Network intrusion detection method for enhancing minority class data identification capability
Through the improved table generation of adversarial network and self-attention mechanism, combined with the parallel one-dimensional convolution-bidirectional gating loop unit, the problem of insufficient recognition of a few categories in network intrusion detection is solved, and efficient and accurate network intrusion detection is achieved.
Patent Information
- Application Number
- CN202510663072.2
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-05-22
- Publication Date
- 2025-08-01
AI Technical Summary
When facing unbalanced samples, existing network intrusion detection models are difficult to effectively identify a few types of attack traffic, and the training cost of high-dimensional network traffic data is high, resulting in insufficient classification accuracy.
The improved table generation adversarial network, an autoencoder combining self-attention mechanism and a parallel one-dimensional convolution-bidirectional gating cycle unit structure are used to perform data preprocessing and feature extraction, and through data enhancement and dimensionality reduction, the recognition rate of a few types of data is improved.
It significantly improves the recognition accuracy of a few types of attack traffic, shortens training time, improves the robustness and generalization ability of the model, is highly adaptable, and is suitable for high-precision intrusion detection in modern network environments.
Smart Images
Figure CN120415855A_ABST
Abstract
Description
Technical Field
[0001] This application relates to the fields of artificial intelligence and network security, and in particular to a method for improving the detection rate of minority-class attack traffic in network intrusion detection. Background Art
[0002] With the development of artificial intelligence technology in recent years, using artificial intelligence technology to automatically analyze network traffic has gradually become the mainstream in order to discover attack behaviors hidden in a large amount of traffic. However, normal traffic and abnormal traffic in the network usually show an unbalanced state. Unbalanced samples will seriously affect the performance of the detection algorithm, causing the classification algorithm to bias the classification result towards the majority-class normal traffic data, seriously affecting the model performance. At the same time, network traffic data has characteristics such as high dimensionality, feature heterogeneity, and strong temporal correlation. Directly training a model with high-dimensional data will significantly increase the training time and computational cost, and the mainstream traffic classification models usually have a single structure, resulting in their inability to fully extract various data feature information of network intrusion.
[0003] Therefore, there is an urgent need to design an intrusion detection method that can not only effectively enhance minority-class samples but also reduce the dimensionality to extract the feature dimension of network traffic, so as to achieve the purpose of improving the detection ability of minority-class attack traffic and ensuring the model training efficiency, in order to meet the requirements of high-precision and high-robustness intrusion detection in the modern network environment. Summary of the Invention
[0004] The purpose of the present invention is to solve the problems existing in the above background art, and provide a network intrusion detection method for enhancing the recognition ability of minority-class data. The model solves the problems of the prior art. The model uses an improved tabular generative adversarial network, an autoencoder structure combined with a self-attention mechanism, and a parallel one-dimensional convolutional - bidirectional gated recurrent unit structure to reduce the dimensionality of all traffic data and perform data enhancement on minority-class traffic data, so as to enhance the proportion of the number of minority-class data in the training set. Finally, the enhanced dataset is used to train the parallel one-dimensional convolutional - bidirectional gated recurrent unit machine, and hyperparameter adjustment is performed on the validation set, so as to improve the recognition rate of the model for minority-class data and enhance the overall recognition accuracy.
[0005] In order to achieve the above purpose, this application adopts the following technical solutions:
[0006] The present invention provides a network intrusion detection method for enhancing the recognition ability of minority-class data, including: a data preprocessing module, an improved tabular generative adversarial network structure, an autoencoder structure combined with a self-attention mechanism, and a parallel one-dimensional convolutional - bidirectional gated recurrent unit structure;
[0007] The initialization module: preprocesses the network traffic data. First, it finds the NULL values and Infinity values in the numerical columns of the traffic data, fills them with 0 and the average value of the column respectively, then performs Yeo - johnson initialization processing on the numerical columns to limit the value range of the numerical column data within [-1, 1]. Finally, it performs one - hot encoding on the categorical columns in the traffic data to convert the text - type data into one - hot encoding form;
[0008] The improved tabular generative adversarial network: First, the one - dimensional feature sequence after data pre - processing and encoding is adaptively mapped to a g×g square grid according to the total feature width, where g is the smallest integer that can cover all features and is closest. In this way, the original one - dimensional traffic data is mapped into two - dimensional tabular data. The generator of the tabular generative adversarial network adopts a cascaded structure of "transposed convolution - batch normalization - rectified linear unit", and upsamples step by step until a single - channel fitted two - dimensional traffic data is obtained; the discriminator of the tabular generative adversarial network downsamples step by step in the way of "convolution - batch normalization - Leaky ReLU", and finally uses 1×1 convolution to output the true - false discrimination result. This design can utilize the advantages of two - dimensional convolution in spatial correlation modeling to fully extract the information of network traffic data. At the same time, a classifier structure based on linear layers is constructed in parallel outside the main loop of the generator - discriminator of the tabular generative adversarial network. Specifically, this classifier structure first masks the one - hot encoding dimension of the target column and only retains the remaining features to enter the fully - connected stack; then it passes through several hidden layers with Leaky ReLU activation function and Dropout in turn, and finally adaptively selects the Sigmoid or Softmax output layer according to the number of classes of the target column to obtain a prediction vector of the same type as the label. This module accepts the input of real and generated traffic data samples during the training phase, and updates the discriminator and the generation gradient of the improved tabular generative adversarial network through cross - entropy loss respectively. This method not only makes the generator pay more attention to the overall distribution matching, but also focuses on the discriminant information related to the classification task. To maintain the consistency between the synthetic traffic samples and the original traffic data, this improved tabular generative adversarial network performs the operation of restoring two - dimensional data to one - dimensional data after generating minority - class traffic data, and finally obtains synthetic traffic data with the same dimension as the input traffic data, so that the synthetic traffic can be directly used for the training of subsequent models. Through the above design, this improved tabular generative adversarial network constructs a convolutional generative adversarial network synthesis method for one - dimensional network traffic data, realizing the complete logic from two - dimensional mapping to adversarial generation, then to minority - class enhancement, and finally to two - dimensional data reverse reduction for minority - class traffic data. This method not only improves the overall quality of the synthetic traffic data, but also significantly enhances the adaptability and robustness to extremely class - imbalanced scenarios.
[0009] The autoencoder structure combined with the self-attention mechanism: The encoder part of the autoencoder consists of three linear units with gradually decreasing output dimensions, finally compressing the input features to the bottleneck layer dimension. After each layer of linear units, a ReLU activation function is connected to enhance the non-linearity. The self-attention mechanism module is arranged after the bottleneck layer, generating query, key, and value vectors through the self-attention structure unit, calculating the scaled dot-product attention and weighted summation, thereby realizing the cross-dimensional feature interaction and adaptive reconstruction of the bottleneck layer vectors. The decoder part of the autoencoder consists of three linear units with gradually increasing dimensions, symmetric to the encoder structure, restoring the attention-enhanced features to the second hidden layer dimension, the first hidden layer dimension, and the input feature dimension in sequence. After each layer, a ReLU activation function is connected to optimize the data reconstruction effect. This structure synergistically combines multi-level dimensionality reduction and the attention mechanism, improving the feature discriminability and reconstruction accuracy while reducing the computational complexity.
[0010] The parallel one-dimensional convolutional - bidirectional gated recurrent unit structure: For the one-dimensional convolutional spatial feature extraction module, this module regards the input traffic data as a one-dimensional tensor of a single channel, and completes multi-scale feature extraction through two levels of "convolution - activation - convolution - activation - pooling" sub-structures in sequence. Each level of convolution selects a combination of a smaller receptive field and adjacent scales, first expands the features in the channel dimension, and then reduces the sequence length through pooling to aggregate context information. Subsequently, batch normalization and dropout are performed on all feature channels, and the flattened high-dimensional vector is compressed into a compact spatial feature representation through a fully connected layer. This module makes full use of the advantages of one-dimensional convolution in local correlation modeling, can capture both fine-grained edge information and long-range dependencies simultaneously, and lays a high-resolution spatial foundation for subsequent temporal modeling and classification. For the bidirectional two-layer gated recurrent unit module, this module adopts a stacked bidirectional gated recurrent unit structure, encodes the traffic data in both forward and backward directions simultaneously within each layer, and concatenates the bidirectional hidden states at the last time step; the concatenated time vector then undergoes batch normalization and dropout to suppress internal covariance shift, and the resulting time vector is mapped into a compressed vector of a unified length through a fully connected layer. Designing a two-layer stack combined with a gated mechanism can effectively alleviate gradient vanishing, ensure sufficient learning of the temporal information in the traffic data, and at the same time use the bidirectional structure to eliminate the information blind spots generated by unidirectional recursion, improving the model's global consistency modeling ability for traffic data. Finally, the spatial vector obtained by convolution and the time vector obtained by recurrence are directly concatenated in the channel dimension to form a complementary spatio-temporal vector, and the final class probability is output through a fully connected layer. The strategy of directly parallelly concatenating the spatio-temporal vectors not only maintains the respective advantages of the two types of sub-networks, but also avoids the complex alignment of traffic data, achieving the purpose of a compact structure and stable training. The parallel one-dimensional convolutional - bidirectional gated recurrent unit model is trained on the training set, hyperparameters are adjusted on the validation set, and finally the well-divided test set is used to verify with metrics such as precision, accuracy, false alarm rate, and F1-Score. Finally, the trained model is put into the actual production environment for use.
[0011] Compared with the prior art, the present invention has the following advantages and beneficial effects:
[0012] 1. The improved tabular generative adversarial network introduces conditional sampling, convolutional adversarial generation, and classification consistency constraints for the class imbalance scenario, and can directionally increase the number and diversity of minority class samples while maintaining the overall distribution consistency. It significantly alleviates the problem of poor classification accuracy caused by "majority class dominance" in the traditional training process.
[0013] 2. By introducing self-attention mechanism into the bottleneck layer of the autoencoder, it is possible to adaptively capture cross-dimensional dependencies while achieving significant dimensionality reduction, enabling key information to be accurately retained during the compression process. The result not only effectively reduces the input dimension and computational overhead of the subsequent model, shortens the convergence time, but also improves the discriminability and robustness of the low-dimensional representation, laying a feature foundation with high signal-to-noise ratio for subsequent learning.
[0014] 3. The parallel one-dimensional convolutional - bidirectional gated recurrent unit structure focuses on local pattern extraction on the spatial branch side and global context encoding on the temporal branch side. The cascade of the two can form a complete spatio-temporal feature representation; combined with validation set-driven hyperparameter search, the optimal performance solution can be quickly found under different data scales and business requirements. Compared with traditional single-path models, this parallel framework has the advantages of simple structure, stable training, and strong generalization ability, and finally shows a higher level in core indicators such as precision, accuracy, and F1-Score, especially showing a significant performance improvement in the identification task of minority-class attack traffic. BRIEF DESCRIPTION OF THE DRAWINGS [[ID=]6]
[0015] The drawings are used to provide a further understanding of the present application and constitute a part of the specification. They are used together with the embodiments of the present application to explain the present application and do not constitute a limitation to the present application.
[0016] Figure 1 Overall structure diagram of a network intrusion detection model for enhancing the identification ability of minority-class data
[0017] Figure 2 Structural diagram of an improved tabular generative adversarial network
[0018] Figure 3 Structural diagram of an autoencoder combined with self-attention mechanism
[0019] Figure 4 Dimensional change diagram of the parallel one-dimensional convolutional - bidirectional gated recurrent unit DETAILED DESCRIPTION OF THE EMBODIMENTS
[0020] In order to make the objectives, technical solutions, and advantages of the present invention clearer, the following embodiments will further illustrate the present invention in conjunction with the accompanying drawings. The embodiments described are only a part of the embodiments of the present application, not all of the embodiments.
[0021] Embodiment 1
[0022] Referring to Figures 1-4 , the embodiments of the present application provide a network intrusion detection method for enhancing the identification ability of minority-class data. The specific steps of the method are as follows:
[0023] S1. Based on an open-source network intrusion dataset containing various attack types and normal traffic, such asFigure 1 Perform preprocessing operations on the dataset, including data cleaning, standardization, and one-hot encoding. Yeo-Johnson method is used for data standardization;
[0024] S2. Use an improved tabular generative adversarial network to perform data augmentation on the minority-class traffic data in the training set, as Figure 2 shown;
[0025] S21. One-dimensional feature two-dimensionalization and transposed convolutional generative-discriminative architecture: First, pad zeros at the end of the feature vector x ∈ R d to make its length become where i.e., take the smallest integer n that satisfies n 2 ≥ d, and then reshape the data into a single-channel square matrix of n × n;
[0026] S22: Convolutional generative-discriminative adversarial network: After concatenating the random noise z ∈ R 100 with the conditional vector c ∈ R c (c is the total width of the classes), it undergoes four layers of transposed convolution in the generator for upsampling step by step, and outputs two-dimensional data with a dimension of 1 × n × n; The number of channels in the first layer of the transposed convolution is set to 64 and decreases by half in subsequent layers. The discriminator adopts a mirror convolutional structure, performs feature extraction on the input real and fake two-dimensional data, and outputs the true and false probabilities y. The loss is calculated using the logarithmic likelihood form:
[0027]
[0028] Both the generator and the discriminator use the Adam optimizer and have the same learning rate parameter;
[0029] S23: To make the generated samples more realistic, a multi-layer perceptron classifier C is trained in parallel outside the discriminator and generator structures. Its working process is to input the real samples and the generated samples into C at the same time, and calculate the cross-entropy losses and respectively. The total loss of the generator obtained is updated as:
[0030]
[0031] where the value of λ is 1.0. By designing the classifier, it is forced that the generated samples are consistent with the conditional vector in the label space. And in the conditional vector generation stage, by assigning a heavier weight to the low-frequency classes, the purpose of sampling the minority-class data multiple times is achieved, so as to enhance the learning intensity of rare data;
[0032] S24: After the generation stage, the 1×n×n output matrix is flattened into a vector x according to the row-major rule, and the zero elements filled in the early stage are discarded, only the first d valid features are retained to ensure that the dimension is exactly the same as the original feature, and then it is concatenated with the conditional vector c.
[0033] S3. Use an autoencoder structure combined with the self-attention mechanism to perform dimensionality reduction on network traffic data to obtain a low-dimensional representation of the original data, as Figure 3 shown;
[0034] S31: Encoding and compression operation. The original feature vector X∈R d is input into a three-layer linear mapping network. The weight matrices of each layer are denoted as W1, W2, and W3 in turn, and the ReLU activation function is used. After successive compression, the bottleneck layer representation Z∈R r can be obtained, where r is much smaller than d, and thus the bottleneck layer data is obtained;
[0035] S32: Self-attention weighting. Z is linearly transformed into query Q, key K, and value V respectively:
[0036] Q = W Q z, K = W K z, V = W V z
[0037] Calculate the dot-product attention weights and obtain the weighted bottleneck vector:
[0038]
[0039] S33: The obtained bottleneck layer vector enters the decoder part of the autoencoder for iterative training. The mean square error is used as the main optimization objective, and the parameters of the encoder, decoder, and attention layer are updated synchronously through backpropagation until the loss converges. Through this structure, the data compression ratio d:r can be flexibly selected, and the addition of the attention mechanism is beneficial to globally model the data on the bottleneck layer. The data after low-dimensional representation is beneficial to reducing the training cost of the subsequent model.
[0040] S4. Based on the foregoing synthesis and dimensionality reduction results, construct a discriminant network with a parallel convolutional branch and a bidirectional gated recurrent branch to perform high-precision classification on network traffic sequences. The schematic diagram of the overall network dimension change is shown in Figure 4 :
[0041] S41: The convolutional branch is a double-layer stacked structure. The first layer uses a one-dimensional convolutional kernel with a receptive field of 3×1 to extract coarse-grained patterns and expands the number of channels from 1 to 8. Subsequently, a convolutional kernel with a receptive field of 2×1 is used to further refine the features and expand them to 16 channels. The maximum pooling window has a length of 2, and the sequence length is downsampled by 1 / 2. The above structure is repeated in the second stage, and feature maps with 8 channels and 16 channels are output successively, followed by pooling of the same size. After two-stage processing, the sequence length is compressed to 1 / 4 of the original value, while the total number of channels of the feature maps remains 16;
[0042] S42: The bidirectional gated recurrent branch takes the original one-dimensional feature sequence as input and constructs two layers of bidirectional GRUs, with the number of hidden units h = 200 in each layer. The forward hidden state is output for any time step t and the backward hidden state and their concatenation is taken at the last time step:
[0043]
[0044] After obtaining the output data of the convolution and the stacked bidirectional GRU, both are subjected to row batch normalization and 0.3 dropout, and are compressed to the same 30 dimensions through a fully connected layer;
[0045] S43: Feature-level fusion and discrimination: The obtained convolution output and the stacked bidirectional GRU output data are concatenated to obtain a fused representation:
[0046]
[0047] The raw scores of the classes are output through a linear classification head, and a probability vector P is obtained through softmax. Multiclass cross-entropy is used during the training process:
[0048]
[0049] where y is the one-hot encoding of the true label. The network parameters are updated by the Adam optimizer, and the learning rate is set to 1×10-3.
[0050] S5. To verify the effectiveness of the model in a real network environment, the trained model and configuration will be migrated to the production side and a full-process detection service will be built:
[0051] S51: The above model structures are respectively converted to the ONNX format, and lightweight images are made using Docker;
[0052] S52: Use TorchServe to combine three segments of the model into a single endpoint, implement elastic load balancing through Kubernetes (set multiple replicas) + Nginx, use online normalization, combine encoder dimensionality reduction, utilize the discriminant network to output probability p, and trigger an alarm when max(p) ≥ 0.85 and the category is an attack. This process can achieve millisecond-level intrusion detection in the production network and support continuous model updates.
Claims
1. A network intrusion detection method for enhancing the recognition ability of minority class data, characterized in that The specific steps of this method are as follows: S1. Based on an open-source network intrusion dataset containing various attack types and normal traffic, perform preliminary preprocessing on the dataset. Among them, the data standardization step uses the Yeo-Johnson algorithm for processing, and then divide the preprocessed data into a training set, a validation set, and a test set; S2. Use an improved tabular generative adversarial network to perform data augmentation on the minority-class traffic data in the training set. Among them, the generator of the tabular generative adversarial network is designed as a structure of multi-layer transposed convolution upsampling, and the discriminator is designed as a structure of multi-layer convolution downsampling. In addition, a classifier structure is newly added outside the generator-discriminator structure to ensure the consistency of the separability of synthetic samples on the target column, improve the performance of the supervision task, and increase the proportion of minority-class data in the training set; S3. Combine the autoencoder structure with the self-attention mechanism to perform dimensionality reduction on the enhanced network traffic data. Among them, the decoder and encoder of the autoencoder are symmetric three-layer linear layer structures, and self-attention weights are applied to the low-dimensional bottleneck vectors compressed by the encoder in the autoencoder structure. By using the method of end-to-end training of mean squared error to synchronously optimize all weights, obtain the low-dimensional representation of the original data, thereby reducing the subsequent model calculation overhead. After experimental verification, the dimension of the bottleneck layer data obtained can be compressed to a minimum of 7% of the original data dimension; S4. A parallel one-dimensional convolution - bidirectional gated recurrent unit, which is designed to extract the spatio-temporal features of network traffic data, is trained on the training set after minority-class traffic data augmentation and data dimensionality reduction, and the model hyperparameters are adjusted on the divided validation set; S5. Combine the test set divided in S1 to evaluate the trained parallel one-dimensional convolution - bidirectional gated recurrent unit model, and use precision, accuracy, false alarm rate, and F1-Score as evaluation indicators to obtain the final performance of the model, and combine the model into a real production environment for testing.
2. The network intrusion detection method for enhancing the recognition ability of minority class data according to claim 1, wherein The step S1 mainly includes the following parts: S11. Remove interfering data: Use the pandas data processing library to remove the Infinity values and null values (Null values) existing in the dataset, and use the sklearn library to perform one-hot encoding on the categorical data in the dataset; S12. Use the Yeo-Johnson algorithm to limit the numerical data in the dataset within the range of [-1, 1]. The Yeo-Johnson calculation formula is as follows: In the formula, λ can take any real number. After determining the appropriate λ using maximum likelihood estimation, use this algorithm to process the numerical data in the preprocessed dataset, distribute the data values within [-1, 1], and then divide the data into a training set, a validation set, and a test set according to a certain proportion.
3. A network intrusion detection method for enhancing the recognition ability of minority class data according to claim 1, characterized in that The step S2 mainly includes the following parts: S21. One-dimensional feature two-dimensionalization and transposed convolution-based generation-discrimination architecture: First, pad zeros at the end of the feature vector x ∈ R of length d to make the length of the feature vector become d where that is, take the smallest integer n that satisfies n ≥ d, and then reshape the data into a single-channel square matrix of n × n; Subsequently, using this two-dimensional matrix as the input, conduct adversarial training with a transposed convolution generator and a convolutional discriminator. The output size calculation formula for the L-th layer of multi-layer transposed convolution upsampling is H 2 =(H l+1 -1)s l -2p l +k l +op l , W l =(W l+1 -1)s l -2p l +k l +op l +op l where s l , p l , k l , and op l are the step size, padding size, convolutional kernel size, and padding size of the output data respectively. The calculation formula for discriminator convolutional downsampling is as follows: where v (l) performs convolution on the previous layer's feature map q l BN is BatchNorm normalization, and d (l) is the added bias. By the mutual cooperation of the transposed convolution generator and the convolutional discriminator, high-order feature correlations are captured to improve the quality of synthetic samples; S22. Classifier Module: Outside the convolutional generative-discriminative network, a classifier for downstream classification tasks is introduced. The classifier structure is designed as a stack of multiple linear layers. To prevent overfitting and vanishing gradients, batch normalization and LeakRelu operations are performed after each linear layer. At the last layer, the output is compressed into one dimension and the Sigmoid activation is applied. Subsequently, the classification errors of the classifier on real samples and synthetic samples are both backpropagated to the generator to jointly optimize the generation quality and label consistency: In the formula, the first term is the adversarial loss, and the second term is the classifier loss. By forcing the generated samples to be correctly recognized by the discriminator on the target column, the generated samples are forced to be as consistent with the real samples as possible; S23. Minority Class Fidelity Mechanism: A sampling strategy based on logarithmic frequency is adopted in the conditional vector sampling stage: When generating the conditional vector, the selected column C is sampled by category according to the logarithmic frequency, and the sampled category is written into the conditional vector C in one-hot form. Since the logarithmic transformation compresses the high-frequency counts, the probability of sampling the minority class is relatively increased, and the low-frequency categories are preferentially selected in the training batch to ensure that the generator fully learns the minority class distribution; S24. Inverse Two-Dimensional Reduction Module: During the generation stage, the two-dimensional matrix output by the convolutional generator is restored to a one-dimensional vector of length n through a flattening operation, and the first d valid features are intercepted; if n 2 > d, the zero-padding positions in the early stage are automatically discarded to maintain consistency with the original feature dimension and provide a consistent input for subsequent activation mapping and label splicing. 2 4. A network intrusion detection method for enhancing the recognition ability of minority class data according to claim 1, characterized in that Step S4 mainly includes the following parts: S41: Encoding and compression operation, where the original feature vector X ∈ R d is input into a three-layer linear mapping network. The weight matrices of each layer are denoted as W1, W2, and W3 in sequence, and the ReLU activation function is adopted. After successive compression, the bottleneck layer representation Z ∈ R r can be obtained, where r is much smaller than d, thereby obtaining the bottleneck layer data; S42: Self-attention weighting, linearly transform Z into query Q, key K, and value V respectively, calculate dot-product attention weights, and obtain a weighted bottleneck vector S43: The obtained bottleneck layer vector Enter the decoder part of the autoencoder for iterative training. Use the mean square error as the main optimization objective, and synchronously update the parameters of the encoder, decoder, and attention layer to convergence through backpropagation. With this structure, the data compression ratio d:r can be flexibly selected, and the addition of the attention mechanism is beneficial to globally model the data on the bottleneck layer. The data after low-dimensional representation is conducive to reducing the training cost of subsequent models.
5. The network intrusion detection method for enhancing the recognition ability of minority class data according to claim 1, characterized in that, Step S5 mainly includes the following parts: S51. Convolution Branch: On the enhanced training set, two levels of "convolution-activation-convolution-activation-max pooling" operations are successively applied to each one-dimensional feature sequence. The convolution kernel size decreases layer by layer from large to small to extract features of different scales, and the number of channels increases gradually. After the output is processed by batch normalization, Dropout and flattening, it is sent to a fully connected layer to generate a local feature vector; S52. Bidirectional Gated Recurrent Unit Branch: In parallel with the convolution branch, the same input sequence is sent into a stacked bidirectional gated recurrent unit to extract the forward and backward temporal context information, which is concatenated at the last time step to form a global temporal representation; after this representation is processed by batch normalization and dropout, it is compressed by a fully connected layer into a low-dimensional temporal feature vector; S53. Feature Fusion and Classification: The low-dimensional feature vectors output by the convolution branch and the bidirectional gated recurrent unit branch are concatenated at the feature dimension to form a fused feature; then the fused feature is sent into a linear classifier to output a probability vector consistent with the number of network intrusion traffic types, and end-to-end training is performed with cross-entropy loss.
6. The network intrusion detection method for enhancing the recognition ability of minority class data according to claim 1, characterized in that, The specific implementation steps of S6 are as follows: S61. Training and Hyperparameter Tuning: The parallel network is jointly trained on the minority class enhanced training set obtained in step S4, and based on the pre-divided validation set, parameters such as convolution kernels are adjusted to obtain the best parameter combination to ensure that the model fully fits the enhanced data and improves the detection ability for the minority class.