determine whether the traffic is an attack type (such as UDP Flood, ARP spoofing, etc.), and generate the corresponding attack labels (such as "UDP Flood Attack") together with normal traffic ("Normal"):

[0015]

[0016] Here, dpkts is the number of packets at the destination end, and proto is the protocol type. If the condition is met, the label is 1 (attack type), otherwise it is 0 (normal traffic). For other attack types (such as DNS Flood, ARP spoofing, etc.), a similar conditional judgment method can be adopted;

[0017] Step 1.4: Data merging and column processing. Append the parsing results of each file to a total DataFrame, remove unnecessary columns (such as SrcAddr and DstAddr) to avoid dealing with too many categorical values. In addition, delete rows containing null values and encode the protocol column (Proto) to process all non-numeric protocol types to ensure data consistency;

[0018] Step 1.5: Label encoding of categorical variables. Perform label encoding on the categorical variables in the dataset to convert non-numeric features (such as protocol type, source address, etc.) into numeric types for subsequent model use. Encode these categorical variables through LabelEncoder:

[0019] Encoded Value = LabelEncoder(X);

[0020] Step 1.6: Data scaling and resampling. Standardize the numeric features in the dataset, use MinMaxScaler for scaling to normalize all feature values between 0 and 1. Then, use ADASYN for resampling to ensure the balance of class distribution and prevent data imbalance from affecting model performance;

[0021]

[0022] Step 1.7: Divide the training set and the test set. Use the train_test_split function to divide the data into a training set (70%) and a test set (30%) to ensure that the model can be trained and verified. Finally, save the data sets (training set, test set) to local files (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) for subsequent loading and use:

[0023] Step 1.8: Feature extraction and standardization. Standardize the features through MinMaxScaler to ensure that each feature value of the data is on the same scale. This can avoid bias during model training due to different magnitudes of features and ensure that each feature contributes equally to the model.

[0024] Step 1.9: Label encoding and data division. Use LabelEncoder to perform label encoding on all non-numerical features and divide the data set into a training set and a test set through train_test_split. This operation ensures that the model can adapt to different traffic types and can effectively learn and evaluate during the training and test phases.

[0025] Step 2: Fuzzy clustering and similarity calculation. Use the Fuzzy C-Means (FCM) clustering algorithm to perform fuzzy clustering on the data, effectively dividing the data into multiple fuzzy categories. During this process, the cosine similarity method is usually used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, adjust the connection strength between each node through a dynamic weighting method to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity have stronger connections. The specific steps are as follows:

[0026] Step 2.1: Calculate the similarity matrix: First, calculate the similarity between data points. One of the commonly used similarity measurement methods is Cosine Similarity, and its formula is:

[0027]

[0028] where A and B are the feature vectors of two data points, ||A|| and ||B|| are their Euclidean norms (moduli), and A·B is the dot product of these two vectors. By calculating the cosine similarity between all data points, we can obtain a similarity matrix, and each element in the matrix represents the similarity between two data points;

[0029] Step 2.2, Dynamic Weighted Similarity Matrix: After obtaining the similarity matrix, the similarities are then dynamically weighted. The purpose of weighting is to strengthen the connections between data points with higher similarities and reduce the influence between points with lower similarities through a decay factor. The weighting formula is as follows:

[0030] Weight ij = Similarity ij × DecayFactor

[0031] where, Weight ij is the weighted similarity between data point i and data point j, Similarity ij is the original similarity value calculated through cosine similarity, and DecayFactor is a decay factor, usually taking values between 0 and 1 (e.g., 0.9). This weighting process makes the connections with high similarities more prominent while weakening those with low similarities, thereby improving the quality of clustering;

[0032] Step 2.3, Fuzzy C-Means Clustering (FCM): The data is clustered using the Fuzzy C-Means Clustering (FCM) algorithm. The goal of FCM is to optimize the membership matrix U and the cluster centers V by minimizing an objective function. The mathematical expression of the objective function is as follows:

[0033]

[0034] where:

[0035] u ij is the membership degree of data point x i to the cluster center v j , representing the degree of data point x i to cluster j, and the value ranges from 0 to 1.

[0036] m is the fuzzy index (usually taking values greater than 1), which controls the fuzziness of clustering. A larger m value makes the membership matrix U smoother, while a smaller m value makes the clustering more precise.

[0037] ||x i - v j || is the Euclidean distance between data point x i and the cluster center v j , representing the similarity degree between the data point and the cluster center.

[0038] C is the number of clusters, and N is the number of data points.

[0039] By continuously iterating and updating the membership matrix U and the cluster centers V until the objective function converges. In each iteration, the FCM algorithm updates the membership matrix to make the membership of data points more reasonably distributed among various clusters;

[0040] Step 2.4, Output the fuzzy clustering result: After clustering is completed, output the final membership matrix U and the cluster centers V. Each element u in the membership matrix U ij represents the membership of the data point x i to cluster j. The final cluster center V is the "average" feature of the data points in each cluster, which represents the central position of each cluster.

[0041] Step 3, Adaptive optimization and model configuration. Through the adaptive optimization algorithm (SSOA), dynamically adjust the important parameters in fuzzy clustering (such as the number of clusters c and the fuzzy exponent m), and then optimize the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.). This optimization algorithm can automatically select the most suitable parameters according to the characteristics of network traffic, thereby improving the adaptability and accuracy of the model. The optimization process dynamically adjusts the parameters by monitoring the fitness during the training process, enabling the model to automatically adjust according to different data characteristics to ensure the maximization of the training effect. The specific steps are as follows:

[0042] Step 3.1, Initial model parameter setting: First, it is necessary to set the initial model parameters. This includes the clustering parameters (such as the number of clusters c and the fuzzy exponent m) in the fuzzy C-means clustering algorithm (FCM), as well as the structural parameters of the neural network (such as the number of layers and the number of neurons in each layer). When setting initially, some common empirical values can be used, or these parameters can be selected through simple heuristic methods. For example, the fuzzy exponent m is usually set between 1.5 and 2.5. The number of clusters c can be initially set according to the characteristics of the data, and usually a reasonable value is selected through cross-validation;

[0043] Step 3.2, Use the adaptive optimization algorithm (SSOA) for dynamic adjustment: Dynamically adjust the key parameters of the model through the adaptive optimization algorithm (such as the adaptive particle swarm optimization algorithm, SSOA). This includes: the number of clusters c, the fuzzy exponent m, the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.) and the threshold (for binary classification tasks, such as the decision threshold for threat detection); The goal of the adaptive optimization algorithm is to minimize the loss function of the model and find the best configuration by automatically adjusting different hyperparameters. SSOA usually searches for the optimal solution by simulating the behavior of particle swarms in nature. The update rule of the particles can be expressed by the following formula:

[0044]

[0045] Denote the velocity of particle i in the k-th generation, Denote the position of particle i in the k-th generation, x id Denote the position of the particle on the i-th task, p best,i is the optimal position of particle i itself, gbest is the global optimal position, c1 and c2 are acceleration constants, r1 and r2 are random values in the range [0, 1], and w is the inertia weight, which is used to balance the exploration and exploitation capabilities of the particle;

[0046] Through iterative optimization, SSOA can adjust the model parameters to minimize the loss function, thereby obtaining the best model configuration;

[0047] Step 3.3, Fitness Function and Parameter Adjustment: In the adaptive optimization process, it is necessary to define a fitness function, which evaluates the performance of the model and determines the quality of the parameters. The fitness function is usually related to indicators such as the prediction accuracy, loss value, and F1 score of the model. In the present invention, the fitness function can be expressed as:

[0048]

[0049] where Loss is the loss function, such as cross-entropy loss, y pred is the predicted value of the model, y true is the true label. The optimization algorithm minimizes the loss by adjusting the model parameters, thereby improving the fitness. Fitness monitoring allows us to dynamically adjust the parameters in the particle swarm algorithm. For example, if the optimization process fails to converge in the initial stage, the exploration ability can be enhanced by increasing the inertia weight or adjusting the acceleration constants. In the later stage, reducing the inertia weight helps to accelerate the convergence of the algorithm;

[0050] Step 3.4, Output of Parameter Optimization Results: Through adaptive optimization, the optimal model parameters are finally obtained. At this time, the optimized number of clusters c, fuzzy exponent m, number of layers n of the neural network layers , number of neurons per layer n neurons and decision threshold (such as 0.5), etc., can all adapt to the requirements of specific datasets and tasks. These optimization results provide the best parameter configuration for subsequent model training and prediction.

[0051] Step 4, Feature Expansion and Neural Network Training. Based on the features obtained from the fuzzy clustering algorithm and polynomial feature expansion technology, construct a feature set with higher expressive ability and use it as the input to be passed into the neural network for training. By using the adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the learning ability of the model and enabling it to better handle complex threat patterns. The specific steps are as follows:

[0052] Step 4.1, Feature Expansion and Combination: At this stage, the features obtained from fuzzy clustering are combined with polynomial features to expand the feature space. Specifically, we perform polynomial expansion on the original features to increase the non-linear representation ability of the features. These polynomial features can be generated by the following formula:

[0053] X poly =[X 1 ,X 2 ,...,X n

[0054] where X is the original feature, X i is the i-th power of the original feature, and n is the highest power of the polynomial required. In this way, we transform the original feature set into a more complex feature space to improve the model's learning ability for complex patterns. Then, we concatenate the fuzzy clustering results with these expanded features to form a new feature set:

[0055] X extended =[X fuzzy ,X poly ;

[0056] Step 4.2, Generating Clustering Rules: Corresponding rules are generated through the fuzzy clustering results. Each rule is represented as a condition-result structure, specifically:

[0057] If x i ∈[a,b] for all i,then class y

[0058] where x i represents the feature, [a,b] represents the value range of the feature, and y is the target class (such as "potential attack" or "normal behavior").

[0059] Specifically, for each cluster, the conditions are generated by calculating the feature range (maximum and minimum values) of the data points. For the data points in the same cluster, they will have similar feature ranges, and rules are created through these feature ranges to indicate which combinations of feature values correspond to attacks or normal behaviors;

[0060] Step 4.3, Constructing the Neural Network Structure: At this stage, we construct a neural network model according to the optimized parameter configuration. The structure of the model includes an input layer, multiple hidden layers, and an output layer. Each hidden layer uses an adaptive activation function (such as EntropyAwareActivation), which selects the ReLU or Sigmoid activation method based on the entropy value of the input data. The structure of the neural network can be represented as:

[0061] Layer​k = f(Layer k-1 ·W k + b k )

[0062] where Layer k represents the output of the k-th layer, W k , b k represent the weight and bias of the k-th layer respectively, and f is the activation function.

[0063] During the training process, the Adam optimizer is used for backpropagation and weight update to minimize the loss function. Usually, the cross-entropy loss (for binary classification tasks) is used:

[0064]

[0065] where y i is the true label, is the predicted value, and N is the number of samples;

[0066] Step 4.4, Neural network training and optimization: In this stage, the neural network is trained with training data. During training, the Adam optimizer is adopted and an appropriate learning rate is set. Combining with the adaptive entropy activation function, multiple iterative trainings are carried out. Each training will optimize the model by calculating the loss function and updating the network weights until the model converges or reaches the set maximum number of iterations. In addition, a learning rate scheduler (such as StepLR) is used to gradually reduce the learning rate to further optimize the convergence speed and stability of the model.

[0067] Step 5, Model evaluation and verification. After training is completed, a comprehensive performance evaluation of the model is carried out, and various evaluation metrics are calculated, including accuracy, confusion matrix, classification report, etc. Through these metrics, the performance of the model in threat behavior detection is verified, and the results are compared with existing methods to demonstrate the advantages of the method of the present invention in terms of accuracy and efficiency. Finally, the trained model is saved, and the actual application verification of the model is carried out to ensure that it can effectively identify and respond to complex network threat behaviors in the actual environment. The specific steps are as follows:

[0068] Step 5.1, Evaluating the generated rules: In model evaluation, we not only evaluate the accuracy of the model, but also need to check the effect of the generated clustering rules. Each rule can correspond to a behavior pattern, such as "potential attack" or "normal behavior". The formula for generating rules is: If x i∈[a,b], then the behavior is y. For each cluster (such as 26 clusters), a rule will be generated, and the accuracy and reliability of the rule will be verified through the test set. It can be judged whether the generated rule is reasonable through the following conditions. If the generated rule does not meet the expectations, the system will make corrections and try to slightly adjust the rule range to obtain more diverse and accurate rules;

[0069] Step 5.2, Model evaluation metric calculation: After training is completed, use the test set to evaluate the model. The evaluation metrics usually include accuracy, confusion matrix, precision, recall, and F1-score, etc. The accuracy formula is:

[0070]

[0071] Among them, TP (True Positive) is the true positive, TN (True Negative) is the true negative, FP (False Positive) is the false positive, and FN (False Negative) is the false negative. In addition, the F1-score can also be used to comprehensively consider precision and recall:

[0072]

[0073] Among them, the calculation formulas for precision and recall are respectively:

[0074]

[0075] Step 5.2, To evaluate the advantages of the method of the present invention, we compare the performance of this model with other existing threat detection methods. Through the comparison, the advantages of the method of the present invention in terms of accuracy, efficiency, etc. can be demonstrated. For example, the gap in the detection accuracy of this model for different attack types can be compared with the existing methods, or the performance of the model when processing different traffic data can be compared.

[0076] Advantages and beneficial effects of the present invention

[0077] The present invention proposes a threat behavior detection method based on a fuzzy enhanced polynomial neural network. In view of the characteristics of network traffic detection problems, combined with the fuzzy enhanced polynomial neural network (AFEPNN) technology, a fuzzy polynomial neural network optimization algorithm is designed. This method comprehensively considers factors such as data traffic characteristics, clustering results, and model adaptive optimization, aiming to improve the accuracy and robustness of threat detection and effectively identify various types of attack behaviors. The present invention can adaptively adjust model parameters according to the characteristics of data and improve the interpretability of the system by generating easily interpretable clustering rules. This method is applicable to scenarios such as security monitoring, intrusion detection, and traffic analysis in complex network environments, can improve detection efficiency, and provides effective technical support for enhancing network security protection capabilities and reducing potential threats. Description of the Drawings

[0078] Figure 1 is a flow chart of a threat behavior detection method based on a fuzzy enhanced polynomial neural network of the present invention;

[0079] Figure 2 is a topology diagram of feature and rule generation in threat behavior detection. Detailed Embodiments

[0080] The present invention will be described in detail below with reference to the drawings and examples.

[0081] A threat behavior detection method based on a fuzzy enhanced polynomial neural network (the technical innovation points are shown in Table 1), according to the SSOA parameter optimization (the structure information is shown in Table 2), fuzzy clustering feature enhancement, and entropy-aware neural network technology, constructs a fuzzy enhanced polynomial neural network method to solve the problem of high-precision identification of threat behavior detection (the performance comparison is shown in Table 3). The specific implementation plan includes the following contents and steps:

[0082] Table 1 Algorithm Technical Innovation Points

[0083]

[0084] Table 2 SSOA Optimization Parameter Range and Performance Performance

[0085] Optimized parameter Parameter range Optimal value Parameter meaning Number of clusters c [8.99,11.32] 10.00 Number of classes in fuzzy clustering Fuzziness m [2.75,3.57] 2.75 Control the fuzziness of clustering Decision threshold [0.47,0.55] 0.50 Boundary threshold for classification decision Number of network layers [4,6] 4 Depth of neural network Number of neurons in each layer [39,94] 80 Width of neural network Training accuracy —— 97.58％ Performance of the model on the test set

[0086] Table 2 Algorithm Performance Comparison

[0087] Algorithm model Accuracy Precision Recall F1-score AFEPNN (this method) 0.9743 0.9739 0.9726 0.9732 FPNN 0.9121 0.9276 0.8990 0.9076 FPNN_PSO 0.9093 0.9259 0.8957 0.9045 FCM_Random Forest 0.9385 0.9451 0.9385 0.8383 Random Forest 0.8468 0.8586 0.8468 0.8456

[0088] Step 1: Data preprocessing and feature extraction. Preprocess the training data and test data, including reading data, converting data formats, feature extraction, and label encoding, to ensure data consistency and provide correct inputs for subsequent model training. The specific steps are as follows:

[0089] Step 1.1: Load the existing dataset or generate a new dataset. First, check whether the saved training set and test set (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) already exist. If they exist, directly load the existing dataset; if not, generate a new dataset by parsing the PCAP file;

[0090] Step 1.2: Obtain and parse the PCAP file. Use the glob function to obtain all PCAP files in the specified directory (. / data0), and parse each file in turn. Use the WSL tool to call the argus command to generate binary stream records, and use the ra command to extract feature data (such as source IP, destination IP, protocol, source port, destination port, number of packets, etc.);

[0091] Step 1.3: Data cleaning and label generation. Use the generate_labels function to generate labels based on the characteristics of each packet (such as protocol, source port, destination port, number of packets, number of bytes, etc.). According to the traffic characteristics, determine whether the traffic is an attack type (such as UDP Flood, ARP spoofing, etc.), and generate the corresponding attack labels (such as "UDP Flood Attack") together with normal traffic ("Normal"):

[0092]

[0093] Here, dpkts is the number of packets at the destination end, and proto is the protocol type. If the condition is met, the label is 1 (attack type); otherwise, it is 0 (normal traffic). For other attack types (such as DNS Flood, ARP spoofing, etc.), a similar conditional judgment method can be adopted.

[0094] Step 1.4: Data merging and column processing. Append the parsing results of each file to a total DataFrame, remove unnecessary columns (such as SrcAddr and DstAddr) to avoid dealing with too many categorical values. In addition, delete the rows containing null values, and encode the protocol column (Proto) to process all non-numeric protocol types to ensure data consistency;

[0095] Step 1.5: Label encoding of categorical variables. Perform label encoding on the categorical variables in the dataset to convert non-numeric features (such as protocol type, source address, etc.) into numeric types for subsequent model use. Encode these categorical variables through LabelEncoder:

[0096] Encoded Value=LabelEncoder(X)

[0097] Step 1.6, Data Scaling and Resampling: Standardize the numerical features in the dataset. Use MinMaxScaler for scaling to normalize all feature values between 0 and 1. Then, use ADASYN for resampling to ensure the balance of class distribution and prevent data imbalance from affecting the model performance;

[0098]

[0099] Step 1.7, Divide the training set and test set: Use the train_test_split function to divide the data into a training set (70%) and a test set (30%) to ensure that the model can be trained and verified. Finally, save the dataset (training set, test set) to local files (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) for subsequent loading and use:

[0100] Step 1.8, Feature Extraction and Standardization: Standardize the features through MinMaxScaler to ensure that each feature value of the data is on the same scale. This can avoid bias during model training due to different magnitudes of features and ensure that each feature contributes equally to the model.

[0101] Step 1.9, Label Encoding and Data Partitioning: Use LabelEncoder to perform label encoding on all non-numerical features and divide the dataset into a training set and a test set through train_test_split. This operation ensures that the model can adapt to different traffic types and can effectively learn and evaluate during the training and test phases.

[0102] Step 2: Fuzzy Clustering and Similarity Calculation. Use the Fuzzy C-Means (FCM) clustering algorithm to perform fuzzy clustering on the data, thus effectively dividing the data into multiple fuzzy classes. During this process, the cosine similarity method is usually used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, adjust the connection strength between each node through a dynamic weighting method to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity can have stronger connections. The specific steps are as follows:

[0103] Step 2.1, Calculate the similarity matrix: First, calculate the similarity between data points. One of the commonly used similarity measurement methods is Cosine Similarity, and its formula is:

[0104]

[0105] Among them, A and B are the feature vectors of two data points, ||A|| and ||B|| are their Euclidean norms (moduli) respectively, and A·B is the dot product of these two vectors. By calculating the cosine similarity between all data points, we can obtain a similarity matrix, and each element in the matrix represents the similarity between two data points;

[0106] Step 2.2, Dynamic weighted similarity matrix: After calculating the similarity matrix, the similarity is then dynamically weighted. The purpose of weighting is to enhance the connection between data points with higher similarity and reduce the influence between points with lower similarity through a decay factor. The weighting formula is:

[0107] Weight ij = Similarity ij × DecayFactor

[0108] Among them, Weight ij is the weighted similarity between data point i and data point j, Similarity ij is the original similarity value calculated through cosine similarity, and DecayFactor is a decay factor, usually taking values between 0 and 1 (such as 0.9). This weighting process makes the connections with high similarity more prominent while weakening the connections with low similarity, thus improving the quality of clustering.

[0109] Step 2.3, Fuzzy C-Means Clustering (FCM): Use the Fuzzy C-Means Clustering (FCM) algorithm to cluster the data. The goal of FCM is to optimize the membership matrix U and the cluster centers V by minimizing an objective function. The mathematical expression of the objective function is:

[0110]

[0111] Among them:

[0112] u ij is the membership degree of data point x i to the cluster center v j , representing the degree of data point x i to cluster j, and the value ranges from 0 to 1.

[0113] m is the fuzzy exponent (usually taking values greater than 1), which controls the fuzziness of clustering. A larger m value makes the membership matrix U smoother, and a smaller m value makes the clustering more precise.

[0114] ||x i - v j || is the distance between data point x i and the cluster center v jThe Euclidean distance between them represents the similarity degree between the data point and the cluster center.

[0115] C is the number of clusters, and N is the number of data points.

[0116] By continuously iteratively updating the membership matrix U and the cluster centers V until the objective function converges. In each iteration, the FCM algorithm updates the membership matrix to make the membership of data points more reasonably distributed among various clusters.

[0117] Step 2.4, Output the fuzzy clustering result: After clustering is completed, output the final membership matrix U and the cluster centers V. Each element u in the membership matrix U ij represents the membership of the data point x i to cluster j. The final cluster center V is the "average" feature of the data points in each cluster, which represents the central position of each cluster.

[0118] Step 3, Adaptive optimization and model configuration. Through the self-adaptive optimization algorithm (SSOA), dynamically adjust the important parameters in fuzzy clustering (such as the number of clusters c and the fuzzy exponent m), and then optimize the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.). This optimization algorithm can automatically select the most appropriate parameters according to the characteristics of network traffic, thereby improving the adaptability and accuracy of the model. The optimization process dynamically adjusts the parameters by monitoring the fitness during the training process, enabling the model to automatically adjust according to different data characteristics to ensure the maximization of the training effect. The specific steps are as follows:

[0119] Step 3.1, Set the initial model parameters: First, it is necessary to set the initial model parameters. This includes the clustering parameters (such as the number of clusters c and the fuzzy exponent m) in the fuzzy C-means clustering algorithm (FCM), as well as the structural parameters of the neural network (such as the number of layers and the number of neurons in each layer). When setting initially, some common empirical values can be used, or these parameters can be selected through simple heuristic methods. For example, the fuzzy exponent m is usually set between 1.5 and 2.5. The number of clusters c can be initially set according to the characteristics of the data, and usually a reasonable value is selected through cross-validation;

[0120] Step 3.2, Dynamic adjustment using the self-adaptive optimization algorithm (SSOA): Dynamically adjust the key parameters of the model through the self-adaptive optimization algorithm (e.g., the self-adaptive particle swarm optimization algorithm, SSOA). This includes: the number of clusters c, the fuzzy exponent m, the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.), and the threshold (for binary classification tasks, such as the decision threshold for threat detection); the goal of the self-adaptive optimization algorithm is to minimize the loss function of the model and find the optimal configuration by automatically adjusting different hyperparameters. SSOA usually searches for the optimal solution by simulating the behavior of particle swarms in nature. The update rule of the particle can be expressed by the following formula:

[0121]

[0122] represents the velocity of particle i in the k-th generation, represents the position of particle i in the k-th generation, x id represents the position of the particle on the i-th task, p best,i is the optimal position of particle i itself, gbest is the global optimal position, c1 and c2 are acceleration constants, r1 and r2 are random values in the range [0,1], and w is the inertia weight, which is used to balance the exploration and exploitation capabilities of the particle

[0123] Through iterative optimization, SSOA can adjust the model parameters to minimize the loss function, thereby obtaining the optimal model configuration;

[0124] Step 3.3, Fitness function and parameter adjustment: In the self-adaptive optimization process, it is necessary to define the fitness function, which evaluates the performance of the model and determines the quality of the parameters. The fitness function is usually related to indicators such as the prediction accuracy, loss value, and F1 score of the model. In the present invention, the fitness function can be expressed as:

[0125]

[0126] where Loss is the loss function, such as the cross-entropy loss, y pred is the predicted value of the model, and y true is the true label. The optimization algorithm adjusts the model parameters to minimize the loss, thereby improving the fitness. Fitness monitoring allows us to dynamically adjust the parameters in the particle swarm algorithm. For example, if the optimization process fails to converge in the initial stage, the exploration ability can be enhanced by increasing the inertia weight or adjusting the acceleration constants. In the later stage, reducing the inertia weight helps to accelerate the convergence of the algorithm.

[0127] Step 3.4, Output of Parameter Optimization Results: Through adaptive optimization, the optimal model parameters are finally obtained. At this time, the optimized number of clusters c, fuzzy exponent m, number of layers n of the neural network layers , number of neurons per layer n neurons and decision threshold (such as 0.5), etc., can all meet the requirements of specific datasets and tasks. These optimization results provide the best parameter configuration for subsequent model training and prediction.

[0128] Step 4, Feature Expansion and Neural Network Training. Based on the features obtained by the fuzzy clustering algorithm and polynomial feature expansion technology, a feature set with higher expressive ability is constructed and used as input to the neural network for training. By using the adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the learning ability of the model and enabling it to better handle complex threat patterns. The specific steps are as follows:

[0129] Step 4.1, Feature Expansion and Combination: At this stage, the features obtained by fuzzy clustering are combined with polynomial features to expand the feature space. Specifically, we perform polynomial expansion on the original features to increase the non-linear representation ability of the features. These polynomial features can be generated by the following formula:

[0130] X poly =[X 1 ,X 2 ,...,X n

[0131] where X is the original feature, X i is the i-th power of the original feature, and n is the highest power of the polynomial required. In this way, we transform the original feature set into a more complex feature space to improve the model's learning ability for complex patterns. Then, we splice the fuzzy clustering results with these expanded features to form a new feature set:

[0132] X extended =[X fuzzy ,X poly

[0133] Step 4.2, Generate Clustering Rules: Generate corresponding rules through the fuzzy clustering results. Each rule is expressed as a condition-result structure, specifically:

[0134] If x i ∈[a,b] for all i, then class y

[0135] where x i ​​A feature is represented, [a, b] represents the value range of the feature, and y is the target class (such as "potential attack" or "normal behavior").

[0136] Specifically, for each cluster, conditions are generated by calculating the feature range (maximum and minimum values) of the data points. For the data points in the same cluster, they will have similar feature ranges, and rules are created through these feature ranges to indicate which combinations of feature values correspond to attacks or normal behaviors.

[0137] Step 4.3, Neural network structure construction: In this stage, we construct a neural network model according to the optimized parameter configuration. The structure of the model includes an input layer, multiple hidden layers, and an output layer. Each hidden layer uses an adaptive activation function (such as EntropyAwareActivation), and this activation function selects the ReLU or Sigmoid activation method based on the entropy value of the input data. The structure of the neural network can be expressed as:

[0138] Layer k = f(Layer k-1 ·W k + b k )

[0139] where Layer k represents the output of the k-th layer, W k , b k represent the weight and bias of the k-th layer respectively, and f is the activation function.

[0140] During the training process, the Adam optimizer is used for backpropagation and weight update to minimize the loss function, and usually the cross-entropy loss (for binary classification tasks) is used:

[0141]

[0142] where, y i is the true label, is the predicted value, and N is the number of samples.

[0143] Step 4.4, Neural network training and optimization: In this stage, the neural network is trained with the training data. During training, the Adam optimizer is adopted and an appropriate learning rate is set, combined with the adaptive entropy activation function, and multiple iterative trainings are carried out. Each training will optimize the model by calculating the loss function and updating the network weights until the model converges or reaches the set maximum number of iterations. In addition, a learning rate scheduler (such as StepLR) is used to gradually reduce the learning rate to further optimize the convergence speed and stability of the model.

[0144] Step 5: Model Evaluation and Validation. After training is completed, conduct a comprehensive performance evaluation of the model, calculate various evaluation metrics, including accuracy, confusion matrix, and classification report, etc. Through these metrics, verify the performance of the model in threat behavior detection, and compare the results with existing methods to demonstrate the advantages of the method of the present invention in terms of accuracy and efficiency. Finally, save the trained model and conduct practical application verification of the model to ensure that it can effectively identify and respond to complex network threat behaviors in the actual environment. The specific steps are as follows:

[0145] Step 5.1: Evaluate the Generated Rules. In model evaluation, we not only evaluate the accuracy of the model but also need to check the effectiveness of the generated clustering rules. Each rule can correspond to a behavior pattern, such as "potential attack" or "normal behavior". The formula for generating rules is: If x i ∈[a, b], then behavior is y. For each cluster (such as 26 clusters), a rule will be generated, and the accuracy and reliability of the rule will be verified through the test set. It can be judged whether the generated rule is reasonable through the following conditions. If the generated rule does not meet the expectations, the system will make corrections and try to slightly adjust the rule range to obtain more diverse and accurate rules.

[0146] Step 5.2: Calculate Model Evaluation Metrics. After training is completed, use the test set to evaluate the model. The evaluation metrics usually include accuracy, confusion matrix, precision, recall, and F1-score, etc. The formula for accuracy is:

[0147]

[0148] where TP (True Positive) is the true positive, TN (True Negative) is the true negative, FP (False Positive) is the false positive, and FN (False Negative) is the false negative. In addition, the F1-score can also be used to comprehensively consider precision and recall:

[0149]

[0150] where the calculation formulas for precision and recall are respectively:

[0151]

[0152] Step 5.2: To evaluate the advantages of the method of the present invention, we compare the performance of this model with other existing threat detection methods. Through the comparison, the advantages of the method of the present invention in terms of accuracy, efficiency, etc. can be demonstrated. For example, the gap in the detection accuracy of this model for different attack types can be compared with that of the existing methods, or the performance of the model when processing different traffic data can be compared.

Claims

1. A threat behavior detection method based on a fuzzy enhanced polynomial neural network, comprising the following steps: Step 1, data preprocessing and feature extraction. Preprocess the training data and test data, including reading data, converting data formats, feature extraction, and label encoding, to ensure data consistency and provide correct inputs for subsequent model training; Step 2, fuzzy clustering and similarity calculation. Use the fuzzy C-means clustering (FCM) algorithm to perform fuzzy clustering on the data, thereby effectively dividing the data into multiple fuzzy categories. In this process, the cosine similarity method is usually used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, adjust the connection strength between each node through a dynamic weighting method to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity can have stronger connections; Step 3, adaptive optimization and model configuration. Through the self-adaptive optimization algorithm (SSOA), dynamically adjust important parameters in fuzzy clustering (such as the number of clusters c and the fuzzy exponent m), and then optimize the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.). This optimization algorithm can automatically select the most suitable parameters according to the characteristics of network traffic, thereby improving the adaptability and accuracy of the model. The optimization process dynamically adjusts the parameters by monitoring the fitness during the training process, enabling the model to automatically adjust according to different data characteristics and ensuring the maximization of the training effect; Step 4, feature expansion and neural network training. Based on the features obtained from the fuzzy clustering algorithm and the polynomial feature expansion technology, construct a feature set with higher expressive power and use it as input to the neural network for training. By using the adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the learning ability of the model and enabling it to better handle complex threat patterns; Step 5, model evaluation and verification. After training is completed, comprehensively evaluate the performance of the model, calculate various evaluation indicators, including accuracy, confusion matrix, and classification report, etc. Through these indicators, verify the performance of the model in threat behavior detection, compare the results with existing methods, and demonstrate the advantages of the method of the present invention in terms of accuracy and efficiency. Finally, save the trained model and conduct practical application verification of the model to ensure that it can effectively identify and respond to complex network threat behaviors in the actual environment; 2. The threat behavior detection method based on a fuzzy enhanced polynomial neural network according to claim 1, characterized in that: For the data preprocessing and feature extraction described in Step 1, preprocess the training data and test data, including reading data, converting data formats, feature extraction, and label encoding, to ensure data consistency and provide correct inputs for subsequent model training. The specific steps are as follows: Step 1.1: Load the existing dataset or generate a new one. First, check if there are already saved training and test sets (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl). If they exist, directly load the existing dataset; if not, generate a new dataset by parsing the PCAP files. Step 1.2: Obtain and parse the PCAP files. Use the glob function to get all PCAP files in the specified directory (. / data0), and parse each file in turn. Use the WSL tool to call the argus command to generate binary stream records, and use the ra command to extract feature data (such as source IP, destination IP, protocol, source port, destination port, number of packets, etc.). Step 1.3: Data cleaning and label generation. Use the generate_labels function to generate labels based on the characteristics of each packet (such as protocol, source port, destination port, number of packets, number of bytes, etc.). According to the traffic characteristics, determine whether the traffic is an attack type (such as UDP Flood, ARP spoofing, etc.), and generate the corresponding attack labels (such as "UDP Flood Attack") together with normal traffic ("Normal"). Here, dpkts is the number of packets at the destination end, and proto is the protocol type. If the condition is met, the label is 1 (attack type); otherwise, it is 0 (normal traffic). For other attack types (such as DNS Flood, ARP spoofing, etc.), a similar conditional judgment method can be adopted. Step 1.4: Data merging and column processing. Append the parsing results of each file to a total DataFrame, and remove unnecessary columns (such as SrcAddr and DstAddr) to avoid dealing with too many categorical values. In addition, delete the rows containing null values, and encode the protocol column (Proto) to handle all non-numeric protocol types to ensure data consistency. Step 1.5: Label encoding of categorical variables. Perform label encoding on the categorical variables in the dataset to convert non-numeric features (such as protocol type, source address, etc.) into numeric types for subsequent model use. Encode these categorical variables through LabelEncoder. Encoded Value = LabelEncoder(X); Step 1.6: Data scaling and resampling. Standardize the numeric features in the dataset, scale them using MinMaxScaler so that all feature values are normalized between 0 and 1. Then, use ADASYN for resampling to ensure the balance of the class distribution and prevent data imbalance from affecting the model performance. Step 1.7: Divide the training set and the test set. Use the train_test_split function to divide the data into a training set (70%) and a test set (30%) to ensure that the model can be trained and validated. Finally, save the data sets (training set, test set) to local files (X_train.pkl, X_test.pkl, y_train.pkl, y_test.pkl) for subsequent loading and use; Step 1.8: Feature extraction and standardization. Standardize the features through MinMaxScaler to ensure that each feature value of the data is on the same scale. This can avoid biases during model training due to different magnitudes of features and ensure that each feature contributes equally to the model; Step 1.9: Label encoding and data division. Use LabelEncoder to perform label encoding on all non-numerical features and divide the data set into a training set and a test set through train_test_split. This operation ensures that the model can adapt to different traffic types and can effectively learn and evaluate during the training and test phases.

3. The threat behavior detection method based on a fuzzy enhanced polynomial neural network according to claim 1, wherein: Step 2 introduces fuzzy clustering and similarity calculation. Use the fuzzy C-means clustering (FCM) algorithm to perform fuzzy clustering on the data, thereby effectively dividing the data into multiple fuzzy categories. During this process, the cosine similarity method is usually used to obtain a similarity matrix to calculate the similarity between data points. Subsequently, based on the calculated similarity matrix, adjust the connection strength between each node through a dynamic weighting method to further improve the accuracy and robustness of clustering, ensuring that nodes with higher similarity can have stronger connections. The specific steps are as follows: Step 2.1: Calculate the similarity matrix: First, calculate the similarity between data points. One of the commonly used similarity measurement methods is cosine similarity, and its formula is: where A and B are the feature vectors of two data points, ||A|| and ||B|| are their Euclidean norms (moduli), and A·B is the dot product of these two vectors. By calculating the cosine similarity between all data points, we can obtain a similarity matrix, and each element in the matrix represents the similarity between two data points; Step 2.2: Dynamically weighted similarity matrix: After calculating the similarity matrix, next perform dynamic weighting on the similarity. The purpose of weighting is to enhance the connection between data points with higher similarity and reduce the influence between points with lower similarity through a decay factor. The weighting formula is: Weight ij = Similarity ij × DecayFactor Among them, Weight ij is the weighted similarity between data point i and data point j, and Similarity ij is the original similarity value calculated by cosine similarity. The DecayFactor is a decay factor, usually taking values between 0 and 1 (for example, 0.9). This weighting process makes the connections with high similarity more prominent, while the connections with low similarity are weakened, thus improving the quality of clustering; Step 2.3: Fuzzy C-means clustering (FCM): Use the fuzzy C-means clustering (FCM) algorithm to cluster the data. The goal of FCM is to optimize the membership matrix U and the cluster centers V by minimizing an objective function. The mathematical expression of the objective function is: where: u ij is the data point x i to the cluster center v j membership degree, indicating the data point x i to the degree of cluster j, with values between 0 and 1. m is the fuzzy exponent (usually taking a value greater than 1), which controls the degree of fuzziness of clustering. A larger m value makes the membership matrix U smoother, and a smaller m value makes the clustering more precise. ||x i -v j || is the data point x i to the cluster center v j The Euclidean distance between them represents the similarity between the data point and the cluster center. C is the number of clusters, and N is the number of data points. By continuously iterating and updating the membership matrix U and the cluster centers V until the objective function converges. In each iteration, the FCM algorithm updates the membership matrix to make the membership of data points more reasonably distributed among different clusters; Step 2.4, Output the fuzzy clustering results: After clustering is completed, output the final membership matrix U and the cluster centers V. Each element u in the membership matrix U ij represents the membership degree of the data point x i to cluster j. The final cluster center V is the "average" feature of the data points in each cluster, which represents the central position of each cluster.

4. The threat behavior detection method based on a fuzzy enhanced polynomial neural network according to claim 1, characterized in that: Step 3 is adaptive optimization and model configuration. Through the adaptive optimization algorithm (SSOA), important parameters in fuzzy clustering (such as the number of clusters c and the fuzzy exponent m) are dynamically adjusted, and then the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.) are optimized. This optimization algorithm can automatically select the most suitable parameters according to the characteristics of network traffic, thereby improving the adaptability and accuracy of the model. The optimization process dynamically adjusts the parameters by monitoring the fitness during the training process, enabling the model to automatically adjust according to different data characteristics to ensure the maximization of the training effect. The specific steps are as follows: Step 3.1, Initial model parameter setting: First, it is necessary to set the initial model parameters. This includes the clustering parameters (such as the number of clusters c and the fuzzy exponent m) in the fuzzy C-means clustering algorithm (FCM), as well as the structural parameters of the neural network (such as the number of layers and the number of neurons in each layer). When making the initial setting, some common empirical values can be used, or these parameters can be selected through simple heuristic methods. For example, the fuzzy exponent m is usually set between 1.5 and 2.

5. The number of clusters c can be initially set according to the characteristics of the data, and usually, a reasonable value is selected through cross-validation; Step 3.2, Dynamic adjustment using the adaptive optimization algorithm (SSOA): The key parameters of the model are dynamically adjusted through the adaptive optimization algorithm (such as the self-adaptive particle swarm optimization algorithm, SSOA). This includes: the number of clusters c, the fuzzy exponent m, the structural parameters of the neural network (such as the number of network layers, the number of neurons in each layer, etc.), and the threshold (used for binary classification tasks, such as the decision threshold for threat detection); The goal of the adaptive optimization algorithm is to minimize the loss function of the model and find the best configuration by automatically adjusting different hyperparameters. SSOA usually searches for the optimal solution by simulating the behavior of particle swarms in nature. The update rule of particles can be expressed by the following formula: represents the velocity of particle i in the k-th generation, represents the position of particle i in the k-th generation, x id represents the position of the particle on the i-th task, p best,i is the optimal position of particle i itself, gbest is the global optimal position, c1 and c2 are acceleration constants, r1 and r2 are random values in the range [0, 1], and w is the inertia weight, which is used to balance the exploration and exploitation capabilities of the particle Through iterative optimization, SSOA can adjust the model parameters to minimize the loss function, thereby obtaining the best model configuration; Step 3.3, Fitness function and parameter adjustment: During the adaptive optimization process, it is necessary to define the fitness function, which evaluates the performance of the model and determines the quality of the parameters. The fitness function is usually related to indicators such as the prediction accuracy, loss value, and F1 score of the model. In the present invention, the fitness function can be expressed as: Among them, Loss is the loss function, such as cross-entropy loss, y pred is the predicted value of the model, y true is the true label. The optimization algorithm minimizes the loss by adjusting the model parameters, thereby improving the fitness. Fitness monitoring allows us to dynamically adjust the parameters in the particle swarm algorithm. For example, if the optimization process fails to converge in the initial stage, the exploration ability can be enhanced by increasing the inertia weight or adjusting the acceleration constants. In the later stage, reducing the inertia weight helps to accelerate the convergence of the algorithm; Step 3.4, Output of Parameter Optimization Results: Through adaptive optimization, the optimal model parameters are finally obtained. At this time, the optimized number of clusters c, fuzzy index m, number of layers n of the neural network layers , number of neurons per layer n neurons and decision threshold (such as 0.5), etc., can all meet the requirements of a specific dataset and task. These optimization results provide the best parameter configuration for subsequent model training and prediction.

5. The threat behavior detection method based on a fuzzy enhanced polynomial neural network according to claim 1, characterized in that: Step 4 Feature Expansion and Neural Network Training. Based on the features obtained from the fuzzy clustering algorithm and the polynomial feature expansion technique, a feature set with higher expressive power is constructed and passed as input to the neural network for training. By using the adaptive entropy activation function, the network can select a suitable activation function (such as ReLU or Sigmoid) according to the complexity of the input data, thereby improving the learning ability of the model and enabling it to better handle complex threat patterns. The specific steps are as follows: Step 4.1 Feature Expansion and Combination: At this stage, the features obtained from fuzzy clustering are combined with polynomial features to expand the feature space. Specifically, we perform polynomial expansion on the original features to increase the non-linear representation ability of the features. These polynomial features can be generated by the following formula: X poly = [X 1 , X 2 ,..., X n ​ where X is the original feature, and X i is the i-th power of the original feature, and n is the highest power of the required polynomial. In this way, we transform the original feature set into a more complex feature space to improve the model's learning ability for complex patterns. Then, we concatenate the fuzzy clustering results with these extended features to form a new feature set: X extended = [X fuzzy , X poly ; Step 4.2 Generating Clustering Rules: Corresponding rules are generated through the fuzzy clustering results. Each rule is represented as a condition-result structure, specifically: If x i ∈[a,b] for all i, then class y Among them, x i represents a feature, [a, b] represents the value range of the feature, and y is the target category (such as "potential attack" or "normal behavior"). Specifically, for each cluster, the condition is generated by calculating the feature range (maximum and minimum values) of the data points. For the data points in the same cluster, they will have similar feature ranges, and rules are created through these feature ranges to indicate which combinations of feature values correspond to attacks or normal behaviors; Step 4.3 Neural Network Structure Construction: At this stage, according to the optimized parameter configuration, we construct a neural network model. The structure of the model includes an input layer, multiple hidden layers, and an output layer. Each hidden layer uses an adaptive activation function (such as EntropyAwareActivation), which selects the ReLU or Sigmoid activation method based on the entropy value of the input data. The structure of the neural network can be represented as: Layer k = f(Layer k-1 · W k + b k ) Among them, Layer k represents the output of the k-th layer, W k , b k represent the weight and bias of the k-th layer respectively, and f is the activation function. During the training process, the Adam optimizer is used for backpropagation and weight update to minimize the loss function, usually using cross-entropy loss (for binary classification tasks): Among them, y i is the true label, is the predicted value, and N is the number of samples; Step 4.4 Neural Network Training and Optimization: At this stage, the neural network is trained with the training data. During training, the Adam optimizer is adopted and an appropriate learning rate is set, combined with the adaptive entropy activation function, for multiple iterative trainings. Each training optimizes the model by calculating the loss function and updating the network weights until the model converges or reaches the set maximum number of iterations. In addition, a learning rate scheduler (such as StepLR) is used to gradually reduce the learning rate to further optimize the convergence speed and stability of the model.

6. The threat behavior detection method based on a fuzzy enhanced polynomial neural network according to claim 1, wherein: Step 5 Model Evaluation and Validation. After training is completed, a comprehensive performance evaluation of the model is carried out, and various evaluation metrics are calculated, including accuracy, confusion matrix, and classification report, etc. Through these metrics, the performance of the model in threat behavior detection is verified, and the results are compared with existing methods to demonstrate the advantages of the method of the present invention in terms of accuracy and efficiency. Finally, the trained model is saved, and the actual application of the model is verified to ensure that it can effectively identify and respond to complex network threat behaviors in the actual environment. The specific steps are as follows Step 5.1, Evaluate the generated rules: In model evaluation, we not only evaluate the accuracy of the model, but also need to check the effectiveness of the generated clustering rules. Each rule can correspond to a behavior pattern, such as "potential attack" or "normal behavior". The formula for generating rules is: If x i ∈[a,b], then behavior is y. For each cluster (such as 26 clusters), a rule will be generated and the accuracy and reliability of the rule will be verified through the test set. The reasonableness of the generated rules can be judged by the following conditions. If the generated rules do not meet the expectations, the system will make corrections and try to slightly adjust the rule scope to obtain more diverse and accurate rules; Step 5.2, Calculation of model evaluation metrics: After training is completed, use the test set to evaluate the model. Evaluation metrics usually include accuracy, confusion matrix, precision, recall, and F1 score, etc. The formula for accuracy is: Among them, TP (True Positive) is the true positive, TN (True Negative) is the true negative, FP (False Positive) is the false positive, and FN (False Negative) is the false negative. In addition, the F1 score can also be used to comprehensively consider precision and recall: Among them, the calculation formulas for precision and recall are respectively: Step 5.2, To evaluate the advantages of the method of the present invention, we compare the performance of this model with other existing threat detection methods. Through the comparison, the advantages of the method of the present invention in terms of accuracy, efficiency, etc. can be demonstrated. For example, the gap in the detection accuracy of different attack types between this model and existing methods can be compared, or the performance of the model when processing different traffic data can be compared.

Images