Network intrusion detection incremental learning method, system and device based on dynamic hypersphere integration, and storage medium

Abstract

The invention discloses a network intrusion detection incremental learning method, system and device based on dynamic hypersphere integration and a storage medium, and belongs to the technical field of information security technologies, and the method comprises the steps: obtaining network flow data, carrying out the feature processing, and forming a standardized feature vector set; constructing a hypersphere set model, dividing the standardized feature vector set into a plurality of subsets according to categories, and constructing a corresponding hypersphere set model based on a neighbor distance; unknown network traffic samples are classified in real time, the distance between the current sample and the center of the hypersphere of each subset is calculated and compared with the corresponding radius, a classification result is determined according to a preset judgment rule for decision fusion, and a final judgment label is output; and executing dynamic updating of the hyper-sphere set model based on the cached samples, reconstructing a new hyper-sphere set by utilizing the cached samples when the number of cached new samples reaches a preset threshold value, and replacing part of hyper-spheres in the hyper-sphere set model with the new hyper-sphere set to complete self-adaptive dynamic updating.

Description

Technical Field

[0001] The present invention relates to the technical field of information security technology, and in particular to a network intrusion detection incremental learning method, system, device and storage medium based on dynamic hypersphere integration. Background Art

[0002] Network traffic data is continuously generated. Quickly identifying network intrusion traffic data from massive traffic data is an important part of ensuring the security of network devices. This requires the model to be able to quickly and effectively adapt to the dynamic data environment.

[0003] Traditional network intrusion detection methods (such as signature-based detection, fixed-threshold classifiers, and shallow machine learning models) rely on predefined attack signatures or static model parameters. Their core flaw is their inability to effectively address the dynamic evolution of unknown attacks. Specifically, static models, relying on offline training data distribution, struggle to capture new attack patterns in real time. This leads to delayed detection and requires frequent manual intervention to update the signature library, significantly increasing operational costs.

[0004] Furthermore, while existing incremental learning methods (such as online learning frameworks based on full retraining) attempt to alleviate the model update problem, their redundant computational overhead and sensitivity to concept drift limit detection efficiency, particularly in scenarios with high-dimensional network traffic and complex temporal characteristics, which can easily lead to model performance degradation. More seriously, traditional approaches often face a trade-off between false positives and false negatives: while loose threshold policies can reduce false negatives, they significantly increase the misclassification rate of normal traffic (e.g., sudden traffic spikes being mislabeled as DDoS attacks); while strict thresholds reduce false positives but sacrifice attack detection coverage. Furthermore, while deep learning-based detection systems (such as LSTM and CNN) excel at processing temporal traffic characteristics, their high computational complexity is difficult to reconcile with real-time requirements, limiting their application in resource-constrained environments (such as edge nodes).

[0005] These shortcomings collectively highlight the shortcomings of existing technologies in terms of dynamic adaptability, computational efficiency, and detection robustness. A new solution that balances real-time updates, lightweight computation, and adaptive decision-making is urgently needed. To this end, this paper proposes an incremental learning framework based on dynamic hypersphere ensembles. Through multi-model collaborative optimization and a lightweight distance metric mechanism, it systematically overcomes these technical bottlenecks. Summary of the Invention

[0006] To solve the above technical problems, a network intrusion detection incremental learning method based on dynamic hypersphere integration is proposed, which includes acquiring network traffic data and performing feature processing to form a standardized feature vector set;

[0007] Construct a hypersphere set model, divide the standardized feature vector set into several subsets according to category, and construct the corresponding hypersphere set model based on the nearest neighbor distance between samples in each subset;

[0008] Classify unknown network traffic samples in real time, calculate the distance between the current sample and the center of each subset hypersphere and compare it with the corresponding radius, and determine the classification result according to the preset judgment rules;

[0009] Decision fusion is performed based on the classification results. The classification results from each subset model are integrated through the majority voting strategy to output the final judgment label.

[0010] The hypersphere set model is dynamically updated based on cached samples. When the number of cached new samples reaches a preset threshold, a new hypersphere set is reconstructed using the cached samples, and some hyperspheres in the hypersphere set model are replaced by the new hypersphere set to complete the adaptive dynamic update of the hypersphere set model.

[0011] As a preferred solution of the network intrusion detection incremental learning method based on dynamic hypersphere integration described in the present invention, wherein: the acquisition of network traffic data and feature processing includes:

[0012] The categorical features in network traffic data are converted into corresponding numerical features using category mapping encoding. The mean and standard deviation of continuous features are calculated and normalized using the standardization formula. After completing the data standardization of different types of features, all features are unified into a standardized feature vector set.

[0013] As a preferred solution of the network intrusion detection incremental learning method based on dynamic hypersphere integration described in the present invention, wherein: the construction of the hypersphere set model includes:

[0014] The standardized feature vector set is divided into multiple data subsets by category, and based on the samples in each data subset, the nearest neighbor sample set of each sample is calculated using the nearest neighbor search method. According to the Euclidean distance between the samples in the nearest neighbor sample set and the current sample, the average distance is calculated as the radius of the hypersphere. The current sample feature vector is used as the center of the hypersphere, and the corresponding hyperspheres are constructed in sequence. The hypersphere sets constructed in each subset are merged to form a complete hypersphere set model.

[0015] As a preferred solution of the network intrusion detection incremental learning method based on dynamic hypersphere integration described in the present invention, wherein: the real-time classification of unknown network traffic samples includes:

[0016] By calculating the Euclidean distance between the sample to be classified and the center of each hypersphere in the hypersphere set model, and calculating the ratio of the distance to the corresponding hypersphere radius, the ratio is compared with a preset fixed threshold or a dynamic threshold calculated based on historical data.

[0017] As a preferred solution of the network intrusion detection incremental learning method based on dynamic hypersphere integration described in the present invention, wherein: the dynamic update of the hypersphere set model based on cache samples includes:

[0018] When the number of new samples stored in the cache reaches a preset threshold, the samples stored in the cache are subjected to feature normalization, and the same neighbor calculation method as that used in the initial model construction is used to redetermine the center and radius of the hypersphere, construct a new hypersphere set, and complete the update of the hypersphere set model by replacing some of the hypersphere sets in the hypersphere set model.

[0019] As a preferred solution of the network intrusion detection incremental learning method based on dynamic hypersphere integration described in the present invention, wherein: the real-time classification of unknown network traffic samples includes:

[0020] For samples to be classified, in the hypersphere set model, hyperspheres with the same historical characteristic distribution as the samples to be classified are preferentially selected for distance calculation. This reduces the computational complexity by narrowing the comparison range. After completing the local hypersphere comparison, the global distance determination is performed.

[0021] Determining the classification result according to the preset judgment rules includes:

[0022] If the ratio is less than the threshold, it is determined to be a known category, and classification is completed by determining the category corresponding to the center of the hypersphere with the smallest distance; if the ratio is greater than the threshold, it is determined to be a new category.

[0023] As a preferred solution of the network intrusion detection incremental learning method based on dynamic hypersphere integration described in the present invention, wherein: the dynamic update of the hypersphere set model based on cache samples also includes:

[0024] According to the characteristic change trend of the cache samples, the center sample and radius of each hypersphere in the hypersphere set model are adjusted. The coverage of the hypersphere set is dynamically adjusted by replacing aging hyperspheres or increasing the radius of existing hyperspheres.

[0025] Another object of the present invention is to provide an incremental learning system for network intrusion detection based on dynamic hypersphere integration. This system addresses the problems of existing network intrusion detection methods, such as insufficient ability to identify unknown attacks, low model update efficiency, prominent contradictions between false positives and missed positives, and difficulty in balancing real-time performance and computing resource constraints. By introducing technical means such as dynamic hypersphere model construction, real-time classification decision-making, multi-model fusion, and model adaptive updating, it achieves rapid identification and classification of new network attacks, improves the accuracy and response speed of the detection system, and reduces computing resource consumption. It is suitable for complex and changing network environments and resource-constrained edge computing scenarios.

[0026] As a preferred solution of the network intrusion detection incremental learning system based on dynamic hypersphere integration described in the present invention, it is characterized by including a feature processing module, a hypersphere model construction module, a real-time classification and decision module, and a dynamic model update module;

[0027] The feature processing module extracts multidimensional features from network traffic data and performs format conversion and normalization on different types of features through a unified data standardization method to generate a standardized feature vector set;

[0028] The hypersphere model construction module is based on the standardized feature vector set, by dividing the categories and calculating the nearest neighbor relationship, determining the center and radius of the hypersphere, and constructing the hypersphere set model;

[0029] The real-time classification and decision module performs distance calculation and threshold judgment on the network traffic samples to be classified based on the hypersphere model, and determines the final classification result through majority voting to effectively identify known categories and new categories;

[0030] The dynamic model updating module reconstructs part of the hypersphere set based on new samples, and replaces and adjusts the hypersphere set model when the cached samples meet the preset conditions.

[0031] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the incremental learning method for network intrusion detection based on dynamic hypersphere integration are implemented.

[0032] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a network intrusion detection incremental learning method based on dynamic hypersphere integration.

[0033] Beneficial effects of the present invention: The present invention is based on the unsupervised clustering characteristics of dynamic hypersphere integration. It does not need to rely on a predefined attack feature library and can directly identify new attack patterns from network traffic, breaking through the limitations of traditional methods that rely on artificial feature engineering. Sub-datasets are generated through self-service sampling, and only local parameter optimization is performed on the dynamic hypersphere set to avoid retraining of the full model. At the same time, redundant updates are reduced through the buffer trigger mechanism to adapt to the real-time requirements of high-frequency traffic changes. The multi-hypersphere voting classification strategy is combined with the confidence adaptive threshold adjustment. Strict judgment rules are used for known attack categories to reduce the missed reporting rate, and unknown samples are made through integrated consensus decisions to avoid misjudgment of normal traffic. Hypersphere distance calculation is used to replace complex deep learning models, which is suitable for low-power scenarios of edge computing devices (such as firewalls and routers). BRIEF DESCRIPTION OF THE DRAWINGS

[0034] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0035] Figure 1 An overall flow chart of an incremental learning method for network intrusion detection based on dynamic hypersphere integration is provided in one embodiment of the present invention. DETAILED DESCRIPTION

[0036] To make the above-mentioned objects, features, and advantages of the present invention more clearly understood, the following detailed description of the specific embodiments of the present invention is given in conjunction with the accompanying drawings. It is obvious that the described embodiments are only part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in this field without creative work should fall within the scope of protection of the present invention.

[0037] Example 1, with reference to Figure 1 This is the first embodiment of the present invention, which provides a network intrusion detection incremental learning method based on dynamic hypersphere integration, including:

[0038] S1. Obtain network traffic data and perform feature processing to form a standardized feature vector set.

[0039] The categorical features in network traffic data are converted into corresponding numerical features using category mapping encoding. The mean and standard deviation of continuous features are calculated and normalized using the standardization formula. After completing the data standardization of different types of features, all features are unified into a standardized feature vector set.

[0040] 1) Basic connection characteristics: connection duration (seconds), protocol type, target host service type, and connection status;

[0041] 2) Traffic characteristics: the number of data bytes from the source host to the destination host, the number of data bytes from the destination host to the source host, and whether it is a local connection (1 = yes, 0 = no);

[0042] 3) Error and anomaly characteristics: number of incorrect fragments, number of emergency data packets, number of sensitive files or directories accessed, number of login failures, whether the login was successful (1=yes, 0=no), number of times the target host was attacked, whether a root shell was obtained (1=yes, 0=no), whether the su command was attempted (1=yes, 0=no), number of root user operations, number of file creations, number of shell startups, number of control file accesses, number of outbound commands, whether it was a hosts.equiv login (1=yes, 0=no), whether it was a guest login (1=yes, 0=no)

[0043] 4) Time window statistical features: number of connections identical to the current connection in the past 2 seconds, number of connections identical to the current service in the past 2 seconds, SYN error ratio in connections in the past 2 seconds, SYN error ratio for the same service, REJ error ratio in connections in the past 2 seconds, REJ error ratio for the same service, connection ratio for the same service in the past 2 seconds, connection ratio for different services in the past 2 seconds, and connection ratio for the same service but different destination hosts

[0044] 5) Target host statistical characteristics: number of connections with the same target host in the top 100 connections, number of connections with the same service as the target host in the top 100 connections, connection ratio of the target host with the same service, connection ratio of the target host with different services, connection ratio of the target host with the same source port, connection ratio of the target host with the same service but different source hosts, SYN error ratio of the target host, SYN error ratio of the target host with the same service, REJ error ratio of the target host, and REJ error ratio of the target host with the same service.

[0045] The above features are combined with the actual connection type (normal or attack type such as denial of service attack) corresponding to each traffic data to obtain the initial training data set.

[0046] Standardization: For the initial data set above, the z-score method is used to standardize the continuous data. The formula is as follows:

[0047]

[0048] Where x is the original eigenvalue, μ and σ are the mean and standard deviation respectively, and x normis the standardized feature value, and N is the number of samples in the data set. The processed data set is x i is the eigenvector of the i-th sample, y i is the label of the i-th sample, and the possible values ​​of the label are [1,2,3,…,K}, where K is the number of known categories.

[0049] S2. Construct a hypersphere set model, divide the standardized feature vector set into several subsets according to category, and construct the corresponding hypersphere set model based on the nearest neighbor distance between the samples in each subset.

[0050] The standardized feature vector set is divided into multiple data subsets by category, and based on the samples in each data subset, the nearest neighbor sample set of each sample is calculated using the nearest neighbor search method. According to the Euclidean distance between the samples in the nearest neighbor sample set and the current sample, the average distance is calculated as the radius of the hypersphere. The current sample feature vector is used as the center of the hypersphere, and the corresponding hyperspheres are constructed in sequence. The hypersphere sets constructed in each subset are merged to form a complete hypersphere set model.

[0051] The current steps in a preferred embodiment of the present invention are:

[0052] Real-time detection and identification of new categories of network traffic attack types based on hypersphere sets. Existing methods use random trees to identify new categories, which are highly random and easily lead to false positive judgments for new category samples. In addition, the tree-based method is not very effective for identifying known categories. The advantages of this patent solution in identifying new categories based on hypersphere sets are two-fold. First, the hypersphere set is constructed based on the k-nearest neighbor method, which can fully explore the local neighborhood information of the feature space, reduce false positive results and improve the recognition rate of known category samples. Second, the hypersphere set can be easily updated. Replacing outdated samples with new samples can ensure that the model quickly adapts to the new data environment. The following first introduces how to construct a hypersphere set.

[0053] After obtaining the processed data set D, traverse each known category and perform sampling without replacement for all samples belonging to category k. Sample A samples from each category to obtain a data subset containing A×K samples. Repeat the above sampling process B times on the data set D to generate B data subsets D i ,i=1,…,B, each subset contains A×K samples (A is the number of single-class samples, K is the number of known categories).

[0054] Traverse all data subsets D i ,i=1,…,B, for each subset D i , construct a hypersphere set based on the k-nearest neighbor algorithm:

[0055] Traverse the data subset D i Each sample (x j ,y j ), calculate x j With D i All with y j The Euclidean distance of samples with the same label, and sort the samples from small to large according to the distance, denoted by η l (x j ) is the distance x j The most recent lth and y j Feature vectors of samples with the same label.

[0056] Calculate the radius of the hypersphere:

[0057]

[0058] Where L is the predefined number of neighbors, r(x j ) is x j The radius of the hypersphere centered on . Based on this, the hypersphere can be defined as:

[0059] h(x j ,r(x j ),y j )=[x:||xx j ||≤r(x j )}

[0060] where || xx j || represents the eigenvector x and x j The Euclidean distance, h(x j ,r(x j )) indicates x j As the center, r(x j ) is the radius, y j A hypersphere with the label x j For each sample, a hypersphere can be constructed, so each data subset D i A subset hypersphere set can be constructed: Where ∪ represents the union operation, H i Represents the data subset D i The subset hypersphere set constructed is based on D i The union of the hyperspheres constructed for each sample.

[0061] Merge all subset hypersphere sets to form the initial hypersphere set H is the union of all subset hypersphere sets, and ∪ represents the union operation.

[0062] The current step in another optional embodiment of the present invention is based on a Gaussian mixture model.

[0063] First, the standardized network traffic feature vector set is divided into categories. For each category of sample data, a Gaussian mixture sub-model is trained to characterize the probability density distribution of that category in the feature space. During parameter training, the Gaussian sub-models corresponding to multiple categories are collaboratively optimized using the expectation-maximization (EM) algorithm. Ultimately, a joint GMM classification model is formed. This model compares the probability responses of the test sample in each category model using the maximum likelihood principle and selects the category with the highest response as the classification result.

[0064] This solution has certain advantages in modeling capabilities, especially when processing data with continuous distribution characteristics, it can approximate any complex distribution through multiple Gaussian components, and has a certain degree of flexibility. However, in the context of network intrusion detection applications in which the present invention is located, this solution still has three shortcomings.

[0065] First, GMM is a generative model based on parameter fitting, relying on the assumption that sample features conform to an approximately Gaussian distribution in space. However, in real-world network traffic, different types of attack traffic often exhibit asymmetry, segmented sparsity, and significant multimodality. This makes the Gaussian assumption invalid in many categories, resulting in reduced modeling accuracy and limited classification performance.

[0066] Secondly, this solution faces a fundamental obstacle in identifying samples from new categories. As a closed ensemble model, the GMM lacks the ability to determine whether a sample belongs to any known category. For new attack samples that constantly appear in real systems, if their characteristics have low response probabilities across all trained sub-models, the GMM cannot clearly determine that they belong to an "unknown category" and may misclassify them as existing marginal categories, thus compromising the robustness of the detection system.

[0067] Finally, GMM needs to re-execute global parameter estimation when updating the model. Even if only some categories are updated or new categories are introduced, the EM algorithm needs to be re-run and multiple rounds of iterative optimization need to be performed. This global coupled optimization is not suitable for frequently updated data scenarios, especially in resource-constrained network edge devices.

[0068] In contrast, the present invention adopts a multi-subset hypersphere set model based on k-nearest neighbor construction, which can accurately characterize the local structure of samples in the feature space in a non-parametric, locally constructed manner. By constructing a hypersphere model with a limited center and radius for subset samples, a classification unit with the ability to perceive spatial boundaries can be formed. At the same time, with the help of a ratio judgment mechanism, it is possible to effectively determine whether a sample belongs to a certain category in the training set, thereby realizing the recognition of new categories. In addition, the hypersphere set structure has good modular characteristics. When new samples appear, partial hyperspheres can be incrementally constructed and replaced to update the model, without the need for global retraining of the overall structure, thereby greatly improving the model update efficiency and online application capabilities.

[0069] In summary, compared with the GMM-based modeling approach, the hypersphere set modeling scheme of the present invention is not only applicable to more complex, non-Gaussian distributed network data, but also can better balance the ability to identify new attacks and the need for low-overhead model maintenance.

[0070] S3. Classify unknown network traffic samples in real time, calculate the distance between the current sample and the center of each subset hypersphere and compare it with the corresponding radius, and determine the classification result according to the preset judgment rules.

[0071] By calculating the Euclidean distance between the sample to be classified and the center of each hypersphere in the hypersphere set model, and calculating the ratio of the distance to the corresponding hypersphere radius, the ratio is compared with a preset fixed threshold or a dynamic threshold calculated based on historical data.

[0072] After the hypersphere set is trained, a multi-model voting mechanism is used to achieve real-time monitoring and classification of network traffic. Given an unknown traffic sample, its distance to the center of all hyperspheres is first calculated and compared with the corresponding radius. If the ratio of distance to radius exceeds a predefined threshold t, the sample is judged to be a new category NC. Otherwise, the sample is considered to be a known category and the category judgment is performed using the nearest neighbor method. That is, based on the calculated distance, the sample closest to the sample (i.e., the center of the hypersphere) is found, and the label of the hypersphere is then judged as the category of the test sample. The above process is repeated B times (for a total of B data subsets or subset hypersphere sets), and finally a majority voting mechanism is used to fuse the B predictions as the final judgment.

[0073] For an unknown network traffic sample x, its distance in the B subset hypersphere sets is calculated in parallel and compared with the corresponding radius:

[0074]

[0075] in, f i (x) is the category prediction result of the i-th subset hypersphere for the test sample x, and t is a predefined threshold.

[0076] Finally, the B prediction results are fused through majority voting to output the final classification label:

[0077]

[0078] Where F(x) is the category prediction result of the hypersphere set for the test sample x, k∈{1,2,…,K,NC}, δ(α,β) is the indicator function, that is, it takes the value of 1 when α=β and otherwise takes the value of 0.

[0079] S4. Decision fusion is performed based on the classification results. The classification results from each subset model are integrated through the majority voting strategy to output the final judgment label.

[0080] S5. Perform dynamic update of the hypersphere set model based on the cached samples. When the number of new cached samples reaches a preset threshold, reconstruct a new hypersphere set using the cached samples, and replace some hyperspheres in the hypersphere set model with the new hypersphere set to complete the adaptive dynamic update of the hypersphere set model.

[0081] When the number of new samples stored in the cache reaches a preset threshold, the samples stored in the cache are subjected to feature normalization, and the same neighbor calculation method as that used in the initial model construction is used to redetermine the center and radius of the hypersphere, construct a new hypersphere set, and complete the update of the hypersphere set model by replacing some of the hypersphere sets in the hypersphere set model.

[0082] For samples to be classified, in the hypersphere set model, hyperspheres with the same historical characteristic distribution as the samples to be classified are preferentially selected for distance calculation. This reduces the computational complexity by narrowing the comparison range. After completing the local hypersphere comparison, the global distance determination is performed.

[0083] Determining the classification result according to the preset judgment rules includes:

[0084] If the ratio is less than the threshold, it is determined to be a known category, and classification is completed by determining the category corresponding to the center of the hypersphere with the smallest distance; if the ratio is greater than the threshold, it is determined to be a new category.

[0085] According to the characteristic change trend of the cache samples, the center sample and radius of each hypersphere in the hypersphere set model are adjusted. The coverage of the hypersphere set is dynamically adjusted by replacing aging hyperspheres or increasing the radius of existing hyperspheres.

[0086] In a preferred embodiment of the present invention, adaptive dynamic updating involves storing each unknown traffic sample in a cache if it is classified as a new class. When the cache is full (for example, the cache size is set to 200 samples), the labels of all samples in the cache are assigned to NC and the cache is cleared. All subset hypersphere sets are checked, and if any subset hypersphere set contains a hypersphere classified as NC, it is removed:

[0087]

[0088] in is the set of samples of category NC in the i-th subset, and the operator - refers to the set difference, that is, from the set H i Remove h(x j ,r(x j ),y j Then, all samples in the buffer are used to construct the subset hypersphere set And blend it with the existing subset hypersphere set:

[0089]

[0090] Traverse all subset hypersphere sets to complete this round of update. The updated hypersphere set is:

[0091]

[0092] The above update mechanism can ensure that the model maintains a fixed-size set of hyperspheres, thereby ensuring efficient operation, and can ensure that the model adapts to the dynamically changing data environment through adaptive updates.

[0093] An optional embodiment of the present invention for adaptive dynamic updating is to use a cyclic training and update mechanism based on a sliding time window. Specifically, during operation, the system continuously records network traffic samples and their predicted classification results. After a fixed time interval, it automatically uses the samples collected in the current time period as a new round of training data to replace the earliest batch of samples in the training set, forming a data window that continuously rolls over time. This window always maintains a fixed sample capacity to ensure that the training overhead of model updates is controllable. The system will use the new data within the time window to retrain the classification model and regularly replace the original model, thereby achieving rolling updates of the model over time.

[0094] The cyclic training and update mechanism based on a sliding time window has a certain degree of "data-driven self-update" capability, automatically adjusting model training data as the network environment changes. In theory, this helps to address temporal drift in data distribution. However, this solution has several limitations in the network intrusion detection application involved in this invention.

[0095] First, this approach is essentially a periodic full-replacement update, requiring the complete model to be retrained for each update. For environments with limited computing resources (such as edge nodes), this approach can easily cause periodic surges in computing load, making it difficult to guarantee real-time response performance. Furthermore, when the distribution of new samples has a low degree of overlap with old samples, this approach can easily lead to the forgetting of important historical category information. This is especially true in scenarios where the proportion of attack samples is extremely low and they appear sparsely over time. This can cause the model to "fade out of memory" for some attack categories, leading to the risk of underreporting.

[0096] Secondly, this approach cannot precisely control the scope of the update and lacks a "targeted replacement" mechanism. For example, even when only a few new class samples appear, the entire classification model must be rebuilt. This is not only computationally expensive but also impacts model stability, easily causing drastic changes in classification boundaries and affecting system reliability.

[0097] In response to the above problems, the present invention proposes a local update mechanism driven by cached samples. By setting up a sample cache area, new samples to be confirmed are accumulated, and the update operation is triggered when the cache area is full. During the update process, no full retraining is performed. Instead, after the cache area samples are standardized, a new hypersphere set is constructed using the same neighbor strategy as the initial model, and only some subset structures in the current hypersphere set model that conflict with the new sample category or have degraded performance are replaced. This update method has good local replaceability and computational lightness, does not rely on global training or time window operations, is suitable for frequently changing data environments, and can retain historical category representations to prevent information from being forgotten.

[0098] Therefore, compared with the model update method based on time sliding window, the cache-driven + local replacement strategy adopted in the present invention has significant advantages in update efficiency, model stability and sensitivity to abnormal attack samples. It is suitable for network intrusion detection tasks in diverse scenarios and is a more practical and engineering-adaptive dynamic incremental learning solution.

[0099] Example 2 is the second embodiment of the present invention, which is different from the previous embodiment in that:

[0100] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0101] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0102] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0103] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one or combination of the following technologies known in the art can be used: a discrete logic circuit having logic gate circuits for implementing logic functions on data signals, an application-specific integrated circuit having suitable combinational logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0104] Example 3 is the third embodiment of the present invention, which provides a network intrusion detection incremental learning system based on dynamic hypersphere integration, including a feature processing module, a hypersphere model construction module, a real-time classification and decision module, and a dynamic model update module;

[0105] The feature processing module extracts multidimensional features from network traffic data and performs format conversion and normalization on different types of features through a unified data standardization method to generate a standardized feature vector set.

[0106] The hypersphere model construction module is based on the standardized feature vector set, by dividing the categories and calculating the nearest neighbor relationship, determining the center and radius of the hypersphere, and constructing the hypersphere set model;

[0107] The real-time classification and decision module performs distance calculation and threshold judgment on the network traffic samples to be classified based on the hypersphere model, and determines the final classification result through majority voting to effectively identify known categories and new categories;

[0108] The dynamic model updating module reconstructs part of the hypersphere set based on new samples, and replaces and adjusts the hypersphere set model when the cached samples meet the preset conditions.

[0109] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network intrusion detection incremental learning method based on dynamic hypersphere integration, characterized by: include, Obtain network traffic data and perform feature processing to form a standardized feature vector set; Construct a hypersphere set model, divide the standardized feature vector set into several subsets according to category, and construct the corresponding hypersphere set model based on the nearest neighbor distance between samples in each subset; Classify unknown network traffic samples in real time, calculate the distance between the current sample and the center of each subset hypersphere and compare it with the corresponding radius, and determine the classification result according to the preset judgment rules; Based on the classification results, decision fusion is performed, and the classification results from each subset model are integrated through the majority voting strategy to output the final judgment label; The hypersphere set model is dynamically updated based on cached samples. When the number of cached new samples reaches a preset threshold, a new hypersphere set is reconstructed using the cached samples, and some hyperspheres in the hypersphere set model are replaced by the new hypersphere set to complete the adaptive dynamic update of the hypersphere set model.

2. The network intrusion detection incremental learning method based on dynamic hypersphere integration according to claim 1, characterized in that: The obtaining of network traffic data and performing feature processing includes: The categorical features in network traffic data are converted into corresponding numerical features using category mapping encoding. The mean and standard deviation of continuous features are calculated and normalized using the standardization formula. After completing the data standardization of different types of features, all features are unified into a standardized feature vector set.

3. The incremental learning method for network intrusion detection based on dynamic hypersphere integration according to claim 2, characterized in that: The constructing of the hypersphere set model includes: The standardized feature vector set is divided into multiple data subsets by category, and based on the samples in each data subset, the nearest neighbor sample set of each sample is calculated using the nearest neighbor search method. According to the Euclidean distance between the samples in the nearest neighbor sample set and the current sample, the average distance is calculated as the radius of the hypersphere. The current sample feature vector is used as the center of the hypersphere, and the corresponding hyperspheres are constructed in sequence. The hypersphere sets constructed in each subset are merged to form a complete hypersphere set model.

4. The incremental learning method for network intrusion detection based on dynamic hypersphere integration according to claim 3, characterized in that: The real-time classification of unknown network traffic samples includes: By calculating the Euclidean distance between the sample to be classified and the center of each hypersphere in the hypersphere set model, and calculating the ratio of the distance to the corresponding hypersphere radius, the ratio is compared with a preset fixed threshold or a dynamic threshold calculated based on historical data.

5. The network intrusion detection incremental learning method based on dynamic hypersphere integration according to claim 4 is characterized in that: The dynamic update of the hypersphere set model based on the cached samples includes: When the number of new samples stored in the cache reaches a preset threshold, the samples stored in the cache are subjected to feature normalization, and the same neighbor calculation method as that used in the initial model construction is used to redetermine the center and radius of the hypersphere, construct a new hypersphere set, and complete the update of the hypersphere set model by replacing some of the hypersphere sets in the hypersphere set model.

6. The network intrusion detection incremental learning method based on dynamic hypersphere integration according to claim 4, characterized in that: The real-time classification of unknown network traffic samples includes: For samples to be classified, in the hypersphere set model, hyperspheres with the same historical characteristic distribution as the samples to be classified are preferentially selected for distance calculation. This reduces the computational complexity by narrowing the comparison range. After completing the local hypersphere comparison, the global distance determination is performed. Determining the classification result according to the preset judgment rules includes: If the ratio is less than the threshold, it is determined to be a known category, and classification is completed by determining the category corresponding to the center of the hypersphere with the smallest distance; if the ratio is greater than the threshold, it is determined to be a new category.

7. The network intrusion detection incremental learning method based on dynamic hypersphere integration as claimed in claim 5, characterized in that: The method of dynamically updating the hypersphere set model based on the cached samples further includes: According to the characteristic change trend of the cache samples, the center sample and radius of each hypersphere in the hypersphere set model are adjusted. The coverage of the hypersphere set is dynamically adjusted by replacing aging hyperspheres or increasing the radius of existing hyperspheres.

8. A network intrusion detection incremental learning system based on dynamic hypersphere integration, applying the network intrusion detection incremental learning method based on dynamic hypersphere integration according to any one of claims 1 to 7, characterized in that: It includes: feature processing module, hypersphere model building module, real-time classification and decision module and dynamic model updating module; The feature processing module extracts multidimensional features from network traffic data and performs format conversion and normalization on different types of features through a unified data standardization method to generate a standardized feature vector set; The hypersphere model construction module is based on the standardized feature vector set, by dividing the categories and calculating the nearest neighbor relationship, determining the center and radius of the hypersphere, and constructing the hypersphere set model; The real-time classification and decision module performs distance calculation and threshold judgment on the network traffic samples to be classified based on the hypersphere model, and determines the final classification result through majority voting to effectively identify known categories and new categories; The dynamic model updating module reconstructs part of the hypersphere set based on new samples, and replaces and adjusts the hypersphere set model when the cached samples meet the preset conditions.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the processor implements the steps of a network intrusion detection incremental learning method based on dynamic hypersphere integration according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the incremental learning method for network intrusion detection based on dynamic hypersphere integration according to any one of claims 1 to 7 are implemented.

Images