Network intrusion detection method based on CKAN-BiLSTM

Abstract

The invention requests to protect a network intrusion detection method based on a CKAN-BiLSTM (Content Kernel Area Network-BiLSTM). The method comprises the following steps: firstly, selecting an NSL-KDD data set widely applied in the field of network security, and performing preprocessing operation on the NSL-KDD data set to improve data quality and a model training effect; then, feature extraction is carried out on input data through a convolutional layer, size adjustment is carried out on features in combination with an adaptive pooling mechanism, and the perception ability of the model to a local mode is enhanced; secondly, inputting the extracted features into a BiLSTM network to fully capture a time sequence dependency relationship in the BiLSTM network; and finally, Kolmogorov-Arnold Network (KAN) is introduced to carry out weighted fusion on the key features, final attack type classification is completed, and efficient and accurate intrusion detection is realized.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of Internet of Things security, and particularly relates to a network intrusion detection method and system based on convolutional Kolmogorov-Arnold network (CKAN) and bidirectional long short-term memory network (BiLSTM) fusion. BACKGROUND

[0002] With the rapid popularization of Internet of Things (IoT) technology, intelligent terminal devices have deeply penetrated into key fields such as smart home, industrial automation, and smart medical care, and gradually become indispensable infrastructure components in these scenarios. However, these devices have limited computing power and are usually operated in an open network environment, which makes them easy targets of network attacks, especially in the face of large-scale and complex network environments, devices are more vulnerable to security threats such as denial of service attacks (DDoS) and man-in-the-middle attacks. Therefore, how to prevent network attacks and protect edge IoT devices has become a problem to be solved.

[0003] As an effective means to protect network and information system security, intrusion detection systems (IDS) are widely used in network anomaly traffic detection and identification. In recent years, various algorithms based on machine learning have gradually played a role in IDS to solve problems in network security. Traditional machine learning methods include eXtreme Gradient Boosting (XGBoost), random forest (RF), etc. However, with the increasing number of network attack categories, traditional machine learning methods have limited expression ability for complex functions, weak generalization ability, and difficulty in extracting deep features, so IDS relying only on traditional machine learning cannot detect intrusion behavior. Intrusion detection algorithms based on deep learning can deeply mine and extract abstract and multi-level features in data due to their strong automatic learning and complex computing capabilities, and are widely used in the field of intrusion detection. However, deep learning methods usually rely on a large amount of labeled data, and the training and inference process has large computational overhead, which is not suitable for direct deployment on resource-constrained edge devices; at the same time, existing detection models are single and have low detection efficiency. Therefore, in order to quickly detect abnormal traffic at the edge, a detection model with low hardware resource requirement and high detection efficiency is urgently needed.

[0004] The intrusion detection method fusing convolutional neural network (CNN) and bidirectional long short-term memory (BiLSTM) network can detect new attack patterns. However, it usually involves a large data model, thus requiring a large amount of computing resources, and is not feasible for deployment on resource-limited edge devices. Therefore, a new efficient and lightweight model is needed to solve these shortcomings. CKAN network is a new convolution method that extends convolution operation to KAN (Kolmogorov-Arnold network) neural network. KAN network adopts a learnable activation function on each edge, which allows the network to adaptively optimize the ability to process various complex data patterns. Therefore, the CKAN-BiLSTM model can effectively overcome the limitations of CNN in introducing redundant information due to weight sharing, while having strong time series information capturing ability. When used for intrusion detection, it can improve the accuracy of intrusion detection and reduce the false positive rate, and maintain high detection performance and real-time response capability under the condition of limited resources of edge IoT devices.

[0005] After searching, the application publication number CN113518063B, a network intrusion detection method and system based on data enhancement and BiLSTM, solves the problem of low accuracy of existing network intrusion detection methods in detecting and identifying a small number of attack sample intrusion. First, collect network intrusion detection traffic data, then perform preliminary feature extraction, form a training data set, confirm the attack type data sample with small data volume, then perform data enhancement, then build a BiLSTM neural network model and perform iterative learning training, the model automatically extracts higher level feature information, can better handle high-dimensional nonlinear network traffic features, overcome the limitations of manual feature extraction in traditional shallow machine learning, and the data enhancement operation can solve the problem of uneven class distribution in the training data set, so that the model improves the recognition accuracy of the minority class attack sample while maintaining high overall detection rate and low false positive rate.

[0006] The above invention enhances data in view of sample imbalance, and then uses BiLSTM neural network for iterative learning and training to extract higher-level features of the model. This method does not consider the calculation complexity of the model, and the requirement of computing resources and storage space in the process of training the model. Based on the above problems, the present application provides a network intrusion detection method based on CKAN-BiLSTM. The input data is feature extracted through a convolutional layer, and the size of the feature is adjusted by combining an adaptive pooling mechanism, enhancing the model's ability to perceive local patterns and reducing the feature dimension; then, the extracted features are input into the BiLSTM network to fully capture the time sequence dependence relationship therein; finally, the Kolmogorov-Arnold Network (KAN) is introduced to weight and fuse the key features, and the final attack type classification is completed, realizing efficient and accurate intrusion detection. SUMMARY

[0007] The present application aims to solve the problems of the prior art. A network intrusion detection method based on CKAN-BiLSTM is proposed. The technical scheme of the present application is as follows:

[0008] A network intrusion detection method based on CKAN-BiLSTM, comprising the following steps:

[0009] Step one: data preprocessing of the public experimental data set NSL-KDD;

[0010] Step two: network intrusion detection method based on convolutional Kolmogorov-Arnold network-bidirectional long short-term memory network CKAN-BiLSTM, comprising: convolutional feature extraction and BiLSTM sequence analysis step: Kolmogorov-Arnold network (KAN) layer; reverse fine-tuning step;

[0011] Step three: model prediction: input the test set into the CKAN-BiLSTM network model for detection, and output the corresponding classification result, so as to accurately identify different types of network attack behaviors.

[0012] Further, the step one: data preprocessing of the NSL-KDD data set, specifically comprising:

[0013] First, map the discrete symbolic features to numerical data, and use One-Hot one-hot encoding to convert each category to the corresponding binary numerical feature, then scale each feature to a unified range through Min-Max normalization.

[0014] Further, the convolutional feature extraction and BiLSTM sequence analysis step of step two specifically comprises:

[0015] First, the input data is sent to the first convolutional layer, using 32 3x3 convolution kernels to extract basic features, and introducing non-linear representation ability through the ReLU activation function; then, the data enters the second convolutional layer, using 64 2x2 convolution kernels to extract deeper features, also using the ReLU function to enhance the non-linear modeling ability of the model; then, the feature map is size-adjusted through the adaptive pooling layer to ensure the consistency of the input dimensions required by the subsequent network structure; finally, the extracted high-order features are input into the BiLSTM network, which simultaneously learns the forward and reverse information of the time series through the bidirectional structure of the network, thereby more comprehensively modeling the sequence dependency.

[0016] Further, the KAN layer of step two specifically includes:

[0017] The input features are processed using a learnable univariate function, i.e., parameterized as a spline function, to replace the multilayer perceptron (MLP), and in the KAN layer, the 64-dimensional output x1 to x 64 of the previous layer is mapped to the required output dimension using the following formula:

[0018]

[0019] where q represents the number of unit functions, p represents the number of input units, n represents the input feature dimension, φ q,p (x p ) represents the Kolmogorov-Arnold representation theorem (KART), and φ q represents a univariate function in the second layer of the KART network.

[0020] After the above mapping, the 64 outputs of the previous layer are mapped to 64 unit functions φ1 to φ 64 , which are added to obtain a multivariate function f(x1,...,x 64 ); the final prediction result is derived using this function; the core of the KAN network is to learn each non-linear unit function; the learning process can be described by the formula:

[0021]

[0022] where w represents the learnable parameter, spline(x) represents the linear combination of B-spline functions, c i represents the learnable parameter; b(x) represents the linear activation function unit; B i (x) represents the B-spline function.

[0023] In the formula, each nonlinear unit function φ(x) is defined by adding a B-spline function spline(x) to a silu(x) function and then scaling it with a learnable parameter w to ensure the smoothness of φ(x); wherein the most important part is spline(x), which is a B-spline function; the KAN network adopts a cubic B-spline function.

[0024] Further, the reverse fine-tuning step specifically comprises:

[0025] The difference between the model prediction output and the real attack type label is calculated by the loss function to obtain a specific loss value; then, by means of the back propagation algorithm, the error is transmitted from the output layer to the input layer, and the influence degree of each layer network parameter on the error, i.e., the gradient value, is calculated simultaneously; then, according to the gradient information, the network weight parameter is updated by using the optimization strategy to reduce the loss; by continuously repeating the iteration process of "calculating loss-transmitting error-updating parameter", the model continuously adjusts the internal parameters and feature representation, and finally improves the recognition accuracy of known attack types to realize more accurate classification effect.

[0026] A storage medium internally stores a computer program, and when the computer program is read by a processor, the network intrusion detection method based on CKAN-BiLSTM described in any of the above is executed.

[0027] 1. The present application introduces a lighter CKAN-BiLSTM model, which significantly reduces the consumption of computing resources and the demand for storage space on the edge device of the Internet of Things, thereby improving the efficiency of model operation and realizing effective saving of energy consumption, while ensuring efficient abnormal traffic detection.

[0028] 2. By optimizing the convolution feature extraction of CKAN and the time series modeling capability of BiLSTM, the present application significantly reduces the false positive rate (FPR) and improves the accuracy of abnormal traffic identification, avoiding the frequent alarm problem in the traditional IDS

[0029] Method, thereby enhancing the practical availability and reliability of the intrusion detection system.

[0030] 3. Unlike the traditional IDS technology which relies on a fixed attack feature library, the present application combines the dynamic learning ability of CKAN and BiLSTM to adapt to new and variant attack patterns in real time, thereby improving the detection capability of unknown threats and ensuring flexible response to complex attacks.

[0031] 4. The present application realizes efficient extraction and fusion of multi-level features by combining the convolution feature extraction of CKAN and the time series modeling of BiLSTM, thereby improving the detection accuracy and simplifying the operation process,

[0032] The complexity of system debugging and maintenance is reduced, and the model is more easily deployed and used.

[0033] The existing IDS usually relies on a large amount of computing resources and storage space when deployed, which cannot meet the requirements of edge devices, resulting in difficulty in effective application in resource-limited environments. To solve this problem, in step two of claim 1, the input data is feature extracted through a convolutional layer, and the feature is size adjusted in combination with an adaptive pooling mechanism to enhance the model's ability to perceive local patterns. Then, the extracted features are input into a BiLSTM network to fully capture the time series dependency relationship therein. Through the above steps, the model's demand for computing and storage resources can be reduced. At the same time, in this step, a KAN layer is used instead of a fully connected layer (FCL) in a traditional convolutional neural network. The KAN network uses a learnable activation function on each edge, which allows the network to adaptively optimize the ability to process various complex data patterns. This approach is more flexible and can automatically adjust the adaptability of each node to optimize the feature learning process and improve classification performance. BRIEF DESCRIPTION OF DRAWINGS

[0034] Figure 1 : CKAN-BiLSTM-based network intrusion detection flowchart;

[0035] Figure 2 : CKAN-BiLSTM model structure diagram. DETAILED DESCRIPTION

[0036] The technical solutions in the embodiments of the present application will be described in detail below with reference to the drawings in the embodiments of the present application. The described embodiments are only a part of the embodiments of the present application.

[0037] The technical solution of the present application to solve the above technical problems is:

[0038] The present application aims to solve the above technical problems and proposes a CKAN-BiLSTM-based network intrusion detection method. First, the widely used NSL-KDD dataset in the field of network security is selected and preprocessed to improve data quality and model training effect. Then, the input data is feature extracted through a convolutional layer, and the feature is size adjusted in combination with an adaptive pooling mechanism to enhance the model's ability to perceive local patterns. Then, the extracted features are input into a BiLSTM network to fully capture the time series dependency relationship therein. Finally, a Kolmogorov-Arnold Network (KAN) is introduced to weight and fuse key features, and the final attack type classification is completed to achieve efficient and accurate intrusion detection, as follows:

[0039] 1. Data preprocessing for NSL-KDD

[0040] First, the discrete symbolic features are mapped to numerical data, and One-Hot encoding is used to avoid the order misunderstanding caused by the size of the value. Then, Min-Max normalization is used to scale each feature to a unified range, which enhances the consistency of the discrete symbolic feature mapping and effectively improves the training efficiency and overall performance of the model.

[0041] To facilitate effective identification by the model, some discrete symbolic features (such as service, protocol_type, etc.) are first converted to numerical features.

[0042] One-hot encoding

[0043] Using One-Hot Encoding, each category is converted to the corresponding binary numerical feature, which enhances the model's ability to distinguish different categories.

[0044] Normalization processing

[0045] The following formula is used to normalize the features. In the formula, x max is the maximum value of the sample data, x min is the minimum value of the sample data, x is the original data, and x' is the normalized data.

[0046] x' = x x-x min

[0047] x max -x min

[0048] 2. Network intrusion detection method based on CKAN-BiLSTM

[0049] (1) Convolutional feature extraction and BiLSTM sequence analysis

[0050] Key features are extracted through a convolutional layer, and adaptive pooling is used to adjust the size of the feature map. Then, the processed features are input into the BiLSTM network to capture the bidirectional time sequence dependency in the sequence, thereby enhancing the model's ability to model and predict time sequence information.

[0051] (2) KAN layer

[0052] By introducing the KAN layer, the features extracted by the previous layer are mapped to the target output dimension according to the following formula, achieving nonlinear weighting of features and completion of the classification task.

[0053]

[0054] The output of the previous layer will be mapped to the corresponding unit function, and each unit function represents a learnable nonlinear mapping. The outputs of all unit functions will be weighted and summed, forming a multi-element nonlinear function to generate the final prediction result. The core of the KAN network lies in the modeling and learning of each nonlinear unit function, and the overall learning process can be represented as the following function relationship:

[0055]

[0056] where w represents a learnable parameter, spline(x) represents a B-spline function, and c i represents a learnable parameter.

[0057] 3. Backward fine-tuning

[0058] When the attack type is known, if the classification result of the model is inconsistent with the true label, the model can be optimized through the fine-tuning mechanism. The specific process is as follows: first, the loss function value is calculated based on the difference between the model prediction output and the true label; then, the error is propagated from the output layer to the input layer using the backpropagation algorithm, and the gradient of each layer parameter is calculated; then, the weight parameters in the network are updated according to the gradient information to minimize the loss function. Through continuous iteration of this optimization process, the model gradually adjusts its internal representation and parameters, thereby improving the recognition ability of the known attack type and achieving more accurate classification performance.

[0059] 4. Model prediction

[0060] After the model training is completed, the test set is sent into the network model of the CKAN-BiLSTM to perform model detection, thereby obtaining the classification result and identifying the attack type.

[0061] The system, device, module or unit illustrated in the above embodiments can be specifically implemented by a computer chip or entity, or by a product with certain functions.

[0062] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can implement information storage by any method or technology. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0063] It should also be noted that the terms "comprising", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or apparatus including a series of elements includes not only those elements, but also other elements not explicitly listed or inherent to such a process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus including the element.

[0064] The above embodiments should be understood as only for illustrating the present application and not for limiting the protection scope of the present application. After reading the content of the present application, the skilled in the art can make various changes or modifications to the present application, and these equivalent changes and modifications also fall within the scope defined by the claims of the present application.

Claims

1. A network intrusion detection method based on CKAN-BiLSTM, characterized in that, The method comprises the following steps: Step one: data preprocessing on the public experimental data set NSL-KDD; Step two: constructing a network intrusion detection method of a convolutional Kolmogorov-Arnold network-bidirectional long short-term memory network (CKAN-BiLSTM), comprising: a convolutional feature extraction and BiLSTM sequence analysis step; a Kolmogorov-Arnold network (KAN) layer; and a backward fine-tuning step; Step three: model prediction: inputting a test set into the CKAN-BiLSTM network model for detection, and outputting corresponding classification results, so as to accurately identify different types of network attack behaviors.

2. The CKAN-BiLSTM-based network intrusion detection method according to claim 1, characterized in that, In the step one, the NSL-KDD data set is preprocessed, specifically comprising: First, the discrete symbol features are mapped into numerical data, and the One-Hot one-hot encoding method is used to convert each category into corresponding binary numerical features, and then the Min-Max normalization is used to scale each feature to a unified range.

3. The CKAN-BiLSTM-based network intrusion detection method according to claim 1, characterized in that, The convolutional feature extraction and BiLSTM sequence analysis step of the step two specifically comprises: First, the input data is sent to the first convolutional layer, 32 3x3 convolutional kernels are used to extract basic features, and the ReLU activation function is used to introduce non-linear representation capability; then, the data enters the second convolutional layer, 64 2x2 convolutional kernels are used to extract deeper features, and the ReLU function is also used to enhance the non-linear modeling capability of the model; then, the adaptive pooling layer is used to adjust the size of the feature map to ensure the consistency of the input dimension required by the subsequent network structure; finally, the extracted high-order features are input into the BiLSTM network, and the bidirectional structure of the network is used to simultaneously learn the forward and reverse information of the time sequence, so as to more comprehensively model the sequence dependence relationship.

4. The CKAN-BiLSTM-based network intrusion detection method according to claim 1, characterized in that, The KAN layer of the step two specifically comprises: The input features are processed using a learnable univariate function, i.e., parameterized as a spline function, instead of a multi-layer perceptron (MLP). At the KAN layer, the 64-dimensional output x1to x 64 from the previous layer are mapped to the desired output dimension using the following equation: where q represents the number of unit functions, p represents the number of input units, n represents the input feature dimension, and φ q,p (x p ) represents a unit function of the first layer in a Kolmogorov-Arnold representation theorem (KART) network, and φ q represents a unit function of the second layer in the KART network. After the above mapping, the 64 outputs of the previous layer are mapped to 64 unit functions φ1~φ64 64 The unit functions are added to obtain a multi-unit function f(x1,...,x 64 ); the final prediction result is derived using the function; the core of the KAN network is to learn each nonlinear unit function; the learning process can be described by the formula: where w denotes a learnable parameter, spline(x) denotes a linear combination of B-spline functions, c i denotes a learnable parameter; b(x) denotes a linear activation function unit; B i (x) denotes a B-spline function; In the formula, each nonlinear unit function φ(x) is defined by adding a B-spline function spline(x) to a silu(x) function and then scaling it with a learnable parameter w to ensure the smoothness of φ(x); wherein the most important part is spline(x), which is a B-spline function; the KAN network adopts a cubic B-spline function.

5. The CKAN-BiLSTM-based network intrusion detection method according to claim 1, characterized in that, The backward fine-tuning step specifically comprises: The difference between the model prediction output and the real attack type label is calculated by a loss function to obtain a specific loss value; then, the error is transmitted from the output layer to the input layer by means of the back propagation algorithm, and the influence degree of each layer network parameter on the error, i.e. the gradient value, is calculated simultaneously; then, according to the gradient information, the network weight parameters are updated by using an optimization strategy to reduce the loss; by repeatedly iterating the process of "calculating loss-propagating error-updating parameters", the model continuously adjusts the internal parameters and feature representation, and finally improves the recognition accuracy of the known attack types to achieve more accurate classification effect.

6. A storage medium, which stores a computer program in the inside, characterized by The computer program is read by a processor to execute the network intrusion detection method based on the CKAN-BiLSTM of any one of claims 1-5.

Images