Real-time network intrusion detection method based on genetic algorithm and bidirectional long short-term memory network

Abstract

This invention discloses a real-time network intrusion detection method based on genetic algorithms and bidirectional long short-term memory networks, belonging to the field of network security technology. The method includes the following steps: Step 1, extracting network traffic features, including continuous and categorical features, from a constructed dataset, performing feature preprocessing and initial screening; Step 2, optimizing feature selection based on genetic algorithms to select the optimal feature combination with high accuracy and low dimensionality; Step 3, constructing an abnormal traffic detection model based on the feature subset selected by the genetic algorithm using a bidirectional LSTM algorithm, used to identify normal and abnormal samples in network traffic; Step 4, evaluating the performance of the abnormal traffic detection model using a confusion matrix; Step 5, deploying and real-time detecting the abnormal traffic detection model. This invention constructs a lightweight and traceable intrusion detection framework, improving the generalization ability and accuracy of the detection model; this method balances accuracy, interpretability, and system responsiveness.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, specifically relating to a real-time network intrusion detection method based on genetic algorithms and bidirectional long short-term memory networks. Background Technology

[0002] With the rapid development of information technology and the deepening of digital transformation, computer network systems have become deeply integrated into key industries such as finance, telecommunications, healthcare, energy, transportation, and government, serving as the infrastructure supporting social operations. However, this high dependence on networks has also brought unprecedented security challenges. Various network attack methods are emerging in an endless stream, exhibiting new characteristics such as intelligence, concealment, and persistence. From traditional denial-of-service (DoS) attacks, port scanning, and malicious code injection, to more complex advanced persistent threats (APTs), internal data breaches, supply chain attacks, and social engineering, attack methods are constantly evolving, and attack targets are increasingly focused on critical data and core systems, seriously threatening the security, stability, and reliability of network systems. Faced with this complex and ever-changing security landscape, building a comprehensive, proactive, and efficient network security protection system has become an urgent need to ensure the normal operation of national critical infrastructure and society.

[0003] Against this backdrop, Intrusion Detection Systems (IDS), as a critical line of defense in network security architecture, bear the important task of real-time monitoring and anomaly identification of network traffic. Traditional IDS mostly rely on signature-based detection methods, which, while efficient in identifying known attacks, are poorly adaptable to unknown, mutated, or multi-stage attacks, making them ill-suited for today's increasingly complex network security needs. To improve detection capabilities, researchers have attempted to apply machine learning and data mining techniques to IDS, constructing behavior-based anomaly detection models such as Support Vector Machines (SVM), K-Nearest Neighbors (KNN), Naive Bayes (NB), and Neural Networks (NN), thereby enhancing the ability to identify unknown attacks. However, these methods still suffer from numerous problems: high false positive rates, redundant feature selection, weak model generalization ability, complex parameter tuning processes, and insufficient support for real-time detection, severely impacting the system's robustness and practicality. In addition, although some studies in recent years have attempted to introduce genetic algorithms (GA) into intrusion detection to compensate for the limitations of the model with its global search and feature optimization capabilities, most of them are limited to simple superposition with classifiers, lacking a collaborative mechanism, and making it difficult to balance interpretability, real-time performance and accuracy. A mature and usable solution has not yet been formed.

[0004] Currently, the comprehensive performance optimization problem of intrusion detection in terms of real-time performance, robustness, and interpretability has not been fully solved both domestically and internationally. Summary of the Invention

[0005] To address the aforementioned problems in the existing technology, the technical problem to be solved by the present invention is to provide a real-time network intrusion detection method based on genetic algorithms and bidirectional long short-term memory networks that balances interpretability, real-time performance, and accuracy.

[0006] Technical Solution: To solve the above-mentioned technical problems, the present invention adopts the following technical solution:

[0007] A real-time network intrusion detection method based on genetic algorithm and bidirectional long short-term memory network includes the following steps:

[0008] Step 1: Extract network traffic features, including continuous and categorical features, from the network anomaly detection benchmark dataset, perform feature preprocessing, and use information gain ratio for initial screening;

[0009] Step 2: Feature selection optimization based on genetic algorithm. Feature selection is modeled as a combinatorial optimization problem. The feature subset is binary encoded by genetic algorithm, and the fitness function is optimized by roulette wheel selection, double crossover and bit flip mutation operation to select the optimal feature combination with high accuracy and low dimensionality.

[0010] Step 3: Construct and train an abnormal traffic detection model. Use a bidirectional LSTM algorithm to construct an abnormal traffic detection model based on the feature subset selected by the genetic algorithm, which is used to identify normal and abnormal samples in network traffic.

[0011] Step 4: Evaluate the performance of the abnormal traffic detection model using a confusion matrix;

[0012] Step 5: Deployment and real-time detection of abnormal traffic detection model.

[0013] Preferably, step 1 specifically includes the following steps:

[0014] Step 1.1: Preprocess the constructed network traffic dataset. First, divide the features into continuous and categorical features according to their attribute types. For continuous features, perform a standardization process: first, use min-max normalization to map the values ​​to the [0,1] interval, and then use the Z-score method to adjust them to zero mean and unit variance to eliminate the influence of dimensions. For categorical features, use one-hot encoding to convert them into sparse vector form to ensure that all features have a consistent numerical expression format. After this step, the original network data is converted into a uniformly structured input vector, which serves as the basis for subsequent feature evaluation.

[0015] Step 1.2: Based on the generated numerical feature vectors, calculate the classification contribution of each feature relative to the label, using information gain ratio as the evaluation metric. Information gain is defined as the difference between the information entropy of the parent node and the conditional entropy of the child node, and information gain ratio is the ratio of information gain to feature entropy. Information gain measures the degree of decrease in information entropy caused by feature partitioning, while information gain ratio corrects for the impact of the number of feature values ​​on information gain, improving the fairness of the evaluation. It is calculated using the following formula:

[0016]

[0017] Where X represents the feature to be evaluated, Y represents the label of the anomaly detection, IG(X) represents the entropy of feature X itself, H(X) represents the entropy of feature X, H(Y|X) represents the conditional entropy, H(Y) represents the entropy of label Y, and IGR(X) represents the information gain. , where p k Let X be the probability of taking the k-th value, and n represent the total number of values ​​that feature X can take.

[0018] Step 1.3: Sort all features according to their information gain ratio, and select the top 40% of features as the candidate feature set to reduce the search space of the genetic algorithm.

[0019] Preferably, step 2 specifically includes the following steps:

[0020] Step 2.1: Transform the selection problem of candidate feature subsets into a combinatorial optimization problem. Assume that the candidate feature set contains... Each feature is represented by a binary string of length t, which encodes a subset of the features.

[0021]

[0022] in, Represents an individual of a feature subset. Indicates whether the i-th feature is selected in this individual:

[0023] This indicates that the i-th feature is selected. This indicates that the feature is discarded;

[0024] Step 2.2: Construct a fitness function to simultaneously measure the classification performance and compression effect of the feature subset, guiding the search direction. The fitness function is defined as follows:

[0025]

[0026] in, This represents the accuracy obtained by training the classifier using the selected features. Let N represent the dimension of the subset, N be the total number of features, and α and β be the weighting coefficients that balance precision and feature quantity, satisfying α + β = 1;

[0027] Step 2.3: After calculating the fitness value of each individual, the parent generation is selected by roulette wheel selection based on the fitness value. Then, new individuals are generated by randomly exchanging parent coding fragments using two-point crossover to increase diversity. The new individuals are then subjected to bit flip mutation with a probability of 0.01 to 0.1 to form a new population and update the population.

[0028] Step 2.4: Repeat step 2.3 until the preset number of iterations is reached or the fitness converges. Finally, select the feature subset corresponding to the individual with the highest fitness as the optimal solution for subsequent model training and anomaly detection.

[0029] Preferably, step 3 specifically includes the following steps:

[0030] Step 3.1: Use the optimal feature subset selected by the genetic algorithm as the input features of the bidirectional LSTM neural network to construct an abnormal traffic detection model based on the bidirectional long short-term memory network;

[0031] Step 3.2: The bidirectional LSTM consists of two LSTM layers: forward and backward. Its computation process includes:

[0032] Forward LSTM output sequence:

[0033]

[0034] Backward LSTM output sequence:

[0035]

[0036] Two-way hidden state splicing:

[0037]

[0038] in, It is the output of the "forward" LSTM unit. It is the output of the "backward" LSTM unit. This represents vector concatenation, where t represents the current layer number, and x represents the vector concatenation. t This represents the input from the current preceding layer;

[0039] Step 3.3: Extract the concatenated hidden state h from the end of the time series. t As a whole sequence representation, the classification probability is output through the fully connected layer and the Softmax layer:

[0040]

[0041] Among them, W yIt is the weight matrix of the Softmax layer, b y It is the bias vector of the Softmax layer. This is the predicted classification probability distribution, and the training objective is defined using the cross-entropy loss function:

[0042]

[0043] in, It is the number of categories. It is the i-th type indicator of the real label. It represents the predicted probability, and γ represents the hyperparameter. These are class weights, used to handle class imbalance;

[0044] Step 3.4: Divide the preprocessed network traffic samples into training and validation sets, and input the optimal feature subset of the samples in the training set into the constructed abnormal traffic detection model; calculate the predicted probability distribution output by the abnormal traffic detection model through forward propagation, and calculate the loss value based on the cross-entropy loss function defined in Step 3.3; then, use the time backpropagation algorithm to perform reverse gradient update on the network parameters, and use the optimization algorithm to iteratively adjust the weight matrix and bias parameters of each layer to minimize the loss function;

[0045] During training, hyperparameters are set, including learning rate, batch size, and maximum number of iterations. At the same time, the performance of the abnormal traffic detection model is periodically evaluated using a validation set. The learning rate is dynamically adjusted or an early stopping mechanism is enabled to prevent overfitting based on the validation results. When the loss function converges or the preset number of iterations is reached, the trained bidirectional LSTM abnormal traffic detection model is obtained.

[0046] Preferably, step 4 specifically includes:

[0047] Based on the abnormal traffic detection model trained in step 3, the confusion matrix is ​​used to evaluate the model performance, and the following key indicators are calculated to conduct a comprehensive quantitative analysis of the model's classification effect:

[0048]

[0049]

[0050]

[0051] Wherein, TP represents the number of samples that the model accurately detects and correctly identifies the class; FN represents the number of samples that the model incorrectly identifies the labeled class; Precision represents the proportion of samples that the model predicts as positive but are actually positive; Recall represents the proportion of samples that are actually positive but were correctly predicted as positive by the model; and F1 represents the harmonic mean of Precision and Recall.

[0052] Preferably, step 5 specifically includes the following steps:

[0053] Step 5.1: After the abnormal traffic detection model is trained, deploy the abnormal traffic detection model optimized by the genetic algorithm on the target monitoring device or server.

[0054] Step 5.2: After preprocessing, the real-time collected network traffic data is divided into a state vector sequence according to the set time window or data packet window, and each sequence is input into the deployed abnormal traffic detection model for classification and judgment.

[0055] Step 5.3: Accumulate and statistically analyze the abnormal detection results of the same traffic. Set a threshold based on historical normal traffic. When the cumulative abnormal count exceeds the threshold, determine that the traffic is abnormal and trigger an alarm or execute subsequent response measures.

[0056] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0057] 1. This method integrates the advantages of genetic algorithms in feature selection and parameter optimization with the efficient processing of sequence data and excellent interpretability of Bidirectional Long Short-Term Memory (BiLSTM) networks, constructing a lightweight and traceable intrusion detection framework. By simultaneously optimizing feature subsets and model hyperparameters using genetic algorithms, the model's performance and generalization ability are effectively improved. Meanwhile, the Bidirectional LSTM structure can fully capture the temporal dependencies in network traffic data, further enhancing the ability to identify and interpret complex attack behaviors.

[0058] 2. By using genetic algorithms to filter traffic features and optimize rules, the generalization ability and accuracy of the detection model are improved. At the same time, a real-time processing mechanism is designed to use only key features for training and inference, which significantly reduces model complexity and response latency.

[0059] 3. Compared with existing deep learning methods, this method balances accuracy, interpretability, and system responsiveness, making it suitable for network security scenarios with limited resources or high requirements for response speed. It has good practical significance and application prospects. Attached Figure Description

[0060] Figure 1 This is a flowchart of the method according to an embodiment of the present invention;

[0061] Figure 2 A neural network architecture based on genetic algorithms and bidirectional long short-term memory networks. Detailed Implementation

[0062] The present invention will be further illustrated below with reference to specific embodiments. These embodiments are implemented based on the technical solutions of the present invention, and it should be understood that these embodiments are only used to illustrate the present invention and are not intended to limit the scope of the present invention.

[0063] like Figure 1 As shown, a real-time network intrusion detection method based on genetic algorithms and bidirectional long short-term memory networks includes the following steps:

[0064] Step 1: Extract network traffic features, including continuous and categorical types, from the selected network anomaly detection benchmark dataset (public datasets such as KDD Cup 1999, NSL-KDD, or CIC-IDS), perform feature preprocessing, and conduct initial screening using information gain ratio. This includes the following steps:

[0065] Step 1.1: Preprocess the constructed network traffic dataset. First, divide the features into continuous and categorical features according to their attribute types. For continuous features, perform a standardization process. First, use min-max normalization to map the values ​​to the [0,1] interval. Then, combine the Z-score method (a common data standardization method based on standard deviation, which converts the original data into a distribution with a mean of 0 and a standard deviation of 1 by (x-μ) / σ, where x represents the original feature value, μ represents the mean of all samples of the feature, and σ represents the standard deviation) to adjust it to zero mean and unit variance to eliminate the influence of dimensions. For categorical features, use one-hot encoding to convert them into sparse vector form to ensure that all features have a consistent numerical expression format. After this step, the original network data is converted into a uniformly structured input vector, which serves as the basis for subsequent feature evaluation.

[0066] Step 1.2: Based on the numericalized feature vectors and their corresponding known anomaly detection labels, where the labels are derived from the labeled training dataset, the Information Gain Ratio (IGR) is used as the evaluation metric, utilizing classification contribution. IG is defined as the difference between the information entropy of the parent node and the conditional entropy of the child node, i.e., Information Gain (IG). The Information Gain Ratio (IGR) is the ratio of Information Gain (IG) to feature entropy. Information Gain is used to measure the degree of decrease in information entropy caused by feature partitioning, while the Information Gain Ratio is used to correct the impact of the number of feature values ​​on IG, improving the fairness of the evaluation. It is calculated using the following formula:

[0067]

[0068] Where X represents the feature to be evaluated, Y represents the label of the anomaly detection, IG(X) represents the entropy of feature X itself, H(X) represents the entropy of label Y, H(Y|X) represents the conditional entropy, H(Y) represents the entropy of label Y, and IGR(X) represents the information gain. Let p represent the entropy of feature X, where p k Let be the probability that feature X takes the k-th value, and n represent the total number of values ​​that feature X can take to be evaluated.

[0069] Step 1.3: Sort all features according to their information gain ratio, and select the top 40% of features as the candidate feature set to reduce the search space of the genetic algorithm and improve the accuracy and generalization ability of the detection model.

[0070] Step 2: Feature selection optimization based on genetic algorithm. Feature selection is modeled as a combinatorial optimization problem. The feature subset is binary encoded using a genetic algorithm, and the fitness function is optimized using operations such as roulette wheel selection, double-point crossover, and bit-flip mutation. This selects the optimal feature combination with high accuracy and low dimensionality. Specifically, the steps are as follows:

[0071] Step 2.1: Transform the candidate feature set selection problem into a combinatorial optimization problem. Assume the candidate feature set contains... Each feature is represented by a binary string of length t, which encodes a subset of the features.

[0072]

[0073] in, It represents a subset of features (i.e., a possible combination of features). Indicates whether the i-th feature is selected in this individual: This indicates that the i-th feature is selected. This indicates that the feature has been discarded.

[0074] Step 2.2: Construct a fitness function to simultaneously measure the classification performance and compression effect of the feature subset, guiding the search direction. The fitness function is defined as follows:

[0075]

[0076] in, This represents the accuracy obtained by training the classifier using the selected features. Let N represent the dimension of the subset, N be the total number of features, and α and β be the weighting coefficients that balance precision and feature quantity, satisfying α + β = 1;

[0077] Step 2.3: After calculating the fitness value of each individual, the parent is selected based on the fitness value using Roulette Wheel Selection (a genetic algorithm-based individual selection strategy). In this strategy, the higher the fitness value of an individual, the greater its probability of being selected (high-performing individuals are distinguished by their high fitness values; typically, individuals with fitness values ​​in the top 10%-20% are considered high-performing individuals). Next, a two-point crossover is used to randomly exchange parent encoding fragments to generate new individuals to increase diversity. The new individuals are then subjected to bit-flip mutation with a low probability (usually set between 0.01 and 0.1) to avoid getting trapped in local optima, forming a new population to update the existing population.

[0078] Step 2.4: Repeat step 2.3 until the preset number of iterations is reached or the fitness converges. Finally, select the feature subset corresponding to the individual with the highest fitness as the optimal solution for subsequent model training and anomaly detection.

[0079] Step 3: Construct and train an abnormal traffic monitoring model. A bidirectional LSTM (Long Short-Term Memory) algorithm is used to construct the abnormal traffic detection model based on a feature subset selected by a genetic algorithm. This model is used to identify normal and abnormal samples in network traffic. Specifically, this includes the following steps:

[0080] Step 3.1: Use the optimal feature subset selected by the genetic algorithm as the input features of the bidirectional LSTM neural network to construct an abnormal traffic detection model based on the bidirectional long short-term memory network;

[0081] Step 3.2: Bidirectional LSTM (BiLSTM) consists of two LSTM layers: forward and backward. W1 and W2 are the weight matrices for the input and forget gates in the forward LSTM layer, respectively; W5 and W6 are the weight matrices for the input and forget gates in the backward LSTM layer, respectively (e.g., ...). Figure 2 (as shown); its calculation process includes:

[0082] Forward LSTM output sequence:

[0083]

[0084] Inverse LSTM output sequence:

[0085]

[0086] Two-way hidden state splicing:

[0087]

[0088] in, It is the output of the "forward" LSTM unit. It is the output of the "backward" LSTM unit. This represents vector concatenation, where t represents the current layer number, and x represents the vector concatenation. t Indicates the input of the current layer.

[0089] Step 3.3: Extract the concatenated hidden state h from the end of the time series. t As a whole sequence representation, the classification probability is output through the fully connected layer and the Softmax layer:

[0090]

[0091] Among them, W y It is the weight matrix of the Softmax layer, b y It is the bias vector of the Softmax layer. This is the predicted classification probability distribution, and the training objective is defined using the cross-entropy loss function:

[0092]

[0093] in, It is the number of categories. It is the i-th type indicator (0 or 1) of the real label. It represents the predicted probability, and γ represents the hyperparameter. These are class weights, used to handle class imbalance.

[0094] Step 3.4: Divide the preprocessed network traffic samples into training and validation sets according to a certain ratio. Input the optimal feature subset of the samples in the training set into the constructed bidirectional LSTM model. Calculate the predicted probability distribution output by the model through forward propagation, and calculate the loss value based on the cross-entropy loss function defined in Step 3.3. Subsequently, use the Backpropagation Through Time (BPTT) algorithm to update the network parameters using backward gradients, and use optimization algorithms (such as Adam or SGD) to iteratively adjust the weight matrices and bias parameters (including W1, W2, W5, W6, W...) of each layer. y and b y (etc.) to minimize the loss function;

[0095] During training, hyperparameters such as learning rate, batch size, and maximum number of iterations can be set. At the same time, the model performance is periodically evaluated using the validation set, and the learning rate is dynamically adjusted or an early stopping mechanism is enabled to prevent overfitting based on the validation results. When the loss function converges or the preset number of iterations is reached, the trained bidirectional LSTM abnormal traffic detection model is obtained.

[0096] Step 4: Evaluate performance using relevant metrics from the confusion matrix, specifically including:

[0097] Based on the abnormal traffic detection model trained in step 3, a confusion matrix is ​​used to evaluate the model's performance. The following key indicators are calculated to provide a comprehensive quantitative analysis of the model's classification effectiveness:

[0098]

[0099]

[0100]

[0101] Wherein, TP represents the number of samples that the model accurately detects and correctly identifies the class; FN represents the number of samples that the model incorrectly identifies the labeled class; Precision represents the proportion of samples that the model predicts as positive but are actually positive, used to measure the accuracy of the prediction; Recall represents the proportion of samples that are actually positive but are correctly predicted as positive by the model, used to measure the model's ability to identify positive classes; and F1-Score is the harmonic mean of Precision and Recall, used to comprehensively evaluate the overall performance of the model under class imbalance conditions.

[0102] Step 5, Deployment and real-time detection of the network anomaly detection model, specifically includes the following steps:

[0103] Step 5.1: After the abnormal traffic detection model is trained, the decision tree classifier optimized by the genetic algorithm is deployed on the target monitoring device or server.

[0104] Step 5.2: After preprocessing, the real-time collected network traffic data is divided into a state vector sequence according to the set time window or data packet window, and each sequence is input into the deployed abnormal traffic detection model for classification and judgment.

[0105] Step 5.3: Accumulate and statistically analyze the anomaly detection results of the same level, set a threshold based on historical normal traffic, and determine that the traffic is abnormal when the cumulative anomaly count exceeds the threshold, trigger an alarm or execute subsequent response measures.

[0106] In the real-time detection phase, the real-time collected network traffic data is processed through the same preprocessing and feature selection process and then input into the trained abnormal traffic detection model, which outputs traffic classification results. The abnormal traffic detection model issues alarms for detected abnormal traffic and supports an online feedback mechanism to dynamically adjust the genetic algorithm parameters and model structure to achieve adaptive optimization.

[0107] The system also incorporates an online feedback mechanism, enabling dynamic adjustment of genetic algorithm parameters and model structure based on actual detection results, achieving continuous self-optimization. The specific process includes: real-time monitoring of model prediction results and confidence levels, accumulating feedback data through manual review or rule engine verification, and evaluating the model's current performance; periodically or trigger-based adjustment of parameters such as crossover rate and mutation rate in the genetic algorithm based on feedback, iteratively optimizing feature subsets and hyperparameters within a preset search space; automatically fine-tuning the model structure based on performance indicators such as accuracy and false positive rate, such as increasing or decreasing the number of network layers or hidden units, and optimizing attention weights to improve responsiveness to new abnormal patterns; and incremental training using newly arrived confirmed samples, periodically updating model parameters to continuously enhance the model's generalization and robustness in real-world environments.

[0108] To verify the effectiveness of the real-time network intrusion detection method proposed in this embodiment, an experiment was designed and implemented. The experiment included several parts, such as dataset selection, experimental platform configuration, pseudo-anomaly sample generation, model construction, and performance evaluation. Specifically, it included:

[0109] This experiment was conducted on a high-performance computing device with the following configuration: AMD Ryzen 5 5600X processor, 64GB of RAM, and an NVIDIA GeForce RTX 3090 graphics card. Model development and training were performed using Python, implemented and optimized based on the PyTorch deep learning framework. The network traffic dataset used in the experiment was the KDD Cup 1999 public dataset. The following key metrics were calculated to provide a comprehensive quantitative analysis of the model's classification performance.

[0110] (1) Accuracy: The proportion of traffic correctly classified based on the total number of classifications. The higher the value, the better the performance.

[0111]

[0112] (2) Precision: The classification ratio of a given category is actually the correct ratio. The higher the value, the better the performance.

[0113]

[0114] (3) Recall: The class condition precision of classified traffic and total traffic. The higher the value, the better the performance.

[0115]

[0116] (4) F1-Score: This indicates the effectiveness of precision and recall when measuring the accuracy of the model. The larger the value, the better the performance.

[0117]

[0118] Wherein, TP: the number of samples accurately detected and labeled as class X by the model; FP: the number of samples incorrectly labeled as class X by the model; FN: the number of samples incorrectly labeled as class Not-X by the model; TN: the number of samples accurately detected and labeled as class Not-X by the model.

[0119] The table below shows the accuracy on the KDD Cup 1999 dataset.

[0120] Table 1. Accuracy on the KDD Cup 1999 dataset

[0121]

[0122] Experimental Results Analysis: The experimental results demonstrate the effectiveness and superiority of the proposed method in network anomaly detection tasks. By introducing information gain ratio feature initial screening, genetic algorithm optimization selection, and the synergistic effect of the BiLSTM deep detection model, this method shows significant advantages in multiple evaluation metrics (in Table 1, SVM-based refers to a machine learning model built with Support Vector Machine (SVM) as the core algorithm, RandomForest is a random forest, 1D-CNN is a one-dimensional convolutional neural network, and LSTM is a long short-term memory network), possessing the feasibility for practical deployment and application.

[0123] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A real-time network intrusion detection method based on genetic algorithm and bidirectional long short-term memory network, characterized in that, Includes the following steps: Step 1: Extract network traffic features, including continuous and categorical features, from the network anomaly detection benchmark dataset, perform feature preprocessing, and use information gain ratio for initial screening; Step 2: Feature selection optimization based on genetic algorithm. Feature selection is modeled as a combinatorial optimization problem. The feature subset is binary encoded by genetic algorithm, and the fitness function is optimized by roulette wheel selection, double crossover and bit flip mutation operation to select the optimal feature combination with high accuracy and low dimensionality. Step 3: Construct and train an abnormal traffic detection model. Use a bidirectional LSTM algorithm to construct an abnormal traffic detection model based on the feature subset selected by the genetic algorithm, which is used to identify normal and abnormal samples in network traffic. Step 4: Evaluate the performance of the abnormal traffic detection model using a confusion matrix; Step 5: Deployment and real-time detection of the abnormal traffic detection model; Step 2 specifically includes the following steps: Step 2.

1. Transform the selection problem of the candidate feature subset into a combinatorial optimization problem, assuming that the candidate feature set contains features, represent the feature subset feature individual code using a binary string of length t: ； wherein, denotes an individual of a feature subset, denotes whether the i-th feature is selected in the individual: = 1 means the i-th feature is selected, = 0 means the feature is discarded; Step 2.2: Construct a fitness function to simultaneously measure the classification performance and compression effect of the feature subset, guiding the search direction. The fitness function is defined as follows: ； wherein, denotes the accuracy rate obtained by training the classifier using the selected features, denotes the dimension of the subset, N is the total number of features, and α and β are weight coefficients for balancing the precision and the number of features, satisfying α + β = 1. Step 2.3: After calculating the fitness value of each individual, the parent generation is selected by roulette wheel selection based on the fitness value. Then, new individuals are generated by randomly exchanging parent coding fragments using two-point crossover to increase diversity. The new individuals are then subjected to bit flip mutation with a probability of 0.01 to 0.1 to form a new population and update the population. Step 2.4: Repeat step 2.3 until the preset number of iterations is reached or the fitness converges. Finally, select the feature subset corresponding to the individual with the highest fitness as the optimal solution for subsequent model training and anomaly detection. Step 3 specifically includes the following steps: Step 3.1: Use the optimal feature subset selected by the genetic algorithm as the input features of the bidirectional LSTM neural network to construct an abnormal traffic detection model based on the bidirectional long short-term memory network; Step 3.2: The bidirectional LSTM consists of two LSTM layers: forward and backward. Its computation process includes: Forward LSTM output sequence: ； Backward LSTM output sequence: ； Two-way hidden state splicing: ； in, It is the output of the "forward" LSTM unit. It is the output of the "backward" LSTM unit. This represents vector concatenation, where t represents the current layer number, and x represents the vector concatenation. t Indicates the input of the current layer; Step 3.3, take the concatenation hidden state h at the end of the time sequence t As the overall representation of the sequence, access the fully connected layer and the Softmax layer to output the classification probability: ； Among them, W y It is the weight matrix of the Softmax layer, b y It is the bias vector of the Softmax layer. This is the predicted classification probability distribution, and the training objective is defined using the cross-entropy loss function: ； in, It is the number of categories. It is the i-th type indicator of the real label. It represents the predicted probability, and γ represents the hyperparameter. These are class weights, used to handle class imbalance; Step 3.4: Divide the preprocessed network traffic samples into training and validation sets, and input the optimal feature subset of the samples in the training set into the constructed abnormal traffic detection model; calculate the predicted probability distribution output by the abnormal traffic detection model through forward propagation, and calculate the loss value based on the cross-entropy loss function defined in Step 3.3; then, use the time backpropagation algorithm to update the network parameters with backward gradient, and use the optimization algorithm to iteratively adjust the weight matrix and bias parameters of each layer to minimize the loss function; During training, hyperparameters are set, including learning rate, batch size, and maximum number of iterations. At the same time, the performance of the abnormal traffic detection model is periodically evaluated using a validation set. The learning rate is dynamically adjusted or an early stopping mechanism is enabled to prevent overfitting based on the validation results. When the loss function converges or the preset number of iterations is reached, the trained bidirectional LSTM abnormal traffic detection model is obtained.

2. The real-time network intrusion detection method based on genetic algorithm and bidirectional long short-term memory network according to claim 1, characterized in that, Step 1 specifically includes the following steps: Step 1.1: Preprocess the constructed network traffic dataset. First, divide the features into continuous and categorical features according to their attribute types. For continuous features, perform a standardization process: first, use min-max normalization to map the values ​​to the [0,1] interval, and then use the Z-score method to adjust them to zero mean and unit variance to eliminate the influence of dimensions. For categorical features, use one-hot encoding to convert them into sparse vector form to ensure that all features have a consistent numerical expression format. After this step, the original network data is converted into a uniformly structured input vector, which serves as the basis for subsequent feature evaluation. Step 1.2: Based on the generated numerical feature vectors, calculate the classification contribution of each feature relative to the label, using information gain ratio as the evaluation metric. Information gain is defined as the difference between the information entropy of the parent node and the conditional entropy of the child node, and information gain ratio is the ratio of information gain to feature entropy. Information gain measures the degree of decrease in information entropy caused by feature partitioning, while information gain ratio corrects for the impact of the number of feature values ​​on information gain, improving the fairness of the evaluation. It is calculated using the following formula: ； Where X represents the feature to be evaluated, Y represents the label of the anomaly detection, IG(X) represents the entropy of feature X itself, H(X) represents the entropy of feature X, H(Y|X) represents the conditional entropy, H(Y) represents the entropy of label Y, and IGR(X) represents the information gain. , where p k Let X be the probability of taking the kth value, and n represent the total number of possible values ​​for the feature X to be evaluated. Step 1.3: Sort all features according to their information gain ratio, and select the top 40% of features as the candidate feature set to reduce the search space of the genetic algorithm.

3. The real-time network intrusion detection method based on genetic algorithm and bidirectional long short-term memory network according to claim 1, characterized in that, Step 4 specifically includes: Based on the abnormal traffic detection model trained in step 3, the confusion matrix is ​​used to evaluate the model performance, and the following key indicators are calculated to conduct a comprehensive quantitative analysis of the model's classification effect: ； ； ； Wherein, TP represents the number of samples that the model accurately detects and correctly identifies the class; FN represents the number of samples that the model incorrectly identifies the labeled class; Precision represents the proportion of samples that the model predicts as positive but are actually positive; Recall represents the proportion of samples that are actually positive but were correctly predicted as positive by the model; and F1 represents the harmonic mean of Precision and Recall.

4. The real-time network intrusion detection method based on genetic algorithm and bidirectional long short-term memory network according to claim 1, characterized in that, Step 5 specifically includes the following steps: Step 5.1: After the abnormal traffic detection model is trained, deploy the abnormal traffic detection model optimized by the genetic algorithm on the target monitoring device or server. Step 5.2: After preprocessing, the real-time collected network traffic data is divided into a state vector sequence according to the set time window or data packet window, and each sequence is input into the deployed abnormal traffic detection model for classification and judgment. Step 5.3: Accumulate and statistically analyze the abnormal detection results of the same traffic. Set a threshold based on historical normal traffic. When the cumulative abnormal count exceeds the threshold, determine that the traffic is abnormal and trigger an alarm or execute subsequent response measures.

Images