Network intrusion detection method based on improved WGAN sampling and ensemble learning

Abstract

The invention relates to a network intrusion detection method based on improved WGAN sampling and ensemble learning, and solves the defects that for high-dimensional and class-unbalanced network flow data, a base learner of an integrated model is insufficient in adaptive capacity, noise interference is difficult to restrain, and key attack modes are difficult to mine in the prior art. The method comprises the following steps: acquiring network flow data; performing data enhancement based on a DDWGLO framework; constructing a network intrusion detection model based on Stacking; training a network intrusion detection model; and detecting network intrusion in real time. According to the method, the DDWGLO is adopted for data enhancement, the weight is adaptively allocated based on the Newton-Raphson optimization algorithm improved on the basis of Circle chaotic mapping, and then the accuracy of network intrusion detection is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method based on improved WGAN sampling and ensemble learning. Background Art

[0002] With the rapid development of next-generation information technology, internet penetration continues to rise, the size of online users continues to expand, and network traffic data is experiencing explosive growth. At the same time, network intrusions are hidden in massive amounts of network traffic data, making them more covert and complex. To ensure cybersecurity, the development of accurate and robust network traffic intrusion detection technologies has become a critical need.

[0003] Class imbalance is a particularly prominent issue in network security scenarios involving intrusion detection. Because abnormal traffic data is far less abundant than normal traffic data, the model training process tends to favor the majority class. This leads to insufficient learning of minority class features, making it difficult to accurately capture the complex patterns and regularities of network intrusion samples. Consequently, a large number of potential network intrusion risks can be easily overlooked in real-world applications.

[0004] Furthermore, the complexity and dynamic nature of network environments mean that traditional single models suffer from insufficient generalization and overfitting when processing high-dimensional, nonlinear data. These problems make them difficult to adapt to the rapidly changing nature of network traffic patterns, thus impacting the accuracy and stability of network intrusion detection. While ensemble models can effectively improve the accuracy and stability of prediction results by combining multiple independent and diverse single prediction models, the complexity and diversity of network traffic data lead to differences in the processing power and adaptability of different base classifiers for the same dataset. Correct detections can provide valuable information, helping to capture complex patterns and improve classification accuracy; however, incorrect detections can introduce noise, causing the results to deviate from the true reality. While current ensemble algorithms demonstrate advantages in network anomaly detection, further research is needed to optimize the combination of base learners, enhance their ability to mine diverse data features, and strengthen their robustness to outliers and noise.

[0005] Therefore, network intrusion detection faces two major challenges: the class imbalance problem in data distribution and the inadequacy of ensemble models in optimizing the combination of base learners. These issues directly impact the accuracy and effectiveness of network intrusion detection. Therefore, there is an urgent need for an innovative network intrusion detection method that can effectively address these issues and improve its performance, so as to better respond to increasingly complex network security threats and ensure the security and stability of cyberspace. Summary of the Invention

[0006] The purpose of the present invention is to solve the defects in the prior art of high-dimensional and class-imbalanced network traffic data, such as insufficient adaptability of the base learner of the ensemble model, difficulty in suppressing noise interference and mining key attack patterns, and to provide a network intrusion detection method based on improved WGAN sampling and ensemble learning to solve the above problems.

[0007] In order to achieve the above object, the technical solution of the present invention is as follows:

[0008] A network intrusion detection method based on improved WGAN sampling and ensemble learning includes the following steps:

[0009] 11) Acquisition of network traffic data: Acquire network traffic data and preprocess it to obtain a class-imbalanced dataset;

[0010] 12) Data augmentation based on the DDWGLO framework: The hybrid sampling DDWGLO framework is used to sample attack traffic categories in class-imbalanced datasets;

[0011] 13) Build a network intrusion detection model based on Stacking;

[0012] 14) Network Intrusion Detection Model Training: The network intrusion detection model is trained using the class-balanced training set R2. A Newton-Raphson optimization algorithm based on a modified Circle Chaos Map is used to adaptively assign optimal weights to the output results of the Stacking first-level learner. The weighted detection results are used as the training set for the Stacking second-level learner.

[0013] 15) Real-time detection of network intrusions: Monitor network traffic data in real time, input the network traffic data into the trained network intrusion detection model, output the detection results, and realize network intrusion detection.

[0014] The acquisition of the network traffic data comprises the following steps:

[0015] 21) Obtain network traffic data, which is divided into numerical data and categorical data. Missing values ​​of numerical data are filled with the mean, and missing values ​​of categorical data are filled with the mode.

[0016] 22) For categorical data, use one-hot encoding to convert it into numerical data and merge it with the numerical data to construct the original dataset;

[0017] 23) Normalize the original data set and scale the value range of each feature to the interval [0, 1]. The normalization formula is:

[0018] ,

[0019] Where, is the normalized data, is the sample value of the feature vector in the original data set, and are the minimum and maximum values ​​of the eigenvectors, respectively;

[0020] 24) Feature selection based on Pearson correlation coefficient test: By calculating the correlation coefficient matrix between each feature in the original data set, identifying feature pairs with an absolute correlation coefficient greater than 0.8, and randomly removing one of the features to reduce redundancy. The calculation formula of Pearson correlation coefficient is:

[0021] ,

[0022] Where, is the Pearson correlation coefficient, which is between -1 and 1. The closer the absolute value is to 1, the stronger the correlation is. and Respectively The observation values ​​of samples on two different features, and are the sample means of the two features, is the sample size;

[0023] 25) Feature selection based on random forest: By training a random forest classifier, based on the feature importance score, we select features with importance higher than 0.005 to obtain the class imbalanced dataset R;

[0024] 26) The class-imbalanced dataset R is divided into a class-imbalanced training set R1 and a test set E1 in a ratio of 8:2. Based on the class-imbalanced training set R1, the top 10 features in terms of feature importance are selected to construct the key feature subset R1'.

[0025] The data enhancement based on the DDWGLO framework includes the following steps:

[0026] 31) The DDWGLO framework includes the DDWGAN model and the LOF model;

[0027] 32) Setting up the DDWGAN model: The DDWGAN model consists of a generator G, a global discriminator D1, and a local discriminator D2. Generator G, global discriminator D1, and local discriminator D2 all use multilayer perceptrons. Generator G has four fully connected layers, with the hidden layers using the LeakyReLU activation function and batch normalization, and the output layer using the tanh activation function. Global discriminator D1 and local discriminator D2 have the same settings, both consisting of three fully connected layers, with the hidden layers using the LeakyReLU activation function and the output layers using linear activation. During training, generator G, global discriminator D1, and local discriminator D2 all use the RMSprop optimizer.

[0028] The loss function of the DDWGAN model is defined by selecting Wasserstein distance to measure the distance between distributions. Its calculation formula is:

[0029] ,

[0030] Where, Represents two probability distributions and The Wasserstein distance between and represent the real data distribution and the generated data distribution respectively, is the infimum of the set, for and A joint probability distribution of for and The set of all joint distributions, Represents the joint distribution The random variable pair expectations, yes and Wassertein distance between them;

[0031] Convert it to the following form:

[0032] ,

[0033] Where, is the supremum, is the Lipschitz constant, Representation function The Lipschitz constant, For function In the real distribution The expected value under For function In generating distribution Expected value under

[0034] 33) DDWGAN model training: The DDWGAN model is trained using the class-imbalanced training set R1 and the key feature subset R1';

[0035] 34) Set LOF model: Introduce LOF model to detect anomalies in samples generated by generator G, remove noise samples, and calculate point The local anomaly factor formula is:

[0036] ,

[0037] in, is a parameter that determines the number of neighbors, Represents a feature, considered as a point in space, express The local outlier factor of a point, express Pointed The set of nearest neighbors, express A point in Indicates a point To its The distance to the nearest neighbor, Indicates a point The local reachable density of express Neighbor Set The number of elements in ;

[0038] 35) Data augmentation: The trained DDWGAN model is used to perform the first data balancing on the class-imbalanced training set R1. The LoF model is then used to detect anomalies on the generated samples and remove noise samples. After noise removal, the classes become unbalanced again, and the DDWGAN model is used to perform the second class balancing to obtain the final class-balanced training set R2.

[0039] The stacking-based network intrusion detection model includes the following steps:

[0040] 41) Set up a network intrusion detection model consisting of two-level learners, using XGBoost, CatBoost, and LightGBM classifiers as the stacking first-level learners and a logistic regression model as the stacking second-level learner;

[0041] 42) A grid search method combined with five-fold cross validation was used to optimize the parameters of the XGBoost, Catboost, LightGBM, and logistic regression models, where:

[0042] For XGBoost, optimize the learning rate learning_rate, the number of trees n_estimators, the subsampling ratio subsample, and the column sampling ratio colsample_bytree;

[0043] For Catboost, optimize the maximum tree depth depth, learning rate learning_rate, number of iterations and L2 regularization coefficient l2_leaf_reg;

[0044] For LightGBM, optimize the maximum tree depth max_depth, learning rate learning_rate, number of trees n_estimators, number of leaf nodes num_leaves, and column sampling ratio colsample_bytree;

[0045] For the logistic regression model, optimize the regularization parameter c and the regularization type penalty.

[0046] The training of the network intrusion detection model includes the following steps:

[0047] 51) Use the class-balanced training set R2 to train the Stacking first-level learners XGBoost, CatBoost, and GBDT and obtain the detection results of the three classifiers to form a feature vector ,

[0048] in, 、 and are the output vectors of XGBoost, CatBoost and GBDT respectively;

[0049] 52) Adaptively assign weights to the output vectors of the first-level learner through an optimization algorithm: Based on the detection results of the stacking first-level learner, the weights are adaptively assigned using the Newton-Raphson optimization algorithm based on the improved Circle chaos map;

[0050] 53) Assign optimal weights to the training set R3 and the test set E1, use the weighted training set R3 to train the Stacking secondary learner, i.e., the logistic regression model, and output the detection results for the weighted test set E1 to achieve network intrusion detection.

[0051] The training of the DDWGAN model includes the following steps:

[0052] 61) Initialize model parameters: Set the initial parameters of the generator G, global discriminator D1, and local discriminator D2, and determine the hyperparameters during training, including the learning rate and number of iterations;

[0053] 62) The generator G receives random noise that satisfies the Gaussian distribution as input and generates fake data that is similar to the real data in the class-imbalanced dataset R;

[0054] 63) The global discriminator D1 evaluates the real data and generated data in the class-imbalanced training set R1 as a whole and outputs a continuity score. The local discriminator D2 evaluates the real data and generated data in the key feature subset R1' locally.

[0055] 64) The generator G performs adversarial training by minimizing the discriminant scores of the generated data in the global discriminator D1 and the local discriminator D2. Its goal is to generate high-quality fake data that deceives both the global discriminator D1 and the local discriminator D2.

[0056] 65) The RMSprop optimizer is used to update the model parameters. During the back propagation of the global discriminator D1 and the local discriminator D2, hard clipping is performed on the gradient tensor to approximately satisfy the Lipschitz continuity condition.

[0057] 66) In each training cycle, the global discriminator D1 and the local discriminator D2 are updated five times respectively. Then, the parameters of the global discriminator D1 and the local discriminator D2 are fixed and the generator G is trained. Through multiple iterations, the generator G gradually approaches the real data distribution in the class-imbalanced dataset, and finally achieves high-fidelity data generation.

[0058] The adaptive weighting of the output vector of the first-level learner by the optimization algorithm comprises the following steps:

[0059] 71) Define the maximum number of iterations of the Newton-Raphson optimization algorithm as , the current number of iterations is , and initialize ;

[0060] 72) Initialize the first generation population using the Circle chaos mapping function , the first generation population contains Individuals, Circle chaos mapping function makes this The individuals in the population are evenly distributed in the search space, and the Circle chaos mapping function is defined as follows:

[0061] ,

[0062] in, Indicates the position after mapping, Indicates the original position of the target. The serial number generated for the mapping, represents the remainder operation, and For parameters, the default value is 0.5, is 0.2;

[0063] 73) The generated weight vector Assign weights to eigenvectors Form the training set R3, and further divide R3 into the training set R4 and the validation set.

[0064] in, 、 and are the adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT in the first optimization process respectively;

[0065] 74) Use the training set R4 to train the logistic regression model, and use the validation set to evaluate the detection effect of the logistic regression model;

[0066] 75) In order to evaluate the impact of iteratively updated weights on the detection effect under the weight adaptive allocation strategy, the objective function is set as

[0067] in, The AUC value is the output of the logistic regression, which is used to evaluate the model's ability to distinguish between network intrusion behavior and normal network traffic. The Recall value is the output of logistic regression and reflects the proportion of all real intrusion behaviors that are correctly identified as attacks by the model. By maximizing the objective function, the risk of missed attack detection is prioritized while ensuring the model's global discrimination capability.

[0068] The fitness function is , the fitness value is fed back to the Newton-Raphson optimization algorithm, based on which the search direction is updated;

[0069] 76) Combine the Newton-Raphson search rule and the trap avoidance operator to update the The eigenvector in the iteration Weight combination ,in, 、 and Respectively The adaptive weights of the output vectors of XGBoost, CatBoost and GBDT during the sub-optimization process,

[0070] The Newton-Raphson search rule uses the gradient information of the fitness function to accelerate convergence, and its update rule is:

[0071] ,

[0072] ,

[0073] in, is the direction of the location update, is a normally distributed random number, and Represent the optimal solution and the worst solution in the current population, respectively. Indicates the current individual's position. is a random vector used to adjust the search direction, To generate a uniform random number vector of 1×dim dimension, dim is the dimension, Indicates the current iteration number;

[0074] The trap avoidance operator applies random perturbations to solutions whose fitness values ​​are lower than the current population optimal solution. The update formula of the trap avoidance operator is:

[0075] ,

[0076] in, represents the position of the individual after update, Indicates the current individual's position. represents the optimal solution in the current population, represents the average value of all individual positions in the current iteration, and is a uniformly distributed random number, is an adaptive coefficient, and is a binary random number;

[0077] 77) Repeat steps 73)-76) and after the number of iterations set in the optimizer, the weight vector that maximizes the objective function in the validation set is the optimal weight. .

[0078] A computer-readable storage medium stores a computer program. When the computer program is executed by a processor, a network intrusion detection method based on improved WGAN sampling and ensemble learning is implemented.

[0079] A computer device includes a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the program, a network intrusion detection method based on improved WGAN sampling and ensemble learning is implemented.

[0080] Beneficial effects

[0081] Compared with the existing technology, the network intrusion detection method based on improved WGAN sampling and ensemble learning of the present invention adopts DDWGLO for data enhancement and adaptively allocates weights based on the Newton-Raphson optimization algorithm improved by Circle chaos mapping, thereby improving the accuracy of network intrusion detection.

[0082] This paper uses the DDWGAN model for data augmentation. By setting global and local discriminators, it optimizes its parameters at both macro and micro levels to generate high-quality samples. Furthermore, the LOF algorithm is introduced to detect anomalies in the generated samples and eliminate noise samples, effectively resolving the class imbalance problem and providing a higher-quality data foundation for subsequent network intrusion detection. Furthermore, based on the Stacking ensemble learning framework, the Newton-Raphson optimization algorithm, improved by the Circle Chaos Map, adaptively assigns weights to fully capture the complex nonlinear characteristics and potential patterns in network traffic, enhancing the model's generalization and detection accuracy.

[0083] The weight adaptive allocation mechanism of network intrusion detection methods belongs to a multi-objective optimization problem. Commonly used intelligent optimization algorithms include genetic algorithms, particle swarm optimization algorithms, simulated annealing algorithms, etc. Compared with other algorithms, the Newton-Raphson optimization algorithm based on the improved Circle chaos map involved in this invention can not only enhance the convergence speed of the algorithm, but also avoid local optimal solutions. BRIEF DESCRIPTION OF THE DRAWINGS

[0084] Figure 1 is a method sequence diagram of the present invention;

[0085] Figure 2 This is a structural diagram of DDWGAN involved in the present invention;

[0086] Figure 3 This invention relates to a flow chart of weight adaptive allocation using an improved Newton-Raphson optimization algorithm based on Circle chaos mapping;

[0087] Figure 4 This is a performance comparison chart of the network intrusion detection method involved in the present invention and other models. DETAILED DESCRIPTION

[0088] In order to provide a further understanding and appreciation of the structural features and effects achieved by the present invention, a detailed description is provided with reference to preferred embodiments and accompanying drawings as follows:

[0089] like Figure 1 As shown, the network intrusion detection method based on improved WGAN sampling and ensemble learning described in the present invention includes the following steps:

[0090] The first step is to obtain network traffic data: obtain network traffic data and preprocess it to obtain a class-imbalanced dataset.

[0091] (1) Obtain network traffic data, which is divided into numerical data and categorical data. Missing values ​​of numerical data are filled with mean values, and missing values ​​of categorical data are filled with mode values.

[0092] (2) For categorical data, use one-hot encoding to convert it into numerical data and merge it with the numerical data to construct the original dataset;

[0093] (3) Normalize the original data set and scale the value range of each feature to the interval [0, 1]. The normalization formula is:

[0094] ,

[0095] Where, is the normalized data, is the sample value of the feature vector in the original data set, and are the minimum and maximum values ​​of the eigenvectors, respectively;

[0096] (4) Feature selection based on Pearson correlation coefficient test: By calculating the correlation coefficient matrix between each feature in the original data set, identifying feature pairs with an absolute value of the correlation coefficient greater than 0.8, and randomly removing one of the features to reduce redundancy. The calculation formula of the Pearson correlation coefficient is:

[0097] ,

[0098] Where, is the Pearson correlation coefficient, which is between -1 and 1. The closer the absolute value is to 1, the stronger the correlation is. and Respectively The observation values ​​of samples on two different features, and are the sample means of the two features, is the sample size;

[0099] (5) Feature selection based on random forest: By training the random forest classifier, according to the feature importance score, the features with importance higher than 0.005 are selected to obtain the class imbalanced dataset R;

[0100] (6) The class-imbalanced dataset R is divided into a class-imbalanced training set R1 and a test set E1 in a ratio of 8:2. Based on the class-imbalanced training set R1, the top 10 features ranked by feature importance are selected to construct the key feature subset R1'.

[0101] The second step is to perform data enhancement based on the DDWGLO framework: the hybrid sampling DDWGLO framework is used to sample the attack traffic categories in the class-imbalanced dataset.

[0102] (1) The DDWGLO framework includes the DDWGAN model and the LOF model.

[0103] (2) Setting the DDWGAN model: The DDWGAN model consists of a generator G, a global discriminator D1, and a local discriminator D2. The generator G, the global discriminator D1, and the local discriminator D2 all use multi-layer perceptrons. The generator G includes four fully connected layers, the hidden layer uses the LeakyReLU activation function and batch normalization, and the output layer uses the tanh activation function. The global discriminator D1 and the local discriminator D2 have the same settings, both including three fully connected layers, the hidden layer uses the LeakyReLU activation function, and the output layer uses linear activation. During training, the generator G, the global discriminator D1, and the local discriminator D2 all use the RMSprop optimizer.

[0104] The loss function of the DDWGAN model is defined by selecting Wasserstein distance to measure the distance between distributions. Its calculation formula is:

[0105] ,

[0106] Where, Represents two probability distributions and The Wasserstein distance between and represent the real data distribution and the generated data distribution respectively, is the infimum of the set, for and A joint probability distribution of for and The set of all joint distributions, Represents the joint distribution The random variable pair expectations, yes and Wassertein distance between them;

[0107] Convert it to the following form:

[0108] ,

[0109] Where, is the supremum, is the Lipschitz constant, Representation function The Lipschitz constant, For function In the real distribution The expected value under For function In generating distribution Expected value under

[0110] (3) Training of DDWGAN model: The DDWGAN model is trained using the class-imbalanced training set R1 and the key feature subset R1'.

[0111] Training the DDWGAN model consists of the following steps:

[0112] A1) Initialize model parameters: Set the initial parameters of the generator G, global discriminator D1, and local discriminator D2, and determine the hyperparameters during training, including the learning rate and number of iterations.

[0113] A2) Generator G receives random noise that satisfies a Gaussian distribution as input and generates fake data that is similar to the real data in R;

[0114] A3) The global discriminator D1 evaluates the real data and generated data in the class-imbalanced training set R1 as a whole and outputs a continuous score. The local discriminator D2 evaluates the real data and generated data in the key feature subset R1' locally.

[0115] A4) Generator G performs adversarial training by minimizing the discriminant scores of the generated data in the global discriminator D1 and the local discriminator D2. Its goal is to generate high-quality fake data that can deceive both the global discriminator D1 and the local discriminator D2.

[0116] A5) Use the RMSprop optimizer to update the model parameters, and perform hard clipping on the gradient tensor during the backpropagation of the global discriminator D1 and the local discriminator D2 to approximately meet the Lipschitz continuity condition;

[0117] A6) In each training cycle, the global discriminator D1 and the local discriminator D2 are updated five times, respectively. Then, the parameters of the global discriminator D1 and the local discriminator D2 are fixed and the generator G is trained. Through multiple iterations, the generator G gradually approaches the real data distribution in the class-imbalanced dataset, and finally achieves high-fidelity data generation.

[0118] (4) Setting LOF model: Introduce LOF model to detect anomalies in samples generated by generator G, remove noise samples, and calculate point The local anomaly factor formula is:

[0119] ,

[0120] in, is a parameter that determines the number of neighbors, Represents a feature, considered as a point in space, express The local outlier factor of a point, express Pointed The set of nearest neighbors, express A point in Indicates a point To its The distance to the nearest neighbor, Indicates a point The local reachable density of express Neighbor Set The number of elements in .

[0121] Network traffic data often has a complex structure and multiple influencing factors. Density-based detection methods are better adapted to this complex data structure. LOF is a density-based unsupervised learning method whose core principle is to detect outliers in a dataset by comparing the local density of data points. Network intrusion incidents are often caused by a combination of complex factors, and their characteristics may differ subtly from normal samples. The LOF algorithm can keenly capture these differences, accurately identifying outliers that differ from surrounding samples and retaining generated samples that are closer to the real world.

[0122] (5) Implementation of data enhancement: The trained DDWGAN model is used to perform the first data balancing process on the class-imbalanced training set R1; the LOF model is then used to detect anomalies on the generated samples and remove the noise samples; after the noise is removed, the categories become unbalanced again, and the DDWGAN model is used to perform the second category balancing process to obtain the final category-balanced training set R2.

[0123] The third step is to build a network intrusion detection model based on Stacking.

[0124] The stacking algorithm essentially stacks multiple classification models to form a multi-layer classification model. By heterogeneously integrating multiple base models, it can significantly improve overall performance. Specifically, the algorithm typically employs a two-layer architecture. In the first layer, multiple base classifiers run in parallel, independently learning and predicting the original training data. The predictions of these base classifiers are combined into a new set of features, which serve as input to the second layer. In the second layer, a meta-classifier learns and integrates this new set of features to generate predictions. Compared to a single model, this layered design fully integrates the strengths of different models, leveraging the expertise of each base model in different features and samples to compensate for some of the shortcomings of a single model, effectively reducing bias and variance and improving prediction accuracy and stability. Compared to homogeneous ensemble models, the stacking algorithm avoids the homogeneity problem of homogeneous models by complementing each other's heterogeneous base models. This allows for better mining of diverse patterns and information within the data, resulting in superior performance when processing complex data structures.

[0125] (1) The network intrusion detection model is set to include two-level learners, using XGBoost, CatBoost, and LightGBM classifiers as the Stacking first-level learners and the logistic regression model as the Stacking second-level learner;

[0126] (2) A grid search method combined with five-fold cross validation was used to optimize the parameters of the XGBoost, Catboost, LightGBM, and logistic regression models, respectively.

[0127] For XGBoost, optimize the learning rate learning_rate, the number of trees n_estimators, the subsampling ratio subsample, and the column sampling ratio colsample_bytree;

[0128] For Catboost, optimize the maximum tree depth depth, learning rate learning_rate, number of iterations and L2 regularization coefficient l2_leaf_reg;

[0129] For LightGBM, optimize the maximum tree depth max_depth, learning rate learning_rate, number of trees n_estimators, number of leaf nodes num_leaves, and column sampling ratio colsample_bytree;

[0130] For the logistic regression model, optimize the regularization parameter c and the regularization type penalty.

[0131] The fourth step is training the network intrusion detection model: the network intrusion detection model is trained using the class-balanced training set R2, and the Newton-Raphson optimization algorithm based on the improved Circle chaos map is used to adaptively assign optimal weights to the output results of the Stacking first-level learner. The weighted detection results are used as the training set for the Stacking second-level learner.

[0132] (1) Use the class-balanced training set R2 to train the Stacking first-level learners XGBoost, CatBoost, and GBDT and obtain the detection results of the three classifiers to form a feature vector ,

[0133] in, 、 and are the output vectors of XGBoost, CatBoost and GBDT respectively;

[0134] (2) Adaptively assign weights to the output vectors of the first-level learner through an optimization algorithm: Based on the detection results of the Stacking first-level learner, the weights are adaptively assigned using the Newton-Raphson optimization algorithm improved based on the Circle chaos map.

[0135] Adaptively assigning weights to the output vectors of the first-level learner through an optimization algorithm includes the following steps:

[0136] B1) Define the maximum number of iterations of the Newton-Raphson optimization algorithm as , the current number of iterations is , and initialize ;

[0137] B2) Initialize the first generation population using the Circle chaos mapping function , the first generation population contains Individuals, Circle chaos mapping function makes this The individuals in the population are evenly distributed in the search space, and the Circle chaos mapping function is defined as follows:

[0138] ,

[0139] in, Indicates the position after mapping, Indicates the original position of the target. The serial number generated for the mapping, represents the remainder operation, and For parameters, the default value is 0.5, is 0.2;

[0140] B3) The generated weight vector Assign weights to eigenvectors Form the training set R3, and further divide R3 into the training set R4 and the validation set.

[0141] in, 、 and are the adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT in the first optimization process respectively;

[0142] B4) Use the training set R4 to train the logistic regression model and use the validation set to evaluate the detection effect of the logistic regression model;

[0143] B5) In order to evaluate the impact of iteratively updated weights on the detection effect under the weight adaptive allocation strategy, the objective function is set as

[0144] in, The AUC value is the output of the logistic regression, which is used to evaluate the model's ability to distinguish between network intrusion behavior and normal network traffic. The Recall value is the output of logistic regression and reflects the proportion of all real intrusion behaviors that are correctly identified as attacks by the model. By maximizing the objective function, the risk of missed attack detection is prioritized while ensuring the model's global discrimination capability.

[0145] The fitness function is , the fitness value is fed back to the Newton-Raphson optimization algorithm, based on which the search direction is updated;

[0146] B6) Combine the Newton-Raphson search rule and the trap avoidance operator to update The eigenvector in the iteration Weight combination ,in, 、 and Respectively The adaptive weights of the output vectors of XGBoost, CatBoost and GBDT during the sub-optimization process,

[0147] The Newton-Raphson search rule uses the gradient information of the fitness function to accelerate convergence, and its update rule is:

[0148] ,

[0149] ,

[0150] in, is the direction of the location update, is a normally distributed random number, and Represent the optimal solution and the worst solution in the current population, respectively. Indicates the current individual's position. is a random vector used to adjust the search direction, To generate a uniform random number vector of 1×dim dimension, dim is the dimension, Indicates the current iteration number;

[0151] The trap avoidance operator applies random perturbations to solutions whose fitness values ​​are lower than the current population optimal solution. The update formula of the trap avoidance operator is:

[0152] ,

[0153] in, represents the position of the individual after update, Indicates the current individual's position. represents the optimal solution in the current population, represents the average value of all individual positions in the current iteration, and is a uniformly distributed random number, is an adaptive coefficient, and is a binary random number;

[0154] B7) Repeat steps B3)-B6) and after the number of iterations set in the optimizer, the weight vector that maximizes the objective function in the validation set is the optimal weight vector. .

[0155] The Newton-Raphson optimization algorithm improved based on Circle chaotic mapping can dynamically adjust weights according to the performance of the base classifier on the training set and validation set, rather than fixing the weights or statically relying on a single evaluation indicator for weight allocation. In addition, by introducing the initial population generation mechanism of chaotic mapping, the traditional optimization algorithm breaks the dependence of random initialization, and utilizes the ergodicity and sensitivity of chaotic sequences to ensure efficient coverage of the weight search space and avoid falling into the local optimal trap. Furthermore, by combining Newton-Raphson gradient acceleration with random perturbation mechanism, the algorithm can converge quickly and escape from the local optimal solution during the iteration process. Finally, the optimization algorithm integrates multi-objective optimization ideas into the weight allocation process, customizes the composite objective function according to the needs of actual problems, and dynamically balances the global discrimination ability of the model with the risk of missed detection of key attack behaviors, which not only ensures detection accuracy but also enhances the ability to capture hidden attack patterns.

[0156] (3) Assign the optimal weights to the training set R3 and the test set E1, use the weighted training set R3 to train the Stacking secondary learner, that is, the logistic regression model, and output the detection results of the weighted test set E1 to achieve network intrusion detection.

[0157] The fifth step is real-time detection of network intrusion: real-time monitoring of network traffic data, inputting the network traffic data into the trained network intrusion detection model, outputting the detection results, and realizing network intrusion detection.

[0158] like Figure 2 As shown, it is a structural diagram of DDWGAN involved in the present invention, the core of which is the introduction of a dual discriminator architecture of a global discriminator D1 and a local discriminator D2. The global discriminator D1 evaluates the authenticity of the generated samples from the perspective of the overall distribution of the data, ensuring that the generated data is consistent with the statistical characteristics of the real data at the macro level. The local discriminator D2 focuses on a subset of key features and verifies the detailed fidelity of the generated samples on the key attack patterns from a micro level. The adversarial training mechanism of the dual discriminator reduces the risk of pattern collapse by constraining the generator from multiple angles. The generator G needs to balance the continuity score of the global discriminator D1 and the key feature matching degree of the local discriminator D2 to generate samples that are closer to the real data distribution. This collaborative mechanism forces the generator G to meet the discrimination criteria of global distribution and local features at the same time, significantly improving the quality of the generated samples and avoiding local pattern deviations that may be ignored by traditional single discriminators.

[0159] like Figure 3The figure shows a flowchart for adaptive weight allocation using a Newton-Raphson optimization algorithm based on a Circle chaotic map. In the adaptive weight allocation optimization process for network intrusion detection, the objective function is to maximize the combination of AUC and Recall, with the goal of improving model detection accuracy and reducing the risk of missed detection. Furthermore, an iterative optimization is performed using the Newton-Raphson algorithm improved by the Circle chaotic map. Weights are adaptively allocated to the prediction results of the base classifiers, thereby optimizing the model combination strategy and improving the overall performance of the intrusion detection system. The sequences generated by the Circle chaotic map exhibit good randomness and diversity, which disperses individuals throughout the search space and provides more favorable initial conditions for subsequent iterative optimization, thereby enhancing the algorithm's global search capabilities and avoiding local optimal solutions. Furthermore, its chaotic properties enable the population to quickly traverse the search space, improving the algorithm's convergence speed and efficiency. Furthermore, the individual fitness of each weight combination is evaluated to determine the optimal solution for the current iteration and the potential global optimal direction. The Newton-Raphson search rule is then used to accelerate gradient convergence, introducing traps to avoid random perturbations imposed by the operator. Continuous iterations synchronously update the adaptive coefficient and population diversity distribution, and continuously verify whether the preset maximum number of iterations has been reached. This process can determine the optimal weight distribution scheme, meeting the core requirements of high-precision intrusion detection and low false negatives in complex network environments, while also promoting the development of network security detection technology towards adaptive optimization.

[0160] like Figure 4 As shown, it is a performance comparison diagram of the network intrusion detection method of the present invention and other models. The proposed complete model is compared with the simplified model with the key modules removed in terms of intrusion detection performance. It can be seen from the figure that the complete model performs best in all four evaluation indicators. After removing the weight adaptive allocation module, the model performance is reduced; after removing the data enhancement module, the model performance is significantly reduced; and when both modules are removed, the model performance is the worst. This shows that the DDWGLO data enhancement module effectively solves the class imbalance problem and provides a better data foundation for the model; and the Newton-Raphson optimization algorithm based on the Circle chaos map significantly improves the weight allocation effect of the model, and enhances the generalization ability and detection accuracy of the model. The experimental results show that these modules play a key role in the present invention, and together improve the accuracy and effectiveness of network intrusion detection.

[0161] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions merely illustrate the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A network intrusion detection method based on improved WGAN sampling and ensemble learning, characterized in that: The following steps are involved: 11) Acquisition of network traffic data: Acquire network traffic data and preprocess it to obtain a class-imbalanced dataset; 12) Data augmentation based on the DDWGLO framework: The hybrid sampling DDWGLO framework is used to sample attack traffic categories in class-imbalanced datasets; 13) Build a network intrusion detection model based on Stacking; 14) Network Intrusion Detection Model Training: The network intrusion detection model is trained using the class-balanced training set R2. A Newton-Raphson optimization algorithm based on a modified Circle Chaos Map is used to adaptively assign optimal weights to the output results of the Stacking first-level learner. The weighted detection results are used as the training set for the Stacking second-level learner. 15) Real-time detection of network intrusions: Monitor network traffic data in real time, input the network traffic data into the trained network intrusion detection model, output the detection results, and realize network intrusion detection.

2. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1 is characterized in that: The acquisition of the network traffic data comprises the following steps: 21) Obtain network traffic data, which is divided into numerical data and categorical data. Missing values ​​of numerical data are filled with the mean, and missing values ​​of categorical data are filled with the mode. 22) For categorical data, use one-hot encoding to convert it into numerical data and merge it with the numerical data to construct the original dataset; 23) Normalize the original data set and scale the value range of each feature to the interval [0, 1]. The normalization formula is: ， Where, is the normalized data, is the sample value of the feature vector in the original data set, and are the minimum and maximum values ​​of the eigenvectors, respectively; 24) Feature selection based on Pearson correlation coefficient test: By calculating the correlation coefficient matrix between each feature in the original data set, identifying feature pairs with an absolute correlation coefficient greater than 0.8, and randomly removing one of the features to reduce redundancy. The calculation formula of Pearson correlation coefficient is: ， Where, is the Pearson correlation coefficient, which is between -1 and 1. The closer the absolute value is to 1, the stronger the correlation is. and Respectively The observation values ​​of samples on two different features, and are the sample means of the two features, is the sample size; 25) Feature selection based on random forest: By training a random forest classifier, based on the feature importance score, we select features with importance higher than 0.005 to obtain the class imbalanced dataset R; 26) The class-imbalanced dataset R is divided into a class-imbalanced training set R1 and a test set E1 in a ratio of 8:

2. Based on the class-imbalanced training set R1, the top 10 features in terms of feature importance are selected to construct the key feature subset R1'.

3. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1 is characterized in that: The data enhancement based on the DDWGLO framework includes the following steps: 31) The DDWGLO framework includes the DDWGAN model and the LOF model; 32) Setting up the DDWGAN model: The DDWGAN model consists of a generator G, a global discriminator D1, and a local discriminator D2. Generator G, global discriminator D1, and local discriminator D2 all use multilayer perceptrons. Generator G has four fully connected layers, with the hidden layers using the LeakyReLU activation function and batch normalization, and the output layer using the tanh activation function. Global discriminator D1 and local discriminator D2 have the same settings, both consisting of three fully connected layers, with the hidden layers using the LeakyReLU activation function and the output layers using linear activation. During training, generator G, global discriminator D1, and local discriminator D2 all use the RMSprop optimizer. The loss function of the DDWGAN model is defined by selecting Wasserstein distance to measure the distance between distributions. Its calculation formula is: ， Where, Represents two probability distributions and The Wasserstein distance between and represent the real data distribution and the generated data distribution respectively, is the infimum of the set, for and A joint probability distribution of for and The set of all joint distributions, Represents the joint distribution The random variable pair expectations, yes and Wassertein distance between them; Convert it to the following form: ， Where, is the supremum, is the Lipschitz constant, Representation function The Lipschitz constant, For function In the real distribution The expected value under For function In generating distribution Expected value under 33) DDWGAN model training: The DDWGAN model is trained using the class-imbalanced training set R1 and the key feature subset R1'; 34) Set LOF model: Introduce LOF model to detect anomalies in samples generated by generator G, remove noise samples, and calculate point The local anomaly factor formula is: ， in, is a parameter that determines the number of neighbors, Represents a feature, considered as a point in space, express The local outlier factor of a point, express Pointed The set of nearest neighbors, express A point in Indicates a point To its The distance to the nearest neighbor, Indicates a point The local reachable density of express Neighbor Set The number of elements in ; 35) Data augmentation: The trained DDWGAN model is used to perform the first data balancing on the class-imbalanced training set R1. The LoF model is then used to detect anomalies on the generated samples and remove noise samples. After noise removal, the classes become unbalanced again, and the DDWGAN model is used to perform the second class balancing to obtain the final class-balanced training set R2.

4. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1, characterized in that: The stacking-based network intrusion detection model includes the following steps: 41) Set up a network intrusion detection model consisting of two-level learners, using XGBoost, CatBoost, and LightGBM classifiers as the stacking first-level learners and a logistic regression model as the stacking second-level learner; 42) A grid search method combined with five-fold cross validation was used to optimize the parameters of the XGBoost, Catboost, LightGBM, and logistic regression models, where: For XGBoost, optimize the learning rate learning_rate, the number of trees n_estimators, the subsampling ratio subsample, and the column sampling ratio colsample_bytree; For Catboost, optimize the maximum tree depth depth, learning rate learning_rate, number of iterations and L2 regularization coefficient l2_leaf_reg; For LightGBM, optimize the maximum tree depth max_depth, learning rate learning_rate, number of trees n_estimators, number of leaf nodes num_leaves, and column sampling ratio colsample_bytree; For the logistic regression model, optimize the regularization parameter c and the regularization type penalty.

5. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 1, characterized in that: The training of the network intrusion detection model includes the following steps: 51) Use the class-balanced training set R2 to train the Stacking first-level learners XGBoost, CatBoost, and GBDT and obtain the detection results of the three classifiers to form a feature vector , in, 、 and are the output vectors of XGBoost, CatBoost and GBDT respectively; 52) Adaptively assign weights to the output vectors of the first-level learner through an optimization algorithm: Based on the detection results of the stacking first-level learner, the weights are adaptively assigned using the Newton-Raphson optimization algorithm based on the improved Circle chaos map; 53) Assign optimal weights to the training set R3 and the test set E1, use the weighted training set R3 to train the Stacking secondary learner, i.e., the logistic regression model, and output the detection results for the weighted test set E1 to achieve network intrusion detection.

6. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 3 is characterized in that: The training of the DDWGAN model includes the following steps: 61) Initialize model parameters: Set the initial parameters of the generator G, global discriminator D1, and local discriminator D2, and determine the hyperparameters during training, including the learning rate and number of iterations; 62) The generator G receives random noise that satisfies the Gaussian distribution as input and generates fake data that is similar to the real data in the class-imbalanced dataset R; 63) The global discriminator D1 evaluates the real data and generated data in the class-imbalanced training set R1 as a whole and outputs a continuity score. The local discriminator D2 evaluates the real data and generated data in the key feature subset R1' locally. 64) The generator G performs adversarial training by minimizing the discriminant scores of the generated data in the global discriminator D1 and the local discriminator D2. Its goal is to generate high-quality fake data that deceives both the global discriminator D1 and the local discriminator D2. 65) The RMSprop optimizer is used to update the model parameters. During the back propagation of the global discriminator D1 and the local discriminator D2, hard clipping is performed on the gradient tensor to approximately satisfy the Lipschitz continuity condition. 66) In each training cycle, the global discriminator D1 and the local discriminator D2 are updated five times respectively. Then, the parameters of the global discriminator D1 and the local discriminator D2 are fixed and the generator G is trained. Through multiple iterations, the generator G gradually approaches the real data distribution in the class-imbalanced dataset, and finally achieves high-fidelity data generation.

7. The network intrusion detection method based on improved WGAN sampling and ensemble learning according to claim 5, characterized in that: The adaptive weighting of the output vector of the first-level learner by the optimization algorithm comprises the following steps: 71) Define the maximum number of iterations of the Newton-Raphson optimization algorithm as , the current number of iterations is , and initialize ; 72) Initialize the first generation population using the Circle chaos mapping function , the first generation population contains Individuals, Circle chaos mapping function makes this The individuals in the population are evenly distributed in the search space, and the Circle chaos mapping function is defined as follows: ， in, Indicates the position after mapping, Indicates the original position of the target. The serial number generated for the mapping, represents the remainder operation, and For parameters, the default value is 0.5, is 0.2; 73) The generated weight vector Assign weights to eigenvectors Form the training set R3, and further divide R3 into the training set R4 and the validation set. in, 、 and are the adaptive weights of the output vectors of XGBoost, CatBoost, and GBDT in the first optimization process respectively; 74) Use the training set R4 to train the logistic regression model, and use the validation set to evaluate the detection effect of the logistic regression model; 75) In order to evaluate the impact of iteratively updated weights on the detection effect under the weight adaptive allocation strategy, the objective function Set to 8. Among them, The AUC value is the output of the logistic regression, which is used to evaluate the model's ability to distinguish between network intrusion behavior and normal network traffic. The Recall value is the output of logistic regression, which reflects the proportion of all real intrusion behaviors that are correctly identified as attacks by the model. By maximizing the objective function, the risk of missed attack detection is prioritized while ensuring the global discrimination ability of the model. The fitness function is , the fitness value is fed back to the Newton-Raphson optimization algorithm, based on which the search direction is updated; 76) Combine the Newton-Raphson search rule and the trap avoidance operator to update the The eigenvector in the iteration Weight combination ,in, 、 and Respectively The adaptive weights of the output vectors of XGBoost, CatBoost and GBDT during the sub-optimization process, The Newton-Raphson search rule uses the gradient information of the fitness function to accelerate convergence, and its update rule is: ， ， in, is the direction of the location update, is a normally distributed random number, and Represent the optimal solution and the worst solution in the current population, respectively. Indicates the current individual's position. is a random vector used to adjust the search direction, To generate a uniform random number vector of 1×dim dimension, dim is the dimension, Indicates the current iteration number; The trap avoidance operator applies random perturbations to solutions whose fitness values ​​are lower than the current population optimal solution. The update formula of the trap avoidance operator is: ， in, represents the position of the individual after update, Indicates the current individual's position. represents the optimal solution in the current population, represents the average value of all individual positions in the current iteration, and is a uniformly distributed random number, is an adaptive coefficient, and is a binary random number; 77) Repeat steps 73)-76) and after the number of iterations set in the optimizer, the weight vector that maximizes the objective function in the validation set is the optimal weight. .

9. A computer-readable storage medium, characterized in that The storage medium stores a computer program. When the computer program is executed by the processor, the network intrusion detection method based on improved WGAN sampling and ensemble learning according to any one of claims 1 to 7 is implemented.

10. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and running on the processor. When the processor executes the computer program, the network intrusion detection method based on improved WGAN sampling and ensemble learning according to any one of claims 1 to 7 is implemented.

Images