Network intrusion detection method and system based on recursive gating convolution

Abstract

The invention discloses a network intrusion detection method and system based on recursive gating convolution, and relates to the technical field of data processing. The method comprises the steps of obtaining to-be-predicted traffic data; obtaining a network intrusion detection model; training the network intrusion detection model, wherein the training comprises the steps of dividing traffic slices for the preprocessed training data according to a fixed time window; calculating a fusion feature value of each time window and the spatial dimension; generating a spatial-temporal characteristic matrix; splicing the spatial-temporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; training the teacher model and training the student model; and inputting the to-be-predicted traffic data into a trained network intrusion detection model to obtain a prediction result. Through time window division and time-space fusion, the diversity of data is artificially expanded, so that the model contacts richer scenes in training, and the dependence on specific sample distribution is reduced.

Description

Technical Field

[0001] The present application relates to the field of data analysis technology, and in particular to a network intrusion detection method and system based on recursive gated convolution. Background Art

[0002] As the wave of digitalization sweeps the globe, cyberattack methods are evolving at an alarming rate, becoming increasingly complex and diverse. As the first line of defense in a cybersecurity system, the Network Intrusion Detection System (NIDS) is becoming increasingly crucial, becoming a core technical defense against cyberthreats. However, traditional rule- and signature-based detection methods, relying on known attack patterns, exhibit significant lags and limitations when facing zero-day attacks and advanced persistent threats (APTs), making them unable to meet the growing demands of cybersecurity. While machine learning-based detection methods have significantly improved detection capabilities, they still face numerous technical bottlenecks in practical application, requiring urgent breakthroughs.

[0003] Existing machine learning-based network intrusion detection technologies face multiple challenges. In terms of feature extraction, traditional convolutional neural networks (CNNs) use fixed-size convolution kernels to process the spatiotemporal characteristics of network traffic, making them unable to adaptively capture multi-scale attack features. This results in inconsistent detection results for both small-scale slow attacks and large-scale DDoS attacks. Class imbalance is also a prominent issue, with a significant imbalance in the ratio of normal traffic to attack traffic. Traditional methods tend to bias the model towards the majority class, resulting in a large number of missed attack samples. Furthermore, the large number of parameters in deep neural networks consumes significant computational resources, making real-time deployment on edge devices difficult and significantly increasing detection latency. In semi-supervised learning, existing methods inefficiently utilize unlabeled data, and model performance is easily affected by noisy labels. Single-scale feature extraction methods also struggle to fully capture the long-term temporal dependencies and localized spatial clustering characteristics of network attacks.

[0004] Academia and industry are actively exploring solutions to these technical challenges. While deep learning architectures like ResNet and DenseNet effectively mitigate the vanishing gradient problem through residual connections, they fail to fully exploit their advantages when directly applied to network intrusion detection scenarios, resulting in unsatisfactory detection results. Attention mechanisms like Squeeze-and-Excitation can increase feature importance, but they incur high computational overhead, impacting detection efficiency. While knowledge distillation techniques can transfer knowledge from large models to smaller ones, traditional methods suffer from flaws in feature alignment, resulting in inadequate knowledge transfer and limiting performance improvements for smaller models.

[0005] The existing technology has the following shortcomings: Inadequate multi-scale feature extraction: Traditional fixed convolution kernels struggle to simultaneously capture both local mutations (such as port scans) and global temporal patterns (such as slow brute force attacks) in network traffic, limiting detection accuracy. This paper uses recursive gated convolution to dynamically adjust the receptive field, enabling adaptive fusion of multi-scale features.

[0006] Detection bias caused by class imbalance: Abnormal traffic accounts for a small proportion, and the model is easily dominated by normal samples. This paper designs a focal loss and dynamic threshold pseudo-label generation mechanism to balance the learning process through reweighting and consistency regularization.

[0007] Noise accumulation problem in semi-supervised learning: Existing methods ignore model prediction uncertainty when generating pseudo labels, and incorrect labels continue to propagate. Figure 1 Consistency verification and temperature scaling technology can effectively suppress the influence of noise labels.

[0008] The contradiction between model complexity and real-time performance: Detection accuracy often comes at the expense of speed. This paper uses a dual attention mechanism to achieve feature compression, combined with a recursive distillation architecture, to reduce the number of parameters by 70% while maintaining accuracy. Summary of the Invention

[0009] The object of the present invention is to provide a network intrusion detection method based on recursive gated convolution to solve at least one of the above technical problems.

[0010] One aspect of the present invention provides a network intrusion detection method based on recursive gated convolution, the network intrusion detection method based on recursive gated convolution comprising: Obtain traffic data to be predicted; Obtain network intrusion detection models; The network intrusion detection model is trained by: obtaining preprocessed training data; dividing the preprocessed training data into traffic slices according to fixed time windows; calculating the fusion feature value of each time window and the spatial dimension; generating a spatiotemporal feature matrix based on the fusion feature value of each time window and the spatial dimension; splicing the spatiotemporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; and training the teacher model using the enhanced feature set; The fusion feature value of each time window and space dimension is calculated by the following formula: ; in, Time window t and spatial dimensions s The fusion feature value of Time window t Neidii The time interval between a traffic packet and the previous packet; For the spatial dimension s Neidi i The port number of each traffic packet; is the time decay factor; Time window t The mean of all time intervals within ; For the spatial dimension s The average value of all port numbers in; is the total number of traffic packets in a single space-time slice; The traffic data to be predicted is input into a trained network intrusion detection model to obtain a prediction result.

[0011] Optionally, obtaining preprocessed training data includes: Obtain network traffic feature set; The SMOTE technology is used to oversample the minority class samples in the network traffic feature set to obtain the oversampled network traffic feature set; Performing data enhancement on the oversampled network traffic feature set to obtain a data enhanced network traffic feature set; The data-enhanced network traffic feature set is divided into data sets to obtain training sets, validation sets, and test sets.

[0012] Optionally, the teacher model includes: A feature extraction module, comprising three convolution units, configured to extract preprocessed input training data into a multi-scale feature map; wherein the first convolution unit outputs 16 channels, the second convolution unit outputs 32 channels, and the third convolution unit outputs 64 channels; A spatial attention module, wherein the spatial attention module is used to perform an attention enhancement operation on the multi-scale feature map to obtain an attention-enhanced feature map; A classification decision module is configured to obtain a classification result based on the attention-enhanced feature map; the classification decision module comprises a first fully connected layer and a second fully connected layer, wherein Dropout regularization is added after the first fully connected layer to randomly shield 40% of the neurons.

[0013] Optionally, the loss function of the teacher model is as follows: ; in, is the number of batch samples, represents the sample label, and is the class probability predicted by the model; is the weight of the minority class, set to 3.0; is the majority class weight and is set to 1.0.

[0014] Optionally, the optimizer used when training the teacher model is an AdamW optimizer; The parameter update rules of the AdamW optimizer are as follows: ; in, For the t Model parameters at the iteration; is the initial learning rate, set to 3e-4; is the first moment estimate of the gradient; is the second moment estimate of the gradient; is a numerical stability term; To control the weight decay strength, set it to 1e-4.

[0015] Optionally, when training the teacher model, a cosine annealing learning rate scheduling method is used to dynamically adjust the learning rate. The formula for dynamically adjusting the learning rate using the cosine annealing learning rate scheduling method is as follows: ; in, For the t The learning rate of each epoch; is the maximum learning rate, is the minimum learning rate, T is the total number of iterations of 30 epochs, t Indicates the current epoch number.

[0016] Optionally, the network intrusion detection model further includes: The student classification decision module is used to obtain classification results based on the attention enhancement feature map.

[0017] Optionally, when training using a semi-supervised training method, the semi-supervised loss function is as follows: ; in, is the focal loss function; is the knowledge distillation loss function; is the consistency loss function; is the feature similarity loss function; is the knowledge distillation loss weight; is the consistency loss weight; is the feature similarity loss.

[0018] The present application also provides a network intrusion detection system based on recursive gated convolution, and the network intrusion detection system based on recursive gated convolution includes: A module for acquiring traffic data to be predicted, wherein the module is used to acquire traffic data to be predicted; A network intrusion detection model acquisition module, wherein the network intrusion detection model acquisition module is used to acquire a network intrusion detection model; A training module, the training module is used to train the network intrusion detection model, the network intrusion detection model is trained in the following manner: obtaining preprocessed training data; dividing the preprocessed training data into traffic slices according to fixed time windows; calculating the fusion feature value of each time window and spatial dimension; generating a spatiotemporal feature matrix based on the fusion feature value of each time window and spatial dimension; splicing the spatiotemporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; and training the teacher model using the enhanced feature set; The fusion feature value of each time window and space dimension is calculated by the following formula: ; in, Time window t and spatial dimensions s The fusion feature value of Time window t Neidi i The time interval between a traffic packet and the previous packet; For the spatial dimension s Neidi i The port number of each traffic packet; is the time decay factor; Time window t The mean of all time intervals within ; For the spatial dimension s The average value of all port numbers in; is the total number of traffic packets in a single space-time slice; The prediction result acquisition module is used to input the traffic data to be predicted into a trained network intrusion detection model to obtain a prediction result.

[0019] The network intrusion detection method based on recursive gated convolution in this application has the following advantages: Network traffic attack patterns (such as port scanning and DDoS attacks) often include both temporal features (such as packet intervals and duration) and spatial features (such as port numbers and protocol types). Traditional data augmentation focuses on a single dimension, but this method directly models the combined temporal and spatial patterns by fusing the time window (t) and the spatial dimension (s), better aligning with the essential characteristics of network intrusions.

[0020] The generated spatiotemporal feature matrix is ​​concatenated with the original features to form a higher-dimensional enhanced feature tensor, which provides more comprehensive input information for the model and helps to learn the hidden patterns of complex attacks (such as the long-term temporal patterns of slow brute force cracking).

[0021] Through time window division and spatiotemporal fusion, the diversity of data is artificially expanded (the same traffic has different characteristics in different windows), allowing the model to be exposed to richer scenarios during training and reduce its dependence on specific sample distributions. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 1 is a flow chart of a network intrusion detection method based on recursive gated convolution according to an embodiment of the present application; Figure 2 This is a flow chart of training a network intrusion detection model according to an embodiment of the present application; Figure 3 This is a detailed flowchart of a training network intrusion detection model according to an embodiment of the present application; Figure 4 This is a structural diagram of a teacher-student model according to an embodiment of the present application; Figure 5 This is a schematic structural diagram of a student model according to an embodiment of the present application; Figure 6 Schematic diagram of a recursive gated convolution module according to an embodiment of the present application; Figure 7 Schematic diagram of a semi-supervised learning framework according to an embodiment of the present application; Figure 8 This is a schematic diagram of the classification effect of an embodiment of the present application. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solutions and advantages of the implementation of this application clearer, the technical solutions in the embodiments of this application will be described in more detail below in conjunction with the drawings in the embodiments of this application. In the drawings, the same or similar reference numerals throughout represent the same or similar elements or elements with the same or similar functions. The described embodiments are part of the embodiments of this application, not all of the embodiments. The embodiments described below with reference to the drawings are exemplary and are intended to be used to explain this application, and should not be understood as limitations on this application. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application. The embodiments of this application are described in detail below in conjunction with the drawings.

[0024] like Figure 1 The network intrusion detection method based on recursive gated convolution shown includes: Step 1: Obtain traffic data to be predicted; Step 2: Obtain network intrusion detection model; Step 3: Training the network intrusion detection model. The network intrusion detection model is trained in the following manner: obtaining preprocessed training data; dividing the preprocessed training data into traffic slices according to fixed time windows (e.g., 500ms); calculating the fusion feature value of each time window and spatial dimension; generating a spatiotemporal feature matrix based on the fusion feature value of each time window and spatial dimension; concatenating the spatiotemporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; and training the teacher model using the enhanced feature set. The fusion feature value of each time window and spatial dimension is calculated using the following formula: ; in, Time window t and spatial dimensions s The fusion feature value of Time window t Neidi i The time interval between a traffic packet and the previous packet; For the spatial dimension s Neidi i The port number of each traffic packet (such as TCP: 80, UDP: 53); is the time decay factor (optimized through back-propagation to control the sensitivity of the time dimension); Time window t The mean of all time intervals within ; For the spatial dimension s The average value of all port numbers in; is the total number of traffic packets in a single space-time slice; For all t and s After calculation, the The spatiotemporal feature matrix ( T is the number of time windows, S is the number of protocol types); Will S It is concatenated with the original traffic features (such as packet length and protocol type) according to the channel dimension to form an enhanced feature tensor. (F is the original feature number); Step 4: Input the traffic data to be predicted into the trained network intrusion detection model to obtain the prediction result.

[0025] In this embodiment, training the teacher model and training the student model by enhancing the feature set includes: The teacher model is trained by enhancing the feature set to obtain the optimal teacher model parameters; Through a semi-supervised training method, the student model is trained according to the trained teacher model to obtain the optimal student model parameters, and the trained student model is used as the network intrusion detection model.

[0026] In this embodiment, obtaining the pre-processed training data includes: Obtain a network traffic feature set. Specifically, first perform multi-dimensional feature parsing on the raw network traffic data, extracting a 41-dimensional feature vector consisting of basic connection features (source / destination port, protocol type), content features (HTTP method count, FTP command count, number of bytes transferred), time series features (connection duration, packet interval, jitter), and statistical features (number of connections to the same service, number of historical connections to the same source IP address). Z-score normalization is performed on the raw network traffic features to eliminate differences in feature dimensions. The mean and standard deviation of each feature are calculated, and the feature values ​​are converted to a standard normal distribution to ensure model training stability.

[0027] The SMOTE technique is used to oversample minority class samples in the network traffic feature set to obtain an oversampled network traffic feature set. Specifically, the SMOTE algorithm is used to oversample minority attack samples. By identifying the k-nearest neighbors of minority class samples, new samples are generated through linear interpolation in the feature space to balance the number of attack samples of each type.

[0028] Data enhancement is performed on the oversampled network traffic feature set to obtain a data-enhanced network traffic feature set. Specifically, two data enhancement strategies with different intensities are defined: the weak enhancement group includes mild perturbations such as random scaling, small translation, and color jitter to retain the main features of the original data; the strong enhancement group introduces drastic transformations such as CutMix mixing, channel noise injection, and random occlusion to significantly improve data diversity.

[0029] In this embodiment, the time interval ( ) and the port number ( ) use arctan and logarithmic (log) transformations respectively, ) use arctan and logarithmic (log) transformations respectively, The logarithmic transformation compresses the port number range (usually 0-65535) to prevent large values ​​from dominating the feature distribution while retaining the relative differences between different ports (such as the distinction between port 80 and port 443).

[0030] This application introduces the mean ( 、 ) and standard deviation to capture the overall distribution characteristics of time intervals and port numbers: reducing single outliers (such as accidental large or wrong ports) to improve the resistance to noisy data; reflect the "group characteristics" of traffic (such as the average interval within a certain period of time, the distribution of commonly used ports), rather than just the isolated characteristics of individual samples, and are more in line with the "batch nature" of network attacks (such as a large number of similar packets in DDoS).

[0031] By time decay factor Dynamically adjust the sensitivity of the time dimension so that the model can adapt to different scenarios (such as increasing the time weight for scenarios with high real-time requirements and increasing the space weight for attacks with strong port dependence), solving the problem that traditional fixed weights cannot adapt to diverse attack modes.

[0032] The data-enhanced network traffic feature set is divided into data sets to obtain training sets, validation sets, and test sets.

[0033] In this embodiment, the teacher model includes a feature extraction module, a spatial attention module, and a classification decision module, wherein: The feature extraction module includes three convolution units, which are used to extract the input preprocessed training data into a multi-scale feature map; among the three convolution units, the first convolution unit outputs 16 channels, the second convolution unit outputs 32 channels, and the third convolution unit outputs 64 channels; The spatial attention module is used to perform attention enhancement operations on multi-scale feature maps to obtain attention-enhanced feature maps; The classification decision module is used to obtain the classification result according to the attention-enhanced feature map; the classification decision module includes a first fully connected layer and a second fully connected layer, and Dropout regularization is added after the first fully connected layer to randomly block 40% of the neurons.

[0034] In this embodiment, the teacher model's architecture is based on a deep convolutional neural network and includes three feature extraction blocks and a spatial attention module. Each feature extraction block consists of a convolutional layer, a batch normalization layer, and a GELU activation function. The feature space is progressively expanded by gradually increasing the number of channels (16-32-64). In this embodiment, the spatial attention module uses 1×1 convolution to generate an attention heatmap, highlighting key feature areas.

[0035] In this embodiment, a phased progressive optimization strategy is used during the teacher model training phase. The training process uses a class-weighted focal loss function, assigning weights of 1.0 and 3.0 to the normal and abnormal classes, respectively, effectively alleviating class imbalance.

[0036] The optimizer uses the AdamW algorithm, with the initial learning rate set to 3e-4. Combined with cosine annealing learning rate scheduling, the learning rate is smoothly reduced to 1e-5 within 30 training cycles.

[0037] To prevent overfitting, a 0.4 dropout layer is added at the end of the network, and a 0.3 dropout rate is added after each convolution block.

[0038] Model selection is based on the validation set macro F1 score. An early stopping mechanism is used to automatically terminate training when the performance plateaus, and the best teacher model parameters are saved for subsequent knowledge distillation.

[0039] In this embodiment, the loss function of the teacher model is as follows: ; in, is the number of batch samples, Indicates the i The true label of each sample (0 = normal class, 1 = abnormal class), and is the class probability predicted by the model; is the majority class weight, set to 1.0; is the weight of the minority class and is set to 3.0.

[0040] In this embodiment, the optimizer used when training the teacher model is the AdamW optimizer; The parameter update rules of the AdamW optimizer are as follows: ; in, For the t Model parameters at the iteration; is the initial learning rate, set to 3e-4; is the first moment estimate of the gradient; is the second moment estimate of the gradient; is a numerical stability term; To control the weight decay strength, set it to 1e-4.

[0041] In this embodiment, when training the teacher model, the cosine annealing learning rate scheduling method is used to dynamically adjust the learning rate. The formula for dynamically adjusting the learning rate by the cosine annealing learning rate scheduling method is as follows: ; in, For the t The learning rate of each epoch; is the maximum learning rate (3e-4), is the minimum learning rate (1e-5), T is the total number of iterations of 30 epochs, t Indicates the current epoch number.

[0042] In this embodiment, the student model includes a recursive gated convolution module, a multi-scale branch fusion structure, a channel calibration fusion module, a student spatial attention module, and a student classification decision module, wherein: The recursive gated convolution module generates multi-scale recursive fusion feature maps by recursively gating 3×3, 5×5, and 7×7 convolution kernels; The multi-scale branch fusion structure includes a main branch and an auxiliary branch. The auxiliary branch is used to obtain the features output by the 7×7 convolution kernel of the recursive gated convolution module and perform downsampling, convolution processing and upsampling on the features to generate auxiliary features; the main branch is used to transmit the multi-scale recursive fusion feature map; The channel calibration fusion module is used to fuse the auxiliary features with the multi-scale recursive fusion feature map to obtain a fusion feature map; The spatial attention module is used to perform a spatial attention operation on the fused feature map to obtain an attention-enhanced feature map; The student classification decision module is used to obtain classification results based on the attention-enhanced feature map.

[0043] In this embodiment, the core component of the student model is an improved recursive gated convolution module. This module constructs a dynamically adjustable receptive field system by deploying three depthwise separable convolutions of different scales in parallel: 3×3, 5×5, and 7×7. The outputs of each convolutional path are blended using learnable weight parameters, enabling the model to adaptively select the optimal feature scale. The model adopts a dual-branch input structure: the main branch processes the original resolution data to capture fine-grained features, while the auxiliary branch processes the downsampled data to extract global semantic information. Two improved recursive convolution modules form the feature extraction backbone, with 16 and 32 output channels, respectively. The feature fusion stage uses upsampling and skip connections to achieve multi-scale feature interaction. A spatial attention mechanism reweights the fused features to highlight highly discriminative regions. The classification head utilizes a two-layer fully connected network with a LayerNorm layer and a dropout rate of 0.3 to ensure stable feature representation. Compared to the teacher model, the student model maintains comparable representation power while reducing the number of parameters by 40% through a more efficient feature utilization mechanism.

[0044] In this embodiment, the present application utilizes a semi-supervised training approach. Specifically, a closed-loop self-improvement system is constructed during the optimization phase of semi-supervised training. A relaxed pseudo-label generation strategy (confidence threshold 0.8) is employed initially, linearly improving to 0.95 as training progresses, achieving a smooth transition from exploration to exploitation. Each unlabeled sample generates a consistent prediction using four view transformations (weak augmentation, strong augmentation, 90-degree rotation, and 180-degree rotation). Pseudo-labels are retained only when multiple view predictions agree. The loss function design incorporates four key components: an improved focal loss to address class imbalance, a temperature-adjusted KL divergence loss for soft target distillation, a consistency regularization loss to enhance view invariance, and a feature similarity loss to align intermediate feature spaces. The optimization process utilizes dynamic parameter scheduling: the temperature parameter is linearly reduced from 0.5 to 0.3, the knowledge distillation weight is increased from 0.7 to 1.0, and the consistency loss weight is reduced from 0.5 to 0.2, achieving a natural transition from unsupervised to supervised training. The training cycle was set to 50 rounds. After each round of training, model performance was evaluated on the validation set, and the optimal student model parameters were saved. The final model was evaluated using comprehensive metrics on the test set, including precision, recall, and F1 score for each category, as well as macro-indicators such as ROC AUC and PR AUC. A confidence distribution plot and error analysis report were also generated to guide iterative model optimization.

[0045] In this example, model optimization utilizes a closed-loop feedback mechanism, dynamically adjusting the training strategy based on validation set performance. The optimal model is selected based on the validation set macro F1 score, and the optimizer state is saved for training resumption. Training is performed over 50 rounds, with a full validation process performed after each round, saving the optimal model parameters. The final model is fully evaluated on an independent test set, generating a detailed performance analysis including a confusion matrix and classification report, providing clear guidance for iterative model optimization.

[0046] In this embodiment, when training is performed using a semi-supervised training method, the total semi-supervised loss function is as follows: ; in, is the focal loss function; is the knowledge distillation loss function; is the consistency loss function; is the feature similarity loss function; is the knowledge distillation loss weight; is the consistency loss weight; is the feature similarity loss.

[0047] The training process of the teacher model and the student model of the present application is further elaborated below by way of examples. It should be understood that this example does not constitute any limitation to the present application.

[0048] like Figure 2 as well as Figure 3 As shown, in the data loading and preprocessing stage (S1), this application first uniformly processes network traffic features into a 14×14 single-channel grayscale image structure. SMOTE oversampling is used to address class imbalance, and both strong and weak data augmentation strategies are designed to improve generalization. Next, a teacher model (S2) is constructed with a three-layer convolutional neural network and a spatial attention mechanism. This model is trained for 30 epochs using a weighted cross-entropy loss and the AdamW optimizer, with a cosine annealing learning rate schedule optimized for convergence. Subsequently, a lightweight student model (S3) is designed, centered around a recursive gated convolution kernel and a multi-scale branch fusion structure. This model, combined with a spatial attention module and skip connections, enhances feature extraction. In the semi-supervised training stage (S4), the teacher model generates dynamic pseudo-labels. A multi-loss joint optimization strategy (including focal loss, knowledge distillation loss, and consistency loss) is employed, combined with a dynamic parameter adjustment mechanism to fully utilize unlabeled data. Finally, in the evaluation and visualization phase (S5), model performance is comprehensively evaluated using metrics such as ROC-AUC and PR-AUC. Visualizations such as training curves and confidence distributions are generated, and a lightweight student model is deployed for efficient inference. This method significantly improves the accuracy and robustness of network intrusion detection through a collaborative teacher-student training framework.

[0049] In this embodiment, the specific process of data loading and preprocessing is as follows: Data loading: Load the network traffic dataset used. The dataset used in this invention has been pre-featured and encoded. For input features, all categorical fields (such as transport layer protocol proto) have completed One-Hot encoding, and numerical fields have completed standardization. For the label field, the original multi-class attack labels have been merged and mapped to a binary classification form: normal is marked as 0, and other attack types are uniformly marked as 1 to construct a binary classification problem. In this experiment, the input features of all samples are uniformly processed into 196 dimensions so that they can be reshaped into a 14×14 single-channel grayscale image to adapt to the input structure of the convolutional neural network.

[0050] For example, if the original feature dimension is exactly 196, the reshape operation is performed directly; if the original feature dimension is less than 196, the zero-padding strategy is used to expand the feature vector to 196 dimensions; if the original feature dimension exceeds 196, the feature vector is truncated and the first 196 dimensions are retained. The shape of the final input tensor is [batch_size, 1, 14, 14], where: 1 represents a single channel (simulating a grayscale image); 14×14 represents the height and width of the image; Class balancing strategy: The number of normal samples far exceeds the number of attack samples, resulting in a significant class imbalance. Using this data directly for training will cause the model to tend to predict the majority class (normal samples), thereby reducing its ability to identify the minority class (attack samples).

[0051] To solve this problem, SMOTE (Synthetic Minority Oversampling Technique) can be used to oversample the minority class samples in the training set. The basic principle of SMOTE is to balance the data distribution by synthesizing new minority class samples. The specific steps are as follows: Define the original sample set: Let the original data set be ,in, Indicates the sample category (0 for the majority class, 1 for the minority class), is the eigenvector.

[0052] Select minority class samples: For each minority class sample , find its nearest neighbor sample in the feature space .

[0053] Generate synthetic samples: and Randomly interpolate on the lines between to generate new samples: , in, is a minority class sample, yes The nearest neighbor samples. Is a random number that controls the location where new samples are generated.

[0054] Repeat the generation process: Repeat the above steps until the number of minority class samples and the number of majority class samples are balanced.

[0055] The SMOTE method can effectively alleviate the problem of class imbalance and enhance the model's ability to identify minority classes (attack samples), thereby improving the overall classification performance.

[0056] Data augmentation methods: Data augmentation is an effective technique for increasing the diversity of training data, thereby improving the generalization and robustness of the model. In this paper, we designed two data augmentation strategies of varying strength: weak augmentation and strong augmentation. During training, we also introduced data augmentation strategies based on image transformations, including random scaling, translation, and color dithering (weak augmentation) and CutMix, channel noise, and random occlusion (strong augmentation), to improve the model's generalization performance and ability to resist perturbations.

[0057] Data partitioning: Divide the dataset into a training set (with labels), a validation set (with labels), and a test set (with labels), as well as an unlabeled dataset for semi-supervised learning.

[0058] In this embodiment, the teacher model training phase steps are as follows: Model architecture: Figure 4 As shown in the figure, the teacher model Teacher.model is a convolutional neural network designed for small-size image classification. Its core architecture gradually extracts and optimizes features through three stages: First, in the feature extraction stage, the network uses three layers of 3×3 convolution kernels to gradually expand the receptive field. Each layer uses the standard process of "convolution → normalization → activation", where the convolution operation can be expressed as: ;in, : represents a single value (also called a neuron or pixel) at the i-th row and j-th column in the output feature map; i and j are indices that specify the spatial coordinates on the output feature map. m and n are indices within the convolution kernel. For a 3×3 convolution kernel, both m and n range from 0 to 2. : represents the value of the corresponding position in a 3×3 area centered on (i, j) on the input feature map. This expression defines the calculation range of the convolution kernel sliding on the input map. : Represents the weight value corresponding to the (m,n) position in the 3×3 convolution kernel. During training, the network continuously optimizes these weights through learning. Input: Refers to the input feature map, that is, the output of the previous layer. For the first convolution layer, this is the original input data. Bias is a learnable parameter used to fine-tune the convolution result and improve the model's fit.

[0059] The first layer outputs 16 channels, primarily detecting basic edge features. The second layer expands to 32 channels, combining simple features to form textures. The third layer reaches 64 channels, allowing each neuron to perceive a 7×7 raw pixel region and recognize complete semantic patterns. Batch normalization and the GELU activation function are used after each convolution layer to stabilize the training process.

[0060] In the feature optimization stage, the network introduces a spatial attention mechanism to automatically focus on important areas. The mechanism first calculates the attention weight through 1×1 convolution: , in, is the Sigmoid activation function, which outputs the attention weight (between 0 and 1); Represents 1×1 convolution, used for dimensionality reduction.

[0061] These weights are then multiplied with the original features to strengthen the key areas and weaken the irrelevant background.

[0062] In the final classification phase, the network flattens the processed features and completes the classification through two fully connected layers. To prevent overfitting, dropout regularization is added after the first fully connected layer, randomly blocking 40% of the neurons. The final output layer gives the classification results: , Among them, FC represents the fully connected layer and GELU is the Gaussian error linear unit activation function.

[0063] The entire network is trained end-to-end and achieves high accuracy on 14×14 pixel image classification tasks.

[0064] In order to effectively solve the problem of class imbalance in the dataset, this paper adopts the weighted cross entropy loss function. This loss function adjusts the learning focus by assigning weights to different categories. Its mathematical expression is: ; in, is the number of batch samples, Indicates the i The true label of each sample (0 = normal class, 1 = abnormal class), and is the class probability predicted by the model. The present invention uses the weight of the minority class (abnormal class) Set to 3.0, the majority class weight Keep it at 1.0 to make the model focus more on feature learning of abnormal samples.

[0065] In terms of optimizer selection, this paper uses the AdamW optimizer, which is an improved version of the Adam optimizer. It improves generalization ability by decoupling weight decay and gradient update. Its parameter update rule is: ; in, For the t Model parameters at the iteration; is the initial learning rate, set to 3e-4; is the first moment estimate of the gradient; is the second moment estimate of the gradient; is a numerical stability term; To control the strength of weight decay, we set it to 1e-4. Compared with standard Adam, AdamW can more effectively prevent overfitting and improve the accuracy on the validation set.

[0066] To further optimize the training process, this paper introduces cosine annealing learning rate scheduling to dynamically adjust the learning rate: ; Here you set For the t The learning rate of each epoch; is the maximum learning rate, is the minimum learning rate, T is the total number of iterations of 30 epochs, t Represents the current epoch number. This strategy smoothly decreases the learning rate from its initial value, ensuring rapid convergence early on while allowing for fine tuning of parameters later on. Training lasts for 30 epochs. After each epoch, the F1 score on the validation set is calculated, and the best-performing model checkpoint is retained. This early stopping strategy avoids overfitting and saves training time.

[0067] In this embodiment, the training phase of the student model is as follows: In this embodiment, the specific structure of the student model is as follows: Figure 5 and Figure 6As shown in Figure 2, the core of its design is to efficiently extract and fuse multi-level features through an iterative structure of attention mechanism, channel separation, and gated convolution. The entire model first enhances the input features through the attention module, then diverts the features into an iterative calculation unit consisting of three gated convolution modules to gradually refine the features. Finally, a fully connected layer integrates the information and outputs the results.

[0068] Feature enhancement: The model first refines the input initial feature map C×W×H through an attention module. Figure 5 As shown in the "CBAM and SE" section of the CNN, this module connects a channel attention module and a spatial attention module in series. The channel attention module first analyzes the importance of each channel in the feature map and assigns higher weights to important channels. Next, the spatial attention module calculates the importance of each spatial location in the feature map, allowing the model to focus on the most informative areas. After these two attention mechanisms, the feature map is further calibrated through compression and excitation operations, ultimately outputting a C×W×H feature map with more prominent features and suppressed noise.

[0069] Feature splitting: To implement complex gating calculations, the model then processes the enhanced features: Channel Doubling: Expand the number of channels of the feature map from C to 2C, and the size becomes 2C×W×H.

[0070] Projection and Splitting: Through the projection module and the splitting module, the 2C×W×H feature map is precisely split into two independent C×W×H feature streams. One stream will serve as the main feature carrier, and the other will serve as auxiliary features or gating signals to provide input for subsequent gated convolution.

[0071] Core computing unit: The core part of the iterative gated convolution and multi-scale fusion model is an iterative chain structure composed of three gated convolution modules, and further enhances the feature expression capability through parallel multi-scale branches. Figure 6 As shown in Figure 1, the model gradually optimizes the feature representation in an iterative manner through three series-connected gated convolution modules.

[0072] Internal mechanism of gated convolution: Figure 5 The "gated convolution" shown here reveals its working principle. It receives two inputs: one is the main feature X, and the other is the auxiliary feature Y that serves as the gating signal. It contains two key steps: Multi-receptive field feature extraction: The main feature X undergoes a recursive gated convolution. This module does not use a single-sized convolution kernel, but instead dynamically fuses three depthwise separable convolutions (DWConv) with different receptive fields: 3×3, 5×5, and 7×7 to capture patterns at different scales. The implementation mechanism is as follows: ; Where X is the main feature map of the input. k represents the size of the convolution kernel, which is 3, 5, or 7 here. A learnable weight for each convolution kernel size k. This weight is learned dynamically and represents the importance of features at different scales. Refers to normalizing the weights through the Softmax function to ensure that the sum of all weights is 1. Refers to performing a depth-wise separable convolution with a kernel size of k×k on the input feature X. Refers to the output features after the final weighted fusion.

[0073] Gating and information screening: After channel adaptation, the auxiliary feature Y is used as a dynamic "gating" signal and multiplied element-by-element with the features extracted from multiple receptive fields.

[0074] ; That is the output of the previous recursive gated convolution. The auxiliary feature Y is passed through a 1x1 convolution and a Sigmoid activation function to generate a gating matrix with a value between 0 and 1. : represents element-by-element multiplication. This step allows the model to dynamically and selectively pass primary features based on the content of auxiliary features, thereby achieving fine control over the flow of information. H is the final output of a single gated convolution module.

[0075] Iteration and context fusion: Figure 5 and Figure 6 As shown, three gated convolutional modules operate in series, with the output of the first module becoming the input of the second. Through methods such as skip connections, the "spatial context" derived from the previous stage is incorporated into the calculations of the next stage, achieving gradual refinement and enrichment of features. To further combine features at different scales and preserve shallow details, the model also employs a parallel multi-scale branch fusion strategy.

[0076] Main branch: directly processes the 14×14 low-level input features (h_{low}), retaining the most complete spatial detail information.

[0077] Downsampling branch: The feature map is processed through the process of "average pooling → normalized convolution → upsampling" to process 7×7 features to obtain higher-level global context information ( ).

[0078] Fusion strategy: Use channel-calibrated jump connections to fuse the features of the two branches: ; in, Low-level, high-resolution features from backbone branches. High-level, low-resolution features from the downsampling branch. Represents a 1×1 convolution, which is used to match The channel dimension of Add. : The final feature integrates multi-scale information, which contains both rich details and global context, further improving the expressiveness and robustness of the model.

[0079] Feature Fusion and Output: After three iterations of gated convolution and fusion of multi-scale information, the model feeds the resulting feature map into a fully connected layer, integrating all high-level features and ultimately outputting the classification result. This complex architecture, combining attention, feature splitting, iterative recursive gating, and multi-scale fusion, enables the student model to maintain its lightweight while possessing powerful feature extraction and generalization capabilities.

[0080] The semi-supervised training strategy for this application is as follows: A key step in improved semi-supervised training is the dynamic generation of consistent pseudo-labels, a process designed to leverage unlabeled data to enhance model training.

[0081] For each unlabeled sample, we generate multiple enhanced views (including weak enhancement, strong enhancement, and rotation, etc.) and obtain the predicted probability of each view through the model.

[0082] The prediction probabilities of multiple views are averaged to obtain more stable and reliable prediction results.

[0083] The maximum value of the average predicted probability (i.e., confidence) is compared with a dynamically adjusted threshold to select samples with higher confidence as pseudo labels. The threshold is initially loose (e.g., 0.8) and becomes increasingly strict as training progresses (up to 0.95), allowing for the gradual introduction of more high-quality unlabeled data. The formula is: ; in It is obtained by averaging the multi-view predictions. It is a dynamically adjusted threshold with an initial value of 0.8 and increases linearly to 0.95 with each training round. t is the current training round, T is the total number of training rounds.

[0084] In this embodiment, the improved semi-supervised loss function combines multiple loss terms to optimize the learning effect of the student model.

[0085] The focal loss function is used to deal with the problem of class imbalance and imposes a greater penalty on misclassified samples. The formula is as follows: ; is the focal loss function; represents the model’s predicted probability for the true category, is the standard cross entropy loss.

[0086] Knowledge distillation loss function (KL divergence): guides the student model to learn through the soft labels of the teacher model. The formula is as follows: , in, is the knowledge distillation loss function; student_log_probs is the logarithmic probability of the student model; teacher_probs is the probability distribution of the teacher model; is the temperature parameter used to control the smoothness of the soft label.

[0087] The consistency loss function is used to ensure the consistency of the student model's predictions under different enhanced views. It is specifically implemented as the KL divergence between the predicted probability of the weakly enhanced view (after sharpening) and the logarithmic probability of the strongly enhanced view. The formula is as follows: ,in, is the consistency loss function; It is a sharpening operation. The predicted probability of the weakly augmented view generated by the teacher model, The predicted probability of the strongly enhanced view generated for the student model; is the KL divergence.

[0088] The feature similarity loss function is used to encourage the similarity between the student model and the teacher model at the intermediate feature level. It is implemented through the MSE loss and the formula is as follows: , in, is a feature similarity loss function; student_features refers to the feature output of the intermediate layers of the student model (such as the feature map after convolution). teacher_features refers to the feature output of the corresponding layer of the teacher model. MSE is the mean squared error loss, which forces the student model to imitate the teacher's feature representation.

[0089] The final total loss is obtained by weighting the above items, and the weights are (knowledge distillation loss), (consistency loss) and (feature similarity loss), the weight of the focal loss is fixed to 1. The formula is expressed as: ; in, is the focal loss function; is the knowledge distillation loss function; is the consistency loss function; is the feature similarity loss function; is the knowledge distillation loss weight; is the consistency loss weight; is the feature similarity loss.

[0090] In this embodiment, in each training iteration, relevant parameters (such as temperature, knowledge distillation loss weight, consistency loss weight, and pseudo-label generation threshold) are dynamically adjusted according to the current training round, as follows: Temperature parameters : The initial value is 0.5 and gradually approaches 1.0 as the number of training rounds increases. It is used to balance the smoothness and discrimination of soft labels. The expression is: ; Knowledge distillation loss weight : The initial value is 0.7, and gradually approaches 1.0 as the number of training rounds increases, emphasizing the knowledge distillation effect in the later stage. The expression is: ; Consistency loss weight : The initial value is 0.5, and gradually approaches 0.2 as the number of training rounds increases, reducing the consistency constraint in the later stage. The expression is: ; Pseudo label generation threshold : The initial value is 0.9, and it gradually approaches 0.95 as the number of training rounds increases, gradually improving the quality requirements of pseudo labels. The expression is: ; See also Figure 7 , the specific steps of the semi-supervised training cycle are as follows: Model state setting: the student model is set to training mode and the teacher model is set to evaluation mode.

[0091] Pseudo-label generation: At the beginning of each epoch, consistent pseudo-labels are generated based on the current teacher model and unlabeled data.

[0092] Training loop: For each batch of labeled data, forward propagation and loss calculation are performed; if there is pseudo-labeled data, forward propagation and consistency loss calculation are performed on unlabeled data at the same time.

[0093] Backpropagation and optimization: Backpropagation is performed based on the total loss and the parameters of the student model are updated.

[0094] Metrics calculation: At the end of each epoch, metrics such as training loss, accuracy, and F1 score are calculated and recorded.

[0095] Through this comprehensive strategy, the improved semi-supervised training method can make full use of limited labeled data and a large amount of unlabeled data to improve the generalization ability and robustness of the model.

[0096] During the model evaluation and visualization phase, this paper uses multi-dimensional evaluation metrics to comprehensively analyze model performance. These include basic classification performance metrics such as accuracy, precision, recall, and F1 score. Macro-average metrics are further calculated to balance the impact of class imbalance. Furthermore, for binary classification problems, advanced evaluation metrics such as the area under the receiver operating characteristic (ROC) curve (ROC-AUC) and the area under the precision-recall curve (PR-AUC) are introduced to more comprehensively assess model performance under conditions of imbalanced class distribution.

[0097] like Figure 8 In terms of visualization, this application implements three key types of charts: ROC curve: used to measure the model's ability to distinguish positive and negative samples at different thresholds, and annotate its AUC value; PR curve: It is particularly suitable for class imbalance scenarios and shows the trade-off between precision and recall. Confidence distribution histogram: It counts the predicted probability distribution of normal and abnormal samples respectively, and intuitively reflects the difference in the model's confidence in the two types of samples.

[0098] During training, historical metrics such as training loss, training accuracy, training F1 score, and validation F1 score are dynamically recorded for each round. Training loss and F1 score curves are plotted to monitor model convergence and prevent overfitting. All visualizations are generated using the Matplotlib library and saved as image files for subsequent analysis and adjustment of model optimization directions.

[0099] Finally, the model parameters with the best performance (based on F1 Score) are retained based on the performance on the validation set.

[0100] This application has the following advantages: Significantly improved detection accuracy: Through the innovative recursive gated convolution multi-scale feature fusion mechanism, the model's detection capability has been greatly enhanced, with significant improvements in all indicators compared to traditional methods.

[0101] Excellent real-time detection performance: The optimized model significantly improves inference speed, ensuring that security threats can be discovered and handled in a timely manner.

[0102] Extremely low resource usage: With a lightweight design, the model is small in size and occupies little memory, and can run efficiently on various resource-constrained edge devices.

[0103] Effectively solve class imbalance: The innovative dynamic focal loss function significantly enhances the model's learning ability for minority class samples and significantly reduces the false negative rate.

[0104] Semi-supervised learning is highly efficient: it only requires a small amount of labeled data and a large amount of unlabeled data to achieve performance close to that of fully supervised learning, greatly reducing the cost of data labeling.

[0105] The model structure is highly streamlined: Through recursive distillation technology, the student model maintains high performance while significantly reducing the model size and computational complexity.

[0106] Strong multi-scale detection capabilities: The dynamic convolution kernel mixing mechanism enables the model to adapt to attack characteristics of different scales, especially significantly improving the detection effect of special threats such as slow attacks.

[0107] Strong anti-noise interference ability: The improved pseudo-label generation strategy effectively filters out noisy data and ensures the stability of semi-supervised learning.

[0108] Network traffic attack patterns (such as port scanning and DDoS attacks) often include both temporal features (such as packet intervals and duration) and spatial features (such as port numbers and protocol types). Traditional data augmentation focuses on a single dimension, but this method directly models the combined temporal and spatial patterns by fusing the time window (t) and the spatial dimension (s), better aligning with the essential characteristics of network intrusions.

[0109] The generated spatiotemporal feature matrix is ​​concatenated with the original features to form a higher-dimensional enhanced feature tensor, which provides more comprehensive input information for the model and helps to learn the hidden patterns of complex attacks (such as the long-term temporal patterns of slow brute force cracking).

[0110] Through time window division and spatiotemporal fusion, the diversity of data is artificially expanded (the same traffic has different characteristics in different windows), allowing the model to be exposed to richer scenarios during training and reduce its dependence on specific sample distributions.

[0111] The present application also provides a network intrusion detection system based on recursive gated convolution, which includes a traffic data acquisition module to be predicted, a network intrusion detection model acquisition module, a training module, and a prediction result acquisition module, wherein: A module for acquiring traffic data to be predicted, wherein the module is used to acquire traffic data to be predicted; A network intrusion detection model acquisition module, wherein the network intrusion detection model acquisition module is used to acquire a network intrusion detection model; The training module is used to train the network intrusion detection model, and the network intrusion detection model is trained in the following manner: obtaining preprocessed training data; dividing the preprocessed training data into traffic slices according to fixed time windows; calculating the fusion feature value of each time window and spatial dimension; generating a spatiotemporal feature matrix based on the fusion feature value of each time window and spatial dimension; splicing the spatiotemporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; and training the teacher model using the enhanced feature set; The fusion feature value of each time window and space dimension is calculated by the following formula: ; in, Time window t and spatial dimensions s The fusion feature value of Time window t Neidi i The time interval between a traffic packet and the previous packet; For the spatial dimension s Neidi i The port number of each traffic packet; is the time decay factor; Time window t The mean of all time intervals within ; For the spatial dimension s The average value of all port numbers in; is the total number of traffic packets in a single space-time slice; The prediction result acquisition module is used to input the traffic data to be predicted into a trained network intrusion detection model to obtain a prediction result.

[0112] Although the present invention has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications and improvements may be made based on the present invention. Therefore, such modifications and improvements, which do not depart from the spirit of the present invention, are intended to be within the scope of protection claimed herein.

Claims

1. A network intrusion detection method based on recursive gated convolution, characterized in that: The network intrusion detection method based on recursive gated convolution includes: Obtain traffic data to be predicted; Obtain network intrusion detection models; The network intrusion detection model is trained by: obtaining preprocessed training data; dividing the preprocessed training data into traffic slices according to fixed time windows; calculating the fusion feature value of each time window and the spatial dimension; generating a spatiotemporal feature matrix according to the fusion feature value of each time window and the spatial dimension; splicing the spatiotemporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; training the teacher model and the student model using the enhanced feature set; The fusion feature value of each time window and space dimension is calculated by the following formula: ； in, Time window t and spatial dimensions s The fusion feature value of Time window t Neidi i The time interval between a traffic packet and the previous packet; For the spatial dimension s Neidi i The port number of each traffic packet; is the time decay factor; Time window t The mean of all time intervals within ; For the spatial dimension s The average value of all port numbers in; is the total number of traffic packets in a single space-time slice; The traffic data to be predicted is input into a trained network intrusion detection model to obtain a prediction result.

2. The network intrusion detection method based on recursive gated convolution according to claim 1, characterized in that: The obtaining of pre-processed training data comprises: Obtain network traffic feature set; The SMOTE technology is used to oversample the minority class samples in the network traffic feature set to obtain the oversampled network traffic feature set; Performing data enhancement on the oversampled network traffic feature set to obtain a data enhanced network traffic feature set; The data-enhanced network traffic feature set is divided into data sets to obtain training sets, validation sets, and test sets.

3. The network intrusion detection method based on recursive gated convolution according to claim 2, characterized in that: The teacher model includes: A feature extraction module, comprising three convolution units, configured to extract preprocessed input training data into a multi-scale feature map; wherein the first convolution unit outputs 16 channels, the second convolution unit outputs 32 channels, and the third convolution unit outputs 64 channels; A spatial attention module, wherein the spatial attention module is used to perform an attention enhancement operation on the multi-scale feature map to obtain an attention-enhanced feature map; A classification decision module is configured to obtain a classification result based on the attention-enhanced feature map; the classification decision module comprises a first fully connected layer and a second fully connected layer, wherein Dropout regularization is added after the first fully connected layer to randomly shield 40% of the neurons.

4. The network intrusion detection method based on recursive gated convolution according to claim 3, characterized in that: The loss function of the teacher model is as follows: ； in, is the number of batch samples, represents the sample label, and is the class probability predicted by the model; is the weight of the minority class, set to 3.0; is the majority class weight and is set to 1.

0.

5. The network intrusion detection method based on recursive gated convolution according to claim 4, characterized in that: The optimizer used when training the teacher model is the AdamW optimizer; The parameter update rules of the AdamW optimizer are as follows: ； in, For the t Model parameters at the iteration; is the initial learning rate, set to 3e-4; is the first moment estimate of the gradient; is the second moment estimate of the gradient; is a numerical stability term; To control the weight decay strength, set it to 1e-4.

6. The network intrusion detection method based on recursive gated convolution according to claim 5, characterized in that: When training the teacher model, the cosine annealing learning rate scheduling method is used to dynamically adjust the learning rate. The formula for dynamically adjusting the learning rate by the cosine annealing learning rate scheduling method is as follows: ； in, For the t The learning rate of each epoch; is the maximum learning rate, is the minimum learning rate, T is the total number of iterations of 30 epochs, t Indicates the current epoch number.

7. The network intrusion detection method based on recursive gated convolution according to claim 6, characterized in that: The network intrusion detection model further includes: The student classification decision module is used to obtain classification results based on the attention enhancement feature map.

8. The network intrusion detection method based on recursive gated convolution according to claim 7, characterized in that: When training via semi-supervised training, the total semi-supervised loss function is as follows: ； in, is the focal loss function; is the knowledge distillation loss function; is the consistency loss function; is the feature similarity loss function; is the knowledge distillation loss weight; is the consistency loss weight; is the feature similarity loss.

9. A network intrusion detection system based on recursive gated convolution, characterized in that: The network intrusion detection system based on recursive gated convolution includes: A module for acquiring traffic data to be predicted, wherein the module is used to acquire traffic data to be predicted; A network intrusion detection model acquisition module, wherein the network intrusion detection model acquisition module is used to acquire a network intrusion detection model; A training module, the training module is used to train the network intrusion detection model, the network intrusion detection model is trained in the following manner: obtaining preprocessed training data; dividing the preprocessed training data into traffic slices according to fixed time windows; calculating the fusion feature value of each time window and spatial dimension; generating a spatiotemporal feature matrix based on the fusion feature value of each time window and spatial dimension; splicing the spatiotemporal feature matrix with the preprocessed training data to form an enhanced feature set; constructing a teacher model and a student model; and training the teacher model using the enhanced feature set; The fusion feature value of each time window and space dimension is calculated by the following formula: ； in, Time window t and spatial dimensions s The fusion feature value of Time window t Neidi i The time interval between a traffic packet and the previous packet; For the spatial dimension s Neidi i The port number of each traffic packet; is the time decay factor; Time window t The mean of all time intervals within ; For the spatial dimension s The average value of all port numbers in; is the total number of traffic packets in a single space-time slice; The prediction result acquisition module is used to input the traffic data to be predicted into a trained network intrusion detection model to obtain a prediction result.

Images