Ship network layered intrusion detection method and system

Abstract

The invention provides a ship network hierarchical intrusion detection method and system, and the method comprises the steps: obtaining multi-dimensional flow data from a plurality of hierarchies of a ship network, carrying out the preprocessing of the data, carrying out the feature extraction of the preprocessed flow data through a deep neural network model, obtaining the feature vector of the multi-dimensional flow data, and carrying out the detection of the multi-dimensional flow data. Then, establishing an anomaly detection model based on a random forest algorithm, inputting the feature vector into the anomaly detection model to obtain an anomaly score of the traffic data, and comparing the anomaly score with a preset score threshold to judge a confidence traffic and a question traffic; and finally, establishing an abnormal traffic classification model based on the bidirectional gating recurrent neural network and the convolutional neural network, inputting the doubt traffic into the abnormal traffic classification model to respectively obtain probabilities of the doubt traffic belonging to different known attack types, and respectively comparing the probabilities with a preset threshold. And then judging the attack type and whether the attack is a zero-day attack, and executing a corresponding defense strategy to complete hierarchical intrusion detection of the ship network.

Description

Technical Field

[0001] The present invention relates to the technical field of ship network detection, and particularly relates to a ship network hierarchical intrusion detection method and system. Background Art

[0002] A ship network refers to a network composed of various information systems and communication devices on a ship, including ship navigation, control, monitoring, management and other systems. The ship network is an important guarantee for ship safety and efficiency, and also an important way for the ship to communicate with the outside world. With the continuous development and complexity of the ship network, the ship network is also facing more and more network security threats, such as hacker attacks, malware, data leakage, etc. These threats may lead to serious consequences such as the paralysis of the ship network, the loss or tampering of data, the out-of-control or collision of the ship, etc.

[0003] Network intrusion detection is one of the important means of network security. It refers to the process of monitoring the data traffic in the network, analyzing whether there are abnormal or malicious behaviors, and thus timely discovering and defending against network attacks. Network intrusion detection can be divided into two types: anomaly-based intrusion detection and signature-based intrusion detection. Anomaly-based intrusion detection refers to establishing a model of normal network behavior and performing anomaly detection on the behaviors in the network to find behaviors that do not conform to the normal model. Signature-based intrusion detection refers to pre-defining the characteristics or rules of network attacks and matching the behaviors in the network to find behaviors that conform to the known attack characteristics or rules. Deep learning is a machine learning method based on multi-layer neural networks. It can perform automatic feature extraction and classification through a large amount of data, and has powerful learning and adaptation capabilities. Deep learning has made breakthrough progress in fields such as image recognition, speech recognition, and natural language processing, and has gradually been applied to the field of network security, such as malware detection, network traffic analysis, etc.

[0004] The current network intrusion detection methods still have some problems and limitations, which are mainly manifested in the following aspects: 1. Anomaly-based intrusion detection methods need to establish a model of normal network behavior. However, due to the complexity and variability of network behaviors, it is difficult to establish an accurate and perfect model, and false alarms or missed detections are likely to occur. 2. Signature-based intrusion detection methods need to pre-define the characteristics or rules of network attacks. However, due to the diversity and variability of network attacks, it is difficult to cover all attack types, especially for unknown or zero-day attacks, and signature-based methods cannot effectively detect them. 3. Traditional network intrusion detection methods usually only consider the data at a single level or single dimension in the network, such as network packet headers, network traffic, etc., and ignore other levels or dimensions of data in the network, such as network protocols, network applications, etc. These data may contain more information about network behaviors and help improve the effect of network intrusion detection.

[0005] Therefore, in view of the characteristics of ship networks and the deficiencies of existing network intrusion detection methods, there is an urgent need for a hierarchical intrusion detection model for ship networks based on deep learning that can detect zero-day attacks. Summary of the Invention

[0006] To solve the problems existing in the current network intrusion detection process, such as easy generation of false positives or false negatives, inability to effectively detect zero-day attacks or unknown data, and neglect of data in other layers or dimensions of the network, the present invention provides a hierarchical intrusion detection method for ship networks. By utilizing the powerful feature extraction ability of the deep neural network model, combining multi-level and multi-dimensional data of ship networks, and based on the random forest algorithm, bidirectional gated recurrent neural network, and convolutional neural network, an anomaly detection model and an anomaly traffic classification model are constructed. With its powerful classification ability, a hierarchical network intrusion detection framework is built, which can effectively detect various types of network attacks, including unknown and zero-day attacks, and effectively improve the accuracy and robustness of network intrusion detection. The present invention also relates to a hierarchical intrusion detection system for ship networks.

[0007] The technical solution of the present invention is as follows:

[0008] A hierarchical intrusion detection method for ship networks, characterized by comprising the following steps:

[0009] Multi-dimensional traffic data collection and preprocessing step: Collect multi-dimensional traffic data from multiple layers of the ship network. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocess the multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for the deep neural network.

[0010] Feature extraction step: Use the deep neural network model to extract features from the preprocessed multi-dimensional traffic data to obtain the feature vectors of the multi-dimensional traffic data.

[0011] Anomaly detection model establishment and suspicious traffic judgment step: Establish an anomaly detection model based on the random forest algorithm, input the feature vectors into the anomaly detection model to obtain the anomaly scores of the multi-dimensional traffic data, compare the anomaly scores with a preset first score threshold, mark the multi-dimensional traffic data with anomaly scores less than or equal to the preset first score threshold as confident traffic, which is used as normal traffic for transmission; mark the multi-dimensional traffic data with anomaly scores greater than the preset first score threshold as suspicious traffic and transfer it to the anomaly traffic classification model establishment and attack type detection step for processing.

[0012] Steps for establishing an abnormal traffic classification model and detecting attack types: An abnormal traffic classification model is established based on a bidirectional gated recurrent neural network and a convolutional neural network. A suspicious traffic flow is input into the abnormal traffic classification model to obtain the probabilities that the suspicious traffic flow belongs to different known attack types respectively. Then, the maximum probability among all the probabilities is compared with a preset probability threshold to determine whether the suspicious traffic flow belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspicious traffic flow does not belong to any known attack type and is marked as unknown traffic. Then, the abnormal score of the unknown traffic is compared with a preset second score threshold, and the preset second score threshold is greater than the preset first score threshold. If the abnormal score of the unknown traffic is less than or equal to the preset second score threshold, the unknown traffic is marked as confident traffic; if the abnormal score of the unknown traffic is greater than the preset second score threshold, the unknown traffic is marked as a zero-day attack.

[0013] If the maximum probability is greater than the preset probability threshold, the suspicious traffic flow belongs to the known attack type corresponding to the maximum probability, and then the corresponding defense strategy is executed, and the execution situation of the defense strategy is recorded to complete the hierarchical intrusion detection of the ship network.

[0014] Preferably, in the steps of establishing the anomaly detection model and judging the suspicious traffic flow, the random forest algorithm consists of multiple decision trees. Each decision tree randomly extracts a part of features and samples from the feature vectors of multi-dimensional traffic data for training to obtain new data, and then votes on the new data to output the abnormal score of the multi-dimensional traffic data.

[0015] Preferably, in the steps of establishing the abnormal traffic classification model and detecting attack types, the bidirectional gated recurrent neural network consists of GRU units in the forward and reverse directions. Each GRU unit includes a reset gate, an update gate, and an output gate. The reset gate is used to control the retention of historical information, the update gate is used to control the update of current information, and the output gate is used to output the hidden state. The bidirectional gated recurrent neural network classifies the suspicious traffic flow by using the information of the GRU units in the forward and reverse directions and outputs the probabilities that the suspicious traffic flow belongs to different attack types.

[0016] Preferably, in the feature extraction step, using a deep neural network model to extract features from the preprocessed multi-dimensional traffic data includes: using a one-dimensional convolutional neural network or an autoencoder to extract the temporal features and statistical features of the preprocessed multi-dimensional traffic data to obtain a one-dimensional feature vector of the multi-dimensional traffic data.

[0017] Preferably, in the multi-dimensional traffic data collection and preprocessing step, the preprocessing includes data cleaning, format conversion, feature selection, numerical feature processing, and data dimensionality reduction. The data cleaning includes removing irrelevant features and filling missing values. The format conversion includes data encoding. The numerical feature processing includes normalizing numerical features and standardizing numerical features;

[0018] In the step of establishing the abnormal traffic classification model and detecting the attack type, the executed defense strategies include interception, isolation, and alarm.

[0019] A ship network hierarchical intrusion detection system, characterized by comprising a multi-dimensional traffic data collection and preprocessing module, a feature extraction module, an abnormal detection model establishment and suspicious traffic judgment module, and an abnormal traffic classification model establishment and attack type detection module that are connected in sequence,

[0020] The multi-dimensional traffic data collection and preprocessing module collects multi-dimensional traffic data from multiple levels of the ship network. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocesses the multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for a deep neural network;

[0021] The feature extraction module uses a deep neural network model to extract features from the preprocessed multi-dimensional traffic data to obtain a feature vector of the multi-dimensional traffic data;

[0022] The abnormal detection model establishment and suspicious traffic judgment module establishes an abnormal detection model based on the random forest algorithm, inputs the feature vector into the abnormal detection model to obtain an abnormal score of the multi-dimensional traffic data, compares the abnormal score with a preset first score threshold, and marks the multi-dimensional traffic data with an abnormal score less than or equal to the preset first score threshold as confident traffic, which is used as normal traffic for transmission; marks the multi-dimensional traffic data with an abnormal score greater than the preset first score threshold as suspicious traffic and transfers it to the step of establishing the abnormal traffic classification model and detecting the attack type for processing;

[0023] The abnormal traffic classification model establishment and attack type detection module establishes an abnormal traffic classification model based on a bidirectional gated recurrent neural network and a convolutional neural network, and inputs a suspected traffic flow into the abnormal traffic classification model to obtain the probabilities that the suspected traffic flow belongs to different known attack types respectively. Then, the maximum probability among all the probabilities is compared with a preset probability threshold to determine whether the suspected traffic flow belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspected traffic flow does not belong to any known attack type and is marked as unknown traffic. Then, the abnormal score of the unknown traffic is compared with a preset second score threshold, and the preset second score threshold is greater than the preset first score threshold. If the abnormal score of the unknown traffic is less than or equal to the preset second score threshold, the unknown traffic is marked as confident traffic; if the abnormal score of the unknown traffic is greater than the preset second score threshold, the unknown traffic is marked as a zero-day attack.

[0024] If the maximum probability is greater than the preset probability threshold, the suspected traffic flow belongs to the known attack type corresponding to the maximum probability, and then the corresponding defense strategy is executed, and the execution situation of the defense strategy is recorded to complete the hierarchical intrusion detection of the ship network.

[0025] Preferably, in the abnormal detection model establishment and suspected traffic flow judgment module, the random forest algorithm is composed of multiple decision trees. Each decision tree randomly extracts a part of features and samples from the feature vectors of multi-dimensional traffic data for training to obtain new data, and then votes on the new data to output the abnormal score of the multi-dimensional traffic data.

[0026] Preferably, in the abnormal traffic classification model establishment and attack type detection module, the bidirectional gated recurrent neural network is composed of GRU units in the forward and reverse directions. Each GRU unit includes a reset gate, an update gate, and an output gate. The reset gate is used to control the retention of historical information, the update gate is used to control the update of current information, and the output gate is used to output the hidden state. The bidirectional gated recurrent neural network classifies the suspected traffic flow by using the information of the GRU units in the forward and reverse directions and outputs the probabilities that the suspected traffic flow belongs to different attack types.

[0027] Preferably, in the feature extraction module, the use of a deep neural network model to extract features from the preprocessed multi-dimensional traffic data includes: using a one-dimensional convolutional neural network or an autoencoder to extract the temporal features and statistical features of the preprocessed multi-dimensional traffic data to obtain a one-dimensional feature vector of the multi-dimensional traffic data.

[0028] Preferably, in the multi-dimensional traffic data collection and preprocessing module, the preprocessing includes data cleaning, format conversion, feature selection, numerical feature processing, and data dimensionality reduction. The data cleaning includes removing irrelevant features and filling in missing values. The format conversion includes data encoding. The numerical feature processing includes normalizing numerical features and standardizing numerical features;

[0029] In the abnormal traffic classification model establishment and attack type detection module, the implemented defense strategies include interception, isolation, and alarm.

[0030] The beneficial effects of the present invention are as follows:

[0031] A method for hierarchical intrusion detection of ship networks provided by the present invention. In the multi-dimensional traffic data collection and preprocessing step, multi-dimensional traffic data is collected from multiple levels of the ship network. When collecting data, multiple levels such as the network protocol layer, traffic statistics layer, application layer, user behavior layer, and device status layer of the ship network are comprehensively considered, which solves the problem that traditional network intrusion detection methods only consider data from a single level or a single dimension in the network. The obtained multi-dimensional traffic data can comprehensively reflect the operating state of the ship network. For example, data from the network protocol layer can reveal the compliance of underlying rules of network communication, data from the application layer can reflect the operation of various ship business applications, and data from the user behavior layer can detect whether the operation patterns of users such as crew members are abnormal. Data from different levels complement each other, providing rich data samples for subsequent analysis, greatly improving the comprehensiveness of detection, and avoiding missed detections of attacks due to one-sided data. Then, preprocessing is performed on the collected multi-dimensional traffic data, such as data cleaning (removing noise, filling missing values, etc.), format conversion (such as data encoding), and feature selection. The original messy data is converted into structured input data suitable for processing by a deep neural network, enabling the deep neural network to learn data features more efficiently, reducing model training errors caused by data quality problems, and improving the detection accuracy and stability of the model. Next, in the feature extraction step, a deep neural network model is used to extract features from the preprocessed multi-dimensional traffic data to obtain feature vectors of the multi-dimensional traffic data. The deep neural network model has a powerful feature learning ability and can automatically extract complex and hidden features from the preprocessed multi-dimensional traffic data. These feature vectors contain key information of the multi-dimensional traffic data of the ship network in different aspects. Compared with the original data, they can better highlight the differences between normal traffic and abnormal traffic, providing strong support for subsequent anomaly detection and classification, and effectively improving the recognition ability of the detection model for complex attack patterns. In the anomaly detection model establishment and suspicious traffic judgment step, also known as the anomaly detection step, an anomaly detection model is established based on the random forest algorithm, and the feature vectors are input into the anomaly detection model to obtain the anomaly scores of the multi-dimensional traffic data. The anomaly scores are compared with a preset first score threshold, and the traffic can be quickly divided into confident traffic (normal traffic) and suspicious traffic (possibly abnormal traffic). The random forest algorithm has good generalization ability and anti-noise ability, can quickly perform preliminary classification on the feature vectors, can quickly screen out the suspicious part from a large amount of traffic data, greatly reducing the amount of data that needs to be further processed subsequently, improving the detection efficiency, and at the same time avoiding misjudging normal traffic as abnormal and increasing unnecessary processing burdens. The high efficiency of the anomaly detection model established based on the random forest algorithm enables the preliminary detection to be completed in a short time, improving the response speed of the entire system. By setting the preset score threshold, most normal traffic is directly marked as confident traffic, reducing the burden of subsequent classification and reducing the false alarm rate.The steps for establishing an abnormal traffic classification model and detecting attack types, which can also be referred to as the abnormal traffic classification steps, are as follows: An abnormal traffic classification model is established based on a bidirectional gated recurrent neural network and a convolutional neural network. A suspected traffic flow is input into the abnormal traffic classification model to obtain the probabilities that the suspected traffic flow belongs to different known attack types respectively. Then, the maximum probability among all the probabilities is compared with a preset probability threshold to determine whether the suspected traffic flow belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspected traffic flow does not belong to any known attack type and is marked as unknown traffic. Then, the abnormal score of the unknown traffic is compared with a preset second score threshold to determine whether the unknown traffic is a zero-day attack. If the maximum probability is greater than the preset probability threshold, the suspected traffic flow belongs to the known attack type corresponding to the maximum probability, and then the corresponding defense strategy is executed, and the execution situation of the defense strategy is recorded to complete the hierarchical intrusion detection of the ship network. An abnormal traffic classification model is established by using a bidirectional gated recurrent neural network GRU and a convolutional neural network CNN. The bidirectional gated recurrent neural network can effectively process time series data and capture the time-dependent features of the suspected traffic flow from both positive and negative directions. The convolutional neural network is good at extracting the spatial features of data. The combination of the bidirectional GRU and CNN can make full use of the temporal features and spatial features of time series data, comprehensively and deeply analyze the suspected traffic flow, accurately calculate the probabilities that the suspected traffic flow belongs to different known attack types, and accurately judge whether the suspected traffic flow belongs to a known attack type by comparing with the preset probability threshold. For known attack types, the corresponding defense strategy can be quickly executed to effectively prevent attacks and ensure the security of the ship network. By comparing the abnormal score of the unknown traffic with the preset second score threshold, it can be determined whether the unknown traffic is a zero-day attack. This method is based on the learning and modeling of a large number of known attack patterns, and identifies abnormal traffic that does not conform to the known patterns through probability comparison, so as to realize the detection of zero-day attacks. This detection method broadens the detection scope, enables the ship network to have a certain defense ability when facing new and unknown attacks, makes up for the deficiency of traditional detection methods in detecting zero-day attacks, and effectively improves the accuracy and robustness of network intrusion detection.

[0032] The ship network hierarchical intrusion detection method of the present invention, which can also be referred to as a ship network hierarchical intrusion detection method based on deep learning that can detect zero-day attacks. Through the synergistic effect of the random forest algorithm and the bidirectional gated recurrent neural network, zero-day attacks can be effectively detected, improving the detection efficiency and accuracy. In addition, a hierarchical network intrusion detection framework is constructed, dividing the ship network into different levels. For network devices and systems at different levels, different detection technologies are adopted, such as network vulnerabilities, intrusions, abnormal traffic, etc., to achieve a comprehensive perception and discovery of known and unknown threats. By integrating a variety of network security detection technologies, while increasing the detection rate, the double screening and classification mechanism can reduce the false alarm rate and the missed alarm rate. At the same time, various types of network attacks from different sources can be detected, with a wide range of applications and strong resilience.

[0033] The present invention also relates to a ship network hierarchical intrusion detection system, which corresponds to the above-mentioned ship network hierarchical intrusion detection method and can be understood as a system for implementing the above-mentioned ship network hierarchical intrusion detection method. It includes a multi-dimensional traffic data collection and preprocessing module, a feature extraction step, an anomaly detection model establishment and suspicious traffic judgment module, and an abnormal traffic classification model establishment and attack type detection module connected in sequence. Each module works in coordination with each other, utilizes the powerful feature extraction of the deep neural network model, combines the multi-level and multi-dimensional data of the ship network, and constructs an anomaly detection model and an abnormal traffic classification model based on the random forest algorithm, the bidirectional gated recurrent neural network, and the convolutional neural network. With its powerful classification ability, a hierarchical network intrusion detection framework is built, which can effectively detect various types of network attacks in the ship network, including zero-day attacks and unknown data, effectively improving the accuracy, comprehensiveness, and robustness of network intrusion detection. And for different detected attack types, corresponding defense strategies can be quickly executed and the execution situation can be recorded. This can not only prevent attacks in a timely manner but also provide data support for subsequent analysis, so as to dynamically adjust the detection model and defense strategy according to the attack situation, enabling the ship network intrusion detection system to better adapt to the changing network security environment and continuously ensure the safe and stable operation of the ship network. Brief Description of the Drawings

[0034] Figure 1 It is a flowchart of the ship network hierarchical intrusion detection method of the present invention.

[0035] Figure 2 It is a working principle diagram of the ship network hierarchical intrusion detection method of the present invention.

[0036] Figure 3 It is a schematic diagram of a decision tree in the random forest algorithm of the present invention. Detailed Embodiments

[0037] The present invention will be described below with reference to the accompanying drawings.

[0038] The present invention relates to a method for hierarchical intrusion detection of ship networks. After multi-dimensional traffic data collection, preprocessing, and feature extraction, it can be understood that two models are constructed: Model 1 (anomaly detection model, a binary classification model) and Model 2 (anomaly traffic classification model, a multi-classification model). Among them, the input of Model 1 is the ship network traffic to be detected (the feature vector of multi-dimensional traffic data), and the output is the confident traffic and questioned traffic for anomaly score judgment; the input of Model 2 is the questioned traffic, and the output is the possibility of the attack type and the final judgment result, which can effectively detect various types of network attacks, including zero-day attacks or unknown data, improving the accuracy and robustness of network intrusion detection. The flowchart of this method is as Figure 1 shown and successively includes the following steps:

[0039] I. Multi-dimensional traffic data collection and preprocessing step: Collect multi-dimensional traffic data from multiple levels of the ship network. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocess the multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for a deep neural network.

[0040] Specifically, first use tools such as network sniffers, network analyzers, and network monitors to obtain multi-dimensional traffic data from multiple levels of the ship network, or directly obtain multi-dimensional traffic data from ship network devices or servers. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocess the obtained multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for a deep neural network; the preprocessing includes operations such as data cleaning, format conversion, feature selection, numerical feature processing, and data dimensionality reduction on the collected original traffic data. Data cleaning includes removing irrelevant features (i.e., using correlation analysis techniques to select useful features and remove irrelevant features), filling missing values (i.e., directly deleting data containing missing values), and data feature processing includes standardizing numerical features and normalizing numerical features (i.e., using the Min-Max technique to implement the normalization operation), etc., to obtain data suitable for input to a deep learning model and make it meet the requirements of subsequent processing. Among them, format conversion is used to convert the obtained multi-dimensional traffic data into a data format suitable for input to a neural network, including encoding other preprocessed multi-dimensional traffic data, directly encoding discrete features, so that the traffic data meets the input requirements of the neural network, encoding normal traffic as 0, and encoding abnormal traffic as 1, 2, 3, etc. in descending order of their occurrence frequencies.

[0041] II. Feature extraction steps: Use a deep neural network model to extract features from the preprocessed multi-dimensional traffic data to obtain the feature vector of the multi-dimensional traffic data.

[0042] Specifically, use a deep neural network model to extract features from the preprocessed multi-dimensional traffic data, that is, use algorithms such as one-dimensional convolutional neural network (CNN) or autoencoder (AE) to extract the temporal features and statistical features of the multi-dimensional traffic data, and obtain a one-dimensional feature vector. Among them, the deep neural network model includes an input layer for receiving the encoded data, and the dimension of the data is N×M, where N is the number of data and M is the number of features of the data; the role of the input layer is to convert the data into a tensor form that can be processed by the neural network. Using the PyTorch framework, the data is converted into a Tensor object.

[0043] III. Abnormal detection model establishment and suspicious traffic judgment steps: Establish an abnormal detection model based on the random forest algorithm, input the feature vector into the abnormal detection model to obtain the abnormal score of the multi-dimensional traffic data, and compare the abnormal score with a preset first score threshold. Mark the multi-dimensional traffic data with an abnormal score less than or equal to the preset first score threshold as confident traffic, which is used as the normal traffic for transmission; mark the multi-dimensional traffic data with an abnormal score greater than the preset first score threshold as suspicious traffic and transfer it to the subsequent abnormal traffic classification model establishment and attack type detection steps for processing.

[0044] Specifically, as Figure 2 shown in the first stage 1 st Stage detects whether the input feature vector is abnormal. First, establish an abnormal detection model (also called Anomaly Detector) based on the random forest (RF) algorithm. The random forest (RF) algorithm includes a random forest layer, and the random forest layer is used for feature selection and preliminary classification of the data, and outputs the probability that the data belongs to normal or abnormal. The random forest layer consists of K decision trees. As Figure 3 shown, each decision tree uses the Bootstrap Resampling statistical method to randomly extract a part of the features and samples (sample 1, sample 2, sample 3... sample n) from the feature vector (original training sample) of the multi-dimensional traffic data for independent training to obtain new data (classification tree 1, classification tree 2, classification tree 3... classification tree i, classification tree n), and then vote on these new data, that is, vote to integrate the results of all classification trees to determine the optimal classification. In Figure 2 it is the traffic sample X = x1, x2... x N input the anomaly detection model (Anomaly Detector), and output the anomaly score λ of the multi-dimensional traffic data B(That is, the output data is the probability of being normal or abnormal, and the output probabilities of the random forest layer are sorted, and the data corresponding to the maximum probability is selected as the candidate for abnormal data), and the anomaly score λ B is compared with a preset first score threshold τ B to mark the multi-dimensional traffic data with an anomaly score less than or equal to the preset first score threshold (for example, with an anomaly score less than or equal to 0.5) as confident traffic (that is, if the output of the Anomaly Detector is True, it means the sample is determined to be Benign), which is used as the normal traffic for transmission. That is, this anomaly detection model has confidence in confirming that these traffic data are normal traffic and can be used for transmission. The anomaly score λ B greater than the preset first score threshold τ B of the multi-dimensional traffic data is marked as suspicious traffic (that is, if the output of the Anomaly Detector is False, it means the sample is determined to be Anomaly), that is, traffic that may be abnormal, and is transmitted to the anomaly traffic classification model establishment and attack type detection step for processing. The dimension of the data is N×2, where N is the number of data, and 2 is the probability of being normal or abnormal; the role of the random forest layer is to reduce the dimension and perform preliminary screening of the data, reduce the computational complexity of the neural network, improve the detection efficiency and accuracy, construct the random forest model, set parameters such as the number of trees, the proportion of features, and the proportion of samples, and then fit and predict the data.

[0045] IV. Anomaly traffic classification model establishment and attack type detection step: An anomaly traffic classification model is established based on a bidirectional gated recurrent neural network and a convolutional neural network, and a certain suspicious traffic is input into the anomaly traffic classification model to obtain the probabilities that the suspicious traffic belongs to different known attack types respectively. Then, the maximum probability among all the probabilities is compared with a preset probability threshold to determine whether the suspicious traffic belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspicious traffic does not belong to any known attack type and is marked as unknown traffic. Then, the anomaly score of the unknown traffic is compared with a preset second score threshold, and the preset second score threshold is greater than the preset first score threshold. If the anomaly score of the unknown traffic is less than or equal to the preset second score threshold (that is, between the first score threshold and the second score threshold), the unknown traffic is marked as confident traffic; if the anomaly score of the unknown traffic is greater than the preset second score threshold, the unknown traffic is marked as a zero-day attack; if the maximum probability is greater than the preset probability threshold, the suspicious traffic belongs to the known attack type corresponding to the maximum probability, and then the corresponding defense strategy is executed, and the execution situation of the defense strategy is recorded to complete the hierarchical intrusion detection of the ship network.

[0046] Specifically, such as Figure 2The second stage 2 shown st The Stage detects whether the questioned traffic input belongs to a known attack type. First, an abnormal traffic classification model (also called an attack classifier Attack Classifier) is established based on a bidirectional gated recurrent neural network (GRU) and a convolutional neural network (CNN). Then, the questioned traffic is subjected to preliminary feature extraction and dimensionality reduction processing through the convolutional neural network to obtain the processed questioned traffic and input it into the bidirectional gated recurrent neural network to extract discriminative local features from the questioned traffic. The bidirectional gated recurrent neural network (GRU) includes a bidirectional GRU layer. The processed questioned traffic is received through the bidirectional GRU layer, and the information in the forward and backward directions (i.e., the positive direction and the negative direction) is used to classify the processed questioned traffic, and the probabilities that the questioned traffic belongs to different known attack types are output. The bidirectional GRU layer is composed of GRU units in two directions (the positive direction and the negative direction). Each GRU unit consists of a reset gate, an update gate, and an output gate. The reset gate is used to control the retention of historical information, the update gate is used to control the update of current information, and the output gate is used to output the hidden state. The dimension of the data is N×C, where N is the number of data and C is the number of attack types. The role of the bidirectional GRU layer is to extract and classify the temporal features of abnormal data, consider the forward and backward correlation of traffic data, improve the sensitivity and robustness of detection, use frameworks such as PyTorch to build a bidirectional GRU model, set parameters such as the number of GRU units, the dimension of the hidden state, and the activation function, and then fit and predict the data.

[0047] After obtaining the probabilities that the questioned traffic belongs to different known attack types (i.e., the probabilities that a certain questioned traffic belongs to different known attack types are respectively ) i∈[1....N], the maximum probability M among all the probabilities is compared with the preset probability threshold τ to determine whether the questioned traffic belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, that is Figure 2 then the questioned traffic does not belong to any known attack type and is marked as unknown traffic Unknown. Then, in the third stage shown in B U , that is, the extension stage Extension, the abnormal score of the first stage is used again to determine whether the unknown traffic belongs to a zero-day attack. First, the abnormal score λ U of the unknown traffic is compared with the preset second score threshold τ B This preset second score threshold τ B is greater than the preset first score threshold τ U (or the preset first score threshold τ )B < τ U If the anomaly score λ of the unknown traffic B is less than or equal to a preset second score threshold τ U , that is, λ B ≤ τ U , then mark the unknown traffic as benign traffic Benign; if the anomaly score λ of the unknown traffic B is greater than the preset second score threshold τ U , that is, λ B > τ U , then mark the unknown traffic as a zero-day attack Zero-Day.

[0048] If the maximum probability is greater than the preset probability threshold, that is greater than τ M , then the questioned traffic belongs to the known attack type corresponding to the maximum probability, and then execute corresponding defense strategies for this attack type, such as interception, isolation, alarm, etc. At the same time, for a denial-of-service attack, interception or isolation can be used; for a Trojan attack, alarm or cleaning can be used. Process the abnormal data, for example, intercept or isolate the source address of the abnormal data, alarm or clean the target address of the abnormal data; and record the execution of the defense strategy, for example, record the source of the abnormal data, attack type, defense measures, processing results, etc., to complete the hierarchical intrusion detection of the ship network.

[0049] Finally, according to the judgment result of the data, select a suitable processing method. For example, for normal traffic for transmission, it can be directly released. For unknown traffic, it can be recorded or further analyzed, and record the execution of the processing method, such as recording the source of the data, judgment result, processing measures, processing results, etc.

[0050] The present invention also relates to a ship network hierarchical intrusion detection system, which corresponds to the above ship network hierarchical intrusion detection method and can be understood as a system for implementing the above method. The system includes a multi-dimensional traffic data acquisition and preprocessing module, a feature extraction module, an anomaly detection model establishment and questioned traffic judgment module, and an abnormal traffic classification model establishment and attack type detection module that are connected in sequence. Specifically,

[0051] The multi-dimensional traffic data acquisition and preprocessing module collects multi-dimensional traffic data from multiple levels of the ship network. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocesses the multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for a deep neural network;

[0052] The feature extraction module uses a deep neural network model to extract features from the preprocessed multi-dimensional traffic data, obtaining the feature vectors of the multi-dimensional traffic data;

[0053] The anomaly detection model establishment and suspicious traffic judgment module establishes an anomaly detection model based on the random forest algorithm, inputs the feature vectors into the anomaly detection model to obtain the anomaly scores of the multi-dimensional traffic data, compares the anomaly scores with a preset first score threshold, marks the multi-dimensional traffic data with anomaly scores less than or equal to the preset first score threshold as confident traffic, which serves as the normal traffic for transmission; marks the multi-dimensional traffic data with anomaly scores greater than the preset first score threshold as suspicious traffic and transfers it to the anomaly traffic classification model establishment and attack type detection step for processing;

[0054] The anomaly traffic classification model establishment and attack type detection module establishes an anomaly traffic classification model based on a bidirectional gated recurrent neural network and a convolutional neural network, inputs a certain suspicious traffic into the anomaly traffic classification model, respectively obtains the probabilities that the suspicious traffic belongs to different known attack types, then compares the maximum probability among all the probabilities with a preset probability threshold to determine whether the suspicious traffic belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspicious traffic does not belong to any known attack type and is marked as unknown traffic. Then, the anomaly score of the unknown traffic is compared with a preset second score threshold, where the preset second score threshold is greater than the preset first score threshold. If the anomaly score of the unknown traffic is less than or equal to the preset second score threshold, the unknown traffic is marked as confident traffic; if the anomaly score of the unknown traffic is greater than the preset second score threshold, the unknown traffic is marked as a zero-day attack;

[0055] If the maximum probability is greater than the preset probability threshold, the suspicious traffic belongs to the known attack type corresponding to the maximum probability, and then the corresponding defense strategy is executed, and the execution situation of the defense strategy is recorded to complete the hierarchical intrusion detection of the ship network.

[0056] Preferably, in the anomaly detection model establishment and suspicious traffic judgment module, the random forest algorithm consists of multiple decision trees. Each decision tree randomly extracts a part of the features and samples from the feature vectors of the multi-dimensional traffic data for training to obtain new data, and then votes on the new data to output the anomaly scores of the multi-dimensional traffic data.

[0057] Preferably, in the abnormal traffic classification model establishment and attack type detection module, the bidirectional gated recurrent neural network is composed of GRU units in the forward and reverse directions. Each GRU unit includes a reset gate, an update gate, and an output gate. The reset gate is used to control the retention of historical information, the update gate is used to control the update of current information, and the output gate is used to output the hidden state. The bidirectional gated recurrent neural network classifies the questioned traffic by using the information of the GRU units in the forward and reverse directions, and outputs the probabilities of the questioned traffic belonging to different attack types.

[0058] Preferably, in the feature extraction module, using a deep neural network model to extract features from the preprocessed multi-dimensional traffic data includes: using a one-dimensional convolutional neural network or an autoencoder to extract the temporal features and statistical features of the preprocessed multi-dimensional traffic data, and obtaining a one-dimensional feature vector of the multi-dimensional traffic data.

[0059] Preferably, in the multi-dimensional traffic data collection and preprocessing module, the preprocessing includes data cleaning, format conversion, feature selection, numerical feature processing, and data dimensionality reduction. The data cleaning includes removing irrelevant features and filling missing values. The format conversion includes data encoding. The numerical feature processing includes normalizing numerical features and standardizing numerical features;

[0060] In the abnormal traffic classification model establishment and attack type detection module, the executed defense strategies include interception, isolation, and alarm.

[0061] The present invention provides an objective and scientific ship network hierarchical intrusion detection method and system. By using the powerful feature extraction and classification capabilities of the deep neural network model, combining the multi-level and multi-dimensional data of the ship network, and constructing a hierarchical network intrusion detection framework based on the random forest algorithm, bidirectional gated recurrent neural network, and convolutional neural network, it can effectively detect various types of network attacks, as well as unknown and zero-day attacks, and effectively improve the accuracy and robustness of network intrusion detection.

[0062] It should be noted that the above specific embodiments can enable those skilled in the art to understand the present invention more comprehensively, but do not limit the present invention in any way. Therefore, although this specification has described the present invention in detail with reference to the drawings and embodiments, those skilled in the art should understand that the present invention can still be modified or equivalently replaced. In short, all technical solutions and their improvements that do not depart from the spirit and scope of the present invention should be covered by the protection scope of the patent of the present invention.

Claims

1. A hierarchical intrusion detection method for ship networks, characterized in that Including the following steps: Multi-dimensional traffic data collection and preprocessing step: Collect multi-dimensional traffic data from multiple levels of the ship network. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocess the multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for a deep neural network; Feature extraction step: Use a deep neural network model to extract features from the preprocessed multi-dimensional traffic data to obtain a feature vector of the multi-dimensional traffic data; Abnormal detection model establishment and suspicious traffic judgment step: Establish an abnormal detection model based on the random forest algorithm, input the feature vector into the abnormal detection model to obtain an abnormal score of the multi-dimensional traffic data, and compare the abnormal score with a preset first score threshold. Mark the multi-dimensional traffic data with an abnormal score less than or equal to the preset first score threshold as confident traffic, which is used as normal traffic for transmission; Mark the multi-dimensional traffic data with an abnormal score greater than the preset first score threshold as suspicious traffic and transfer it to the abnormal traffic classification model establishment and attack type detection step for processing; Abnormal traffic classification model establishment and attack type detection step: Establish an abnormal traffic classification model based on a bidirectional gated recurrent neural network and a convolutional neural network, input a certain suspicious traffic into the abnormal traffic classification model, and obtain the probabilities that the suspicious traffic belongs to different known attack types respectively. Then compare the maximum probability among all probabilities with a preset probability threshold to determine whether the suspicious traffic belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspicious traffic does not belong to any known attack type and is marked as unknown traffic. Then compare the abnormal score of the unknown traffic with a preset second score threshold, where the preset second score threshold is greater than the preset first score threshold. If the abnormal score of the unknown traffic is less than or equal to the preset second score threshold, mark the unknown traffic as confident traffic; If the abnormal score of the unknown traffic is greater than the preset second score threshold, mark the unknown traffic as a zero-day attack; If the maximum probability is greater than the preset probability threshold, the suspicious traffic belongs to the known attack type corresponding to the maximum probability, and then execute the corresponding defense strategy, and record the execution situation of the defense strategy to complete the hierarchical intrusion detection of the ship network.

2. The ship network hierarchical intrusion detection method according to claim 1, characterized in that In the abnormal detection model establishment and suspicious traffic judgment step, the random forest algorithm consists of multiple decision trees. Each decision tree randomly extracts a part of the features and samples from the feature vector of the multi-dimensional traffic data for training to obtain new data, and then votes on the new data to output the abnormal score of the multi-dimensional traffic data.

3. The ship network hierarchical intrusion detection method according to claim 1, characterized in that In the steps of establishing the abnormal traffic classification model and detecting the attack type, the bidirectional gated recurrent neural network is composed of GRU units in the forward and reverse directions. Each GRU unit includes a reset gate, an update gate, and an output gate. The reset gate is used to control the retention of historical information, the update gate is used to control the update of current information, and the output gate is used to output the hidden state. The bidirectional gated recurrent neural network classifies the questioned traffic by using the information of the GRU units in the forward and reverse directions, and outputs the probabilities of the questioned traffic belonging to different attack types.

4. The ship network hierarchical intrusion detection method according to any one of claims 1 to 3, characterized in that, In the feature extraction step, using a deep neural network model to extract features from the preprocessed multi-dimensional traffic data includes: using a one-dimensional convolutional neural network or an autoencoder to extract the temporal features and statistical features of the preprocessed multi-dimensional traffic data, and obtaining a one-dimensional feature vector of the multi-dimensional traffic data.

5. The ship network hierarchical intrusion detection method according to any one of claims 1 to 3, characterized in that, In the multi-dimensional traffic data collection and preprocessing step, the preprocessing includes data cleaning, format conversion, feature selection, numerical feature processing, and data dimensionality reduction. The data cleaning includes removing irrelevant features and filling in missing values. The format conversion includes data encoding. The numerical feature processing includes normalizing numerical features and standardizing numerical features. In the steps of establishing the abnormal traffic classification model and detecting the attack type, the defense strategies implemented include interception, isolation, and alarm.

6. A hierarchical intrusion detection system for ship networks, characterized in that, It includes a multi-dimensional traffic data collection and preprocessing module, a feature extraction module, an anomaly detection model establishment and questioned traffic judgment module, and an abnormal traffic classification model establishment and attack type detection module that are connected in sequence. The multi-dimensional traffic data collection and preprocessing module collects multi-dimensional traffic data from multiple levels of the ship network. The multi-dimensional traffic data includes several combinations of network protocol layer data, traffic statistics layer data, application layer data, user behavior layer data, and device status layer data, and preprocesses the multi-dimensional traffic data. The preprocessed multi-dimensional traffic data is structured input data suitable for a deep neural network. The feature extraction module uses a deep neural network model to extract features from the preprocessed multi-dimensional traffic data, and obtains a feature vector of the multi-dimensional traffic data. The anomaly detection model establishment and questioned traffic judgment module establishes an anomaly detection model based on the random forest algorithm, inputs the feature vector into the anomaly detection model to obtain the anomaly score of the multi-dimensional traffic data, and compares the anomaly score with a preset first score threshold. Mark the multi-dimensional traffic data with an anomaly score less than or equal to the preset first score threshold as confident traffic, which is used as normal traffic for transmission. Mark the multi-dimensional traffic data with an anomaly score greater than the preset first score threshold as questioned traffic, and transfer it to the steps of establishing the abnormal traffic classification model and detecting the attack type for processing. The abnormal traffic classification model establishment and attack type detection module establishes an abnormal traffic classification model based on a bidirectional gated recurrent neural network and a convolutional neural network, and inputs a suspected traffic flow into the abnormal traffic classification model to obtain the probabilities that the suspected traffic flow belongs to different known attack types respectively. Then, the maximum probability among all the probabilities is compared with a preset probability threshold to determine whether the suspected traffic flow belongs to the known attack type corresponding to the maximum probability. If the maximum probability is less than or equal to the preset probability threshold, the suspected traffic flow does not belong to any known attack type and is marked as an unknown traffic flow. Then, the abnormal score of the unknown traffic flow is compared with a preset second score threshold, and the preset second score threshold is greater than the preset first score threshold. If the abnormal score of the unknown traffic flow is less than or equal to the preset second score threshold, the unknown traffic flow is marked as a confident traffic flow; If the abnormal score of the unknown traffic flow is greater than the preset second score threshold, the unknown traffic flow is marked as a zero-day attack; If the maximum probability is greater than the preset probability threshold, the suspected traffic flow belongs to the known attack type corresponding to the maximum probability, and then the corresponding defense strategy is executed, and the execution situation of the defense strategy is recorded to complete the hierarchical intrusion detection of the ship network.

7. The ship network hierarchical intrusion detection system according to claim 6, characterized in that In the abnormal detection model establishment and suspected traffic flow judgment module, the random forest algorithm consists of multiple decision trees. Each decision tree randomly extracts a part of features and samples from the feature vectors of multi-dimensional traffic data for training to obtain new data, and then votes on the new data to output the abnormal score of the multi-dimensional traffic data.

8. The ship network hierarchical intrusion detection system according to claim 6, characterized in that, In the abnormal traffic classification model establishment and attack type detection module, the bidirectional gated recurrent neural network consists of GRU units in the forward and backward directions. Each GRU unit includes a reset gate, an update gate, and an output gate. The reset gate is used to control the retention of historical information, the update gate is used to control the update of current information, and the output gate is used to output the hidden state. The bidirectional gated recurrent neural network classifies the suspected traffic flow by using the information of the GRU units in the forward and backward directions and outputs the probabilities that the suspected traffic flow belongs to different attack types.

9. The ship network hierarchical intrusion detection system according to any one of claims 6 to 8, characterized in that, In the feature extraction module, the use of a deep neural network model to extract features from the preprocessed multi-dimensional traffic data includes: using a one-dimensional convolutional neural network or an autoencoder to extract the temporal features and statistical features of the preprocessed multi-dimensional traffic data to obtain a one-dimensional feature vector of the multi-dimensional traffic data.

10. The ship network hierarchical intrusion detection system according to any one of claims 6 to 8, characterized in that, In the multi-dimensional traffic data collection and preprocessing module, the preprocessing includes data cleaning, format conversion, feature selection, numerical feature processing, and data dimensionality reduction. The data cleaning includes removing irrelevant features and filling in missing values. The format conversion includes data encoding. The numerical feature processing includes normalizing numerical features and standardizing numerical features; In the abnormal traffic classification model establishment and attack type detection module, the executed defense strategies include interception, isolation, and alarm.

Images