Deep learning-based network intrusion detection method and system

Abstract

This application provides a network intrusion detection method and system based on deep learning. The method includes: capturing raw network traffic data in real time using traffic collectors deployed on network nodes; performing data cleaning, feature standardization, and feature filtering on the raw traffic data to obtain optimized feature vectors; constructing an ensemble model containing base classifiers and meta classifiers, and training the ensemble model using the optimized feature vectors, wherein training the ensemble model includes stacking the prediction results of the base classifiers to form new feature vectors to train the meta classifiers; collecting network traffic features in real time and preprocessing the network traffic features; inputting the preprocessed network traffic feature vectors into the trained ensemble model, and determining the risk of intrusion behavior based on the output probability of the ensemble model, as well as performing risk classification and alarms.

Description

Technical Field

[0001] This application relates to the technical field of network security, specifically to a network intrusion detection method and system based on deep learning. Background Technology

[0002] With the rapid development of network technology, network attack methods are becoming more diversified, covert, and intelligent.

[0003] Traditional network intrusion detection methods are mainly divided into rule-based detection methods and traditional machine learning-based detection methods. Rule-based detection methods rely on manually defined attack feature rule bases, which have weak identification capabilities for unknown and variant attacks, and the rule base maintenance costs are high.

[0004] Traditional machine learning-based detection methods (such as support vector machines, decision trees, and Naive Bayes) can learn attack characteristics autonomously through data training, but they are poorly adapted to high-dimensional, non-linear network traffic data. They struggle to capture temporal dependencies and complex features within traffic data, resulting in low accuracy and high false positive rates when facing complex intrusion behaviors such as distributed denial-of-service (DDoS) attacks or advanced persistent threats (APTs). This makes them insufficient to meet the current complex and ever-changing network security protection needs. Furthermore, many current intrusion detection models treat anomaly detection as a static binary or multi-class classification task, significantly limiting their ability to adapt to new or evolving network threats.

[0005] Therefore, developing dynamic network intrusion detection solutions with high accuracy and low false alarm rate, as well as support for continuous learning and real-time threat identification, has become an urgent problem to be solved in the current network security field. Summary of the Invention

[0006] This application proposes a network intrusion detection method and system based on deep learning to address the shortcomings of the aforementioned prior art.

[0007] According to a first aspect of the embodiments of this application, a network intrusion detection method based on deep learning is provided, comprising: By deploying traffic collectors on network nodes, raw network traffic data is captured in real time. The raw traffic data is subjected to data cleaning, feature standardization, and feature filtering to obtain an optimized feature vector. Construct an ensemble model that includes a base classifier and a meta classifier, and train the ensemble model using the optimized feature vector, wherein training the ensemble model includes stacking the prediction results of the base classifiers to form a new feature vector to train the meta classifier; Real-time acquisition of network traffic characteristics and preprocessing of the network traffic characteristics; The preprocessed network traffic feature vector is input into the trained ensemble model, and the risk of intrusion behavior is determined based on the output probability of the ensemble model, and risk classification and alarm are performed.

[0008] In some implementations, the raw traffic data includes multiple protocol data packets, which include multi-dimensional features such as packet length, protocol type, source and destination IP addresses, port numbers, and time sequences. This includes data captured in real-time after the raw traffic data in the network. The multidimensional features are aggregated and calculated according to network connections to form a dataset; Each record in the dataset corresponds to a network connection and contains a label representing the state of that connection.

[0009] In some implementations, the process of performing data cleaning, feature standardization, and feature filtering on the raw traffic data to obtain an optimized feature vector includes: The classification features of the original traffic data are converted into numerical values ​​using label encoding, and samples with redundant fields and / or missing values ​​exceeding 30% and outlier samples identified by interquartile range are deleted to perform data cleaning on the original traffic data. The Z-Score standardization method is used to map the cleaned data features to an interval with a mean of 0 and a standard deviation of 1, so as to perform feature standardization processing on the original traffic data. The original traffic data is scored based on the feature importance of random forest, and the top 80% of features that contribute to intrusion detection are selected to form the feature vector.

[0010] In some implementations, the base classifier includes a neural network model and a support vector machine model; the neural network model includes an input layer, a hidden layer, and an output layer; the hidden layer has three layers with 256, 128, and 64 nodes respectively, and each of the three layers uses a linear rectified function; the output layer uses a logistic function to output the probability value of normal traffic or intrusion traffic; the support vector machine model uses a radial basis function kernel and is used for boundary separation.

[0011] In some implementations, training the ensemble model using the optimized feature vectors includes: The dataset is divided into a training set, a validation set, and a test set in a ratio of 7:2:1.

[0012] In some implementations, stacking the predictions of the base classifiers to form a new feature vector to train the meta-classifier includes: Based on the random forest algorithm, the prediction results of the base classifiers are stacked to form a new feature vector to train the meta-classifier.

[0013] In some implementations, the step of training the meta-classifier by stacking the prediction results of the base classifiers to form a new feature vector based on the random forest algorithm includes: The predicted probability values ​​of the neural network model and the support vector machine model on the training set are stacked to form a two-dimensional feature vector for each sample; The two-dimensional feature vector is used as the input to generate a new feature vector, and the true label of each sample is used as the output to train and generate a random forest model. The model hyperparameters are optimized by cross-validation combined with the validation set and tested based on the test set. The hyperparameters include the number of trees, tree depth, and minimum number of samples per node.

[0014] In some implementations, the process of stacking the predictions of the base classifiers to form a new feature vector to train the meta classifier includes: An adaptive moment estimation algorithm is adopted, with binary cross-entropy as the loss function, and the neural network model is trained based on a dynamic learning rate adjustment strategy and an early stopping strategy. The parameters of the support vector machine model are tuned based on grid search and the performance of the validation set, and the support vector machine model is trained with the goal of maximizing the validation set score.

[0015] In some implementations, determining the risk of intrusion behavior based on the output probability of the integrated model, and performing risk classification and alerting, includes: When the probability of the target type output by the integrated model is greater than 0.9, the behavior of the target type is determined to be an intrusion behavior; Risk classification is performed based on the degree of hazard of the target type, and warning information is sent to the administrator via audible and visual alarms and SMS notifications. The system automatically records the time, source IP, destination IP, and attack type information of the intrusion event corresponding to the intrusion behavior, and generates a log file.

[0016] According to a second aspect of this application, a deep learning-based network intrusion detection system is provided, comprising: The raw data capture module is used to capture raw traffic data in the network in real time through traffic collectors deployed on network nodes; The feature vector optimization module is used to perform data cleaning, feature standardization, and feature filtering on the original traffic data to obtain optimized feature vectors. An ensemble model training module is used to construct an ensemble model containing base classifiers and meta classifiers, and to train the ensemble model using the optimized feature vectors. The training of the ensemble model includes stacking the prediction results of the base classifiers to form a new feature vector to train the meta classifier. The traffic feature processing module is used to collect network traffic features in real time and preprocess the network traffic features; The risk level processing module is used to input the preprocessed network traffic feature vector into the trained ensemble model, determine the risk of intrusion behavior based on the output probability of the ensemble model, and perform risk classification and alarm.

[0017] The beneficial effects of the deep learning-based network intrusion detection method and system in this application include at least the following: This application embodiment captures raw network traffic data in real time using traffic collectors deployed at network nodes. This provides a comprehensive and timely source of foundational data, offering solid data support for subsequent dynamic analysis and ensuring the timeliness of intrusion detection. Optimized feature vectors are obtained by cleaning, standardizing, and filtering the raw traffic data. This improves the quality and consistency of the input data, significantly enhancing the efficiency and generalization ability of subsequent model processing by removing noise, standardizing data scale, and focusing on key features. An ensemble model containing base classifiers and meta-classifiers is constructed and trained using the optimized feature vectors. This achieves the benefits of model ensemble and stacking. This strategy leverages the strengths of different algorithms to effectively improve the overall model's accuracy in identifying complex intrusion patterns and the reliability of its decisions. By collecting and preprocessing network traffic features in real time, it enables continuous monitoring of the network environment. Real-time data preprocessing ensures that the data flow input to the model remains consistent with the training phase, laying the foundation for real-time detection. By inputting the preprocessed network traffic feature vectors into the trained ensemble model and determining the risk of intrusion behavior based on the output probability of the ensemble model, as well as performing risk classification and alerting, it achieves automated and intelligent identification and assessment of security threats. Furthermore, the hierarchical alerting mechanism optimizes the allocation of security resources and improves emergency response efficiency. Attached Figure Description

[0018] Figure 1 This is a flowchart illustrating the deep learning-based network intrusion detection method according to an embodiment of this application. Figure 2 This is a schematic diagram of the structure of a deep learning-based network intrusion detection system according to an embodiment of this application. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the embodiments of this application, and not all embodiments. The components of the embodiments of this application described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0020] Therefore, the following detailed description of the embodiments of the present application provided in the accompanying drawings is not intended to limit the scope of the claimed embodiments of the present application, but merely to illustrate selected embodiments of the present application. Other embodiments obtained by those skilled in the art based on the embodiments of the present application without inventive effort are all within the scope of protection of the embodiments of the present application.

[0021] It can be noted that similar reference numerals and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it will not be further defined and explained in subsequent figures according to the embodiments of this application.

[0022] This application discloses a deep learning-based network intrusion detection method, which is executed based on a deep learning-based network intrusion detection system. This method is suitable for real-time dynamic intrusion detection in complex network environments such as enterprise LANs and industrial control systems, aiming to solve the technical problems of traditional methods, such as low accuracy in identifying complex intrusion behaviors, high false alarm rates, and difficulty in adapting to dynamic threats. (See attached figure.) Figure 1 As shown, the method includes steps 110-140.

[0023] Step 110: Capture raw network traffic data in real time using traffic collectors deployed on network nodes.

[0024] The raw traffic data includes multiple protocol data packets, which contain multi-dimensional characteristics such as packet length, protocol type, source and destination IP addresses, port numbers, and time sequences.

[0025] In some implementations, after capturing raw traffic data in the network in real time, the process includes aggregating and calculating the multidimensional features by network connection to form a dataset.

[0026] For example, each record in the dataset corresponds to one of the network connections and contains a label representing the state of that connection.

[0027] For example, by deploying traffic collectors on real network nodes, raw network traffic data is captured in real time. This raw traffic data includes TCP, UDP, and ICMP packets, with a collection frequency of at least 1000 packets per second. The collected data includes characteristics such as packet length, protocol type, source / destination IP, port number, and time interval. These characteristics are categorized into three types: basic characteristics (duration, protocol type, service, etc.), content characteristics (number of failed logins, restarts, etc.), and traffic characteristics (packet rate, etc.). Each record in the dataset represents a single network connection and is labeled with an additional tag indicating whether the connection is normal or under attack. If it is under attack, the specific attack type is noted. This step 110 is also known as the network traffic data collection step.

[0028] Step 120: Perform data cleaning, feature standardization, and feature filtering on the original traffic data to obtain the optimized feature vector.

[0029] In some implementations, the original traffic data undergoes data cleaning, feature standardization, and feature selection to obtain an optimized feature vector. This includes: converting the categorical features of the original traffic data into numerical values ​​using label encoding, and deleting samples with redundant fields and / or missing values ​​exceeding 30%, as well as outlier samples identified by the interquartile range method, to perform data cleaning; using the Z-Score standardization method to map the cleaned data features to an interval with a mean of 0 and a standard deviation of 1, to perform feature standardization; scoring the original traffic data after feature standardization based on the feature importance of random forest, and selecting the top 80% of features that contribute to intrusion detection to form the feature vector.

[0030] For example, data cleaning includes: converting categorical features such as "protocol type," "service," and "flag" into numerical values ​​using label encoding; then, removing redundant fields, samples with more than 30% missing values, and outlier samples identified using the interquartile range (IMR) method from the original traffic data. These features are removed because they do not contribute to learning and may reduce the model's generalization ability.

[0031] For example, feature standardization includes: using Z-Score standardization to map the cleaned data features to an interval with a mean of 0 and a standard deviation of 1, ensuring that all features are on a uniform scale, which helps improve model convergence.

[0032] The standardized formula is shown below: z = (x - μ) / σ; Where z represents the standard score, x represents the sample value, μ represents the mean, and σ represents the standard deviation.

[0033] For example, feature selection includes: selecting the top 80% of features contributing to intrusion detection based on the feature importance score of a random forest, forming a feature vector. Preferably, 10 features are retained after feature selection.

[0034] In this embodiment of the application, the data undergoes rigorous preprocessing, and the processing structure is optimized.

[0035] Step 130: Construct an ensemble model containing a base classifier and a meta classifier, and train the ensemble model using the optimized feature vector.

[0036] In some implementations, training the ensemble model includes training a meta-classifier by stacking the predictions of the base classifiers to form a new feature vector.

[0037] In some implementations, the base classifier includes neural network models and support vector machine (SVM) models.

[0038] For example, this neural network model includes an input layer, hidden layers, and an output layer. The hidden layer has three layers with 256, 128, and 64 nodes respectively, and each of these layers uses a linear rectified function. The output layer uses a sigmoid function to output the probability value of normal traffic or intrusion traffic.

[0039] For example, the support vector machine model employs a radial basis kernel function, which is used for boundary separation.

[0040] In some implementations, before training the ensemble model using the optimized feature vector, the dataset is divided into a training set, a validation set, and a test set in a 7:2:1 ratio.

[0041] In some implementations, stacking the predictions of the base classifiers to form a new feature vector to train the meta classifier includes: using a random forest (RF) algorithm to stack the predictions of the base classifiers to form a new feature vector to train the meta classifier.

[0042] For example, the method of training a meta-classifier by stacking the prediction results of the base classifiers to form a new feature vector based on the random forest algorithm includes: stacking the predicted probability values ​​of the neural network model and the support vector machine model on the training set to form a two-dimensional feature vector for each sample; using the two-dimensional feature vector as the input of the new feature vector and the true label of each sample as the output to train and generate a random forest model; and using cross-validation combined with the validation set to optimize the model hyperparameters and testing them based on the test set. The hyperparameters include the number of trees, the tree depth, and the minimum number of samples per node.

[0043] In some implementations, before training the meta-classifier by stacking the predictions of the base classifiers to form a new feature vector, the following steps are included: using an adaptive moment estimation algorithm with binary cross-entropy as the loss function and training the neural network model based on a dynamic learning rate adjustment strategy and an early stopping strategy; fine-tuning the parameters of the support vector machine model based on grid search and the performance of the validation set; and training the support vector machine model based on the objective of maximizing the validation set score.

[0044] For example, a neural network model can be constructed, containing a linear rectified function (e.g., a ReLU activation layer based on the linear rectified function) and a sigmoid output layer for binary classification, outputting probability values ​​for "normal traffic" or "intrusion traffic." Simultaneously, a support vector machine (SVM) model is trained. Both models are then optimized by dividing the training, validation, and test sets in a 7:2:1 ratio. The predictions from the neural network and SVM models are then stacked to form a two-feature vector for each instance, and a random forest meta-classifier is trained on this new feature space. This model combines the non-linear learning capability of the neural network model with the boundary separation capability of the SVM model, contributing to improved overall classification reliability.

[0045] Specifically, for example, a model architecture including a base classifier and a meta-classifier is constructed. The base classifier comprises a neural network model and a support vector machine (SVM) model. The neural network model includes an input layer, hidden layers, and an output layer. The input layer receives the core feature vector, the hidden layers have three layers (256, 128, and 64 nodes respectively) all using the ReLU activation function, and the output layer is a sigmoid activation layer. The SVM model uses a radial basis function (RBF) kernel to capture differences in feature boundaries. The meta-classifier uses a random forest algorithm with 150 decision trees. Its input is a two-dimensional feature vector formed by stacking the prediction results from the base classifier (one-dimensional probability values ​​from the neural network model and one-dimensional probability values ​​from the SVM model). The output is the final binary classification result (normal traffic / intrusion traffic) and the probability distribution for intrusion type identification. The training strategy includes dataset partitioning, base classifier training and tuning, and meta-classifier training. For example, the dataset partitioning includes dividing the collected dataset into a training set, a validation set, and a test set in a 7:2:1 ratio for training, tuning, and performance verification of the base classifier and meta classifier.

[0046] For example, base classifier training and tuning includes training and tuning of neural network models and support vector machine models.

[0047] The training and tuning of the neural network model includes: calculating the error between the predicted value and the true label using the binary cross-entropy loss function, using the Adam optimizer (initial learning rate 0.001), adjusting the learning rate based on the performance of the validation set (if the validation set loss does not decrease every 5 epochs, it is reduced to 0.8 times the previous rate), and using an early stopping strategy during training (stopping if the validation set loss does not decrease for 3 consecutive epochs).

[0048] The training and tuning of the support vector machine model includes: initially determining the parameter range (C∈[0.1,100], γ∈[0.001,10]) on the training set through grid search, and then iteratively adjusting the parameters in combination with the performance of the validation set (with the goal of maximizing the F1 score on the validation set) to determine the optimal parameter combination.

[0049] The meta-classifier training includes: stacking the prediction results of the neural network model and the support vector machine model on the training set to form a 2-feature vector for each sample; using the 2-feature vector as input and the true label of the sample as output, training a random forest model; and using 5-fold cross-validation combined with the validation set to optimize the model hyperparameters (number of trees 100-200, tree depth 10-20, minimum number of samples per node 3-8) to ensure the model's generalization ability.

[0050] In some implementations, the method further includes model evaluation. Model evaluation includes using accuracy, precision, recall, and... The accuracy of a model is a good indicator of its performance.

[0051] Recall rate is used to reflect the model's ability to correctly detect anomalies. The calculation formula is shown as follows: ; Precision is used to better reflect the performance of a model. The calculation formula is shown as follows: ; Average accuracy It means - The area under the curve, The higher the value, the higher the accuracy, indicating a stronger ability of the model to detect that category. The formula for calculating the average accuracy is shown below: ; The formula for calculating fractions is shown below: ; in, Indicates correctly predicted abnormal behavior; This indicates that normal behavior was incorrectly classified as abnormal; This indicates that abnormal behavior was incorrectly classified as normal.

[0052] Step 140: Collect network traffic characteristics in real time and preprocess the network traffic characteristics.

[0053] In some implementations, step 140 uses the feature importance score provided by the random forest in the pre-trained model to select key features and generate an optimized real-time feature vector suitable for the model input, thus preparing for subsequent real-time intrusion detection.

[0054] Step 150: Input the preprocessed network traffic feature vector into the trained ensemble model, and determine the risk of intrusion behavior based on the output probability of the ensemble model, as well as perform risk classification and alarm.

[0055] In some implementations, determining the risk of an intrusion behavior based on the output probability of the integrated model, and performing risk classification and alerting, includes: when the probability of the target type output by the integrated model is greater than 0.9, determining that the target type of behavior is an intrusion behavior; classifying the risk according to the degree of harm of the target type, and sending warning information to the administrator through audible and visual alarms and SMS notifications; automatically recording the time, source IP, destination IP and attack type information of the intrusion event corresponding to the intrusion behavior, and generating a log file.

[0056] For example, the preprocessed network traffic feature vectors collected in real time are input into the trained ensemble model. When the probability of a certain type of intrusion output by the ensemble model is greater than 0.9, it is determined to be an intrusion of that type. Based on the severity of the intrusion type, SQL injection and remote code execution are classified as high-risk, DDoS attacks and port scanning are classified as medium-risk, and abnormal port connections and invalid data packets are classified as low-risk. Warning information is sent to the administrator through audible and visual alarms, SMS notifications, etc. At the same time, the time, source IP, destination IP, attack type and other information of the intrusion event are automatically recorded to generate log files for subsequent source tracing and analysis.

[0057] This application embodiment captures raw network traffic data in real time using traffic collectors deployed at network nodes. This provides a comprehensive and timely source of foundational data, offering solid data support for subsequent dynamic analysis and ensuring the timeliness of intrusion detection. Optimized feature vectors are obtained by cleaning, standardizing, and filtering the raw traffic data. This improves the quality and consistency of the input data, significantly enhancing the efficiency and generalization ability of subsequent model processing by removing noise, standardizing data scale, and focusing on key features. An ensemble model containing base classifiers and meta-classifiers is constructed and trained using the optimized feature vectors. This achieves the benefits of model ensemble and stacking. This strategy leverages the strengths of different algorithms to effectively improve the overall model's accuracy in identifying complex intrusion patterns and the reliability of its decisions. By collecting and preprocessing network traffic features in real time, it enables continuous monitoring of the network environment. Real-time data preprocessing ensures that the data flow input to the model remains consistent with the training phase, laying the foundation for real-time detection. By inputting the preprocessed network traffic feature vectors into the trained ensemble model and determining the risk of intrusion behavior based on the output probability of the ensemble model, as well as performing risk classification and alerting, it achieves automated and intelligent identification and assessment of security threats. Furthermore, the hierarchical alerting mechanism optimizes the allocation of security resources and improves emergency response efficiency.

[0058] This application also discloses a network intrusion detection system based on deep learning. (See attached document.) Figure 2 As shown, the system includes: a raw data capture module 210, a feature vector optimization module 220, an integrated model training module 230, a traffic feature processing module 240, and a risk level processing module 250.

[0059] For example, the raw data capture module 210 is used to capture raw traffic data in the network in real time by means of a traffic collector deployed on a network node.

[0060] For example, the feature vector optimization module 220 is used to perform data cleaning, feature standardization and feature filtering on the original traffic data to obtain the optimized feature vector.

[0061] For example, the ensemble model training module 230 is used to construct an ensemble model containing a base classifier and a meta classifier, and to train the ensemble model using the optimized feature vector, wherein training the ensemble model includes stacking the prediction results of the base classifiers to form a new feature vector to train the meta classifier.

[0062] For example, the traffic feature processing module 240 is used to collect network traffic features in real time and preprocess the network traffic features.

[0063] For example, the risk level processing module 250 is used to input the preprocessed network traffic feature vector into the trained ensemble model, and determine the risk of intrusion behavior based on the output probability of the ensemble model, as well as to perform risk classification and alarm.

[0064] This application proposes a framework based on neural network models, support vector machine models, and a random forest classifier. By fusing their prediction results, it addresses the technical problems of traditional methods, such as low accuracy, high false alarm rate, and difficulty in adapting to dynamic threats when identifying complex intrusion behaviors. This framework can be deployed in real-world network environments, utilizing real-time packet capture tools to stream real-time network traffic, enabling instant anomaly detection. This allows the system to dynamically analyze incoming data and respond to threats in real time, thereby enhancing the adaptability and practical operational value of the intrusion detection system.

[0065] It is understood that the above embodiments are merely exemplary implementations used to illustrate the principles of this application, and this application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of this application, and these modifications and improvements are also considered to be within the scope of protection of this application.

Claims

1. A network intrusion detection method based on deep learning, characterized in that, include: By deploying traffic collectors on network nodes, raw network traffic data is captured in real time. The raw traffic data is subjected to data cleaning, feature standardization, and feature filtering to obtain an optimized feature vector. Construct an ensemble model that includes a base classifier and a meta classifier, and train the ensemble model using the optimized feature vector, wherein training the ensemble model includes stacking the prediction results of the base classifiers to form a new feature vector to train the meta classifier; Real-time acquisition of network traffic characteristics and preprocessing of the network traffic characteristics; The preprocessed network traffic feature vector is input into the trained ensemble model, and the risk of intrusion behavior is determined based on the output probability of the ensemble model, and risk classification and alarm are performed.

2. The method according to claim 1, characterized in that, The raw traffic data includes multiple protocol data packets, which include multi-dimensional features such as packet length, protocol type, source and destination IP addresses, port numbers, and time sequences. After real-time capture of the raw network traffic data, the data includes: The multidimensional features are aggregated and calculated according to network connections to form a dataset; Each record in the dataset corresponds to a network connection and contains a label representing the state of that connection.

3. The method according to claim 1, characterized in that, The process of cleaning, standardizing, and filtering the raw traffic data to obtain the optimized feature vector includes: The classification features of the original traffic data are converted into numerical values ​​using label encoding, and samples with redundant fields and / or missing values ​​exceeding 30% and outlier samples identified by interquartile range are deleted to perform data cleaning on the original traffic data. The Z-Score standardization method is used to map the cleaned data features to an interval with a mean of 0 and a standard deviation of 1, so as to perform feature standardization processing on the original traffic data. The original traffic data is scored based on the feature importance of random forest, and the top 80% of features that contribute to intrusion detection are selected to form the feature vector.

4. The method according to claim 2, characterized in that, The base classifier includes a neural network model and a support vector machine model; the neural network model includes an input layer, a hidden layer, and an output layer; the hidden layer has three layers with 256, 128, and 64 nodes respectively, and each of the three layers uses a linear rectified function; the output layer uses a logistic function to output the probability value of normal traffic or intrusion traffic; the support vector machine model uses a radial basis function kernel and is used for boundary separation.

5. The method according to claim 4, characterized in that, Before training the ensemble model using the optimized feature vectors, the following steps are included: The dataset is divided into a training set, a validation set, and a test set in a ratio of 7:2:

1.

6. The method according to claim 5, characterized in that, The step of stacking the prediction results of the base classifiers to form a new feature vector to train the meta classifier includes: Based on the random forest algorithm, the prediction results of the base classifiers are stacked to form a new feature vector to train the meta-classifier.

7. The method according to claim 6, characterized in that, The method of training a meta-classifier by stacking the prediction results of the base classifiers to form a new feature vector based on the random forest algorithm includes: The predicted probability values ​​of the neural network model and the support vector machine model on the training set are stacked to form a two-dimensional feature vector for each sample; The two-dimensional feature vector is used as the input to generate a new feature vector, and the true label of each sample is used as the output to train and generate a random forest model. The model hyperparameters are optimized by cross-validation combined with the validation set and tested based on the test set. The hyperparameters include the number of trees, tree depth, and minimum number of samples per node.

8. The method according to claim 7, characterized in that, Before training the meta-classifier by stacking the predictions of the base classifiers to form a new feature vector, the following steps are included: An adaptive moment estimation algorithm is adopted, with binary cross-entropy as the loss function, and the neural network model is trained based on a dynamic learning rate adjustment strategy and an early stopping strategy. The parameters of the support vector machine model are tuned based on grid search and the performance of the validation set, and the support vector machine model is trained with the goal of maximizing the validation set score.

9. The method according to claim 1, characterized in that, The step of determining the risk of intrusion behavior based on the output probability of the integrated model, and performing risk classification and alarm, includes: When the probability of the target type output by the integrated model is greater than 0.9, the behavior of the target type is determined to be an intrusion behavior; Risk classification is performed based on the degree of hazard of the target type, and warning information is sent to the administrator via audible and visual alarms and SMS notifications. The system automatically records the time, source IP, destination IP, and attack type information of the intrusion event corresponding to the intrusion behavior, and generates a log file.

10. A network intrusion detection system based on deep learning, characterized in that, include: The raw data capture module is used to capture raw traffic data in the network in real time through traffic collectors deployed on network nodes; The feature vector optimization module is used to perform data cleaning, feature standardization, and feature filtering on the original traffic data to obtain optimized feature vectors. An ensemble model training module is used to construct an ensemble model containing base classifiers and meta classifiers, and to train the ensemble model using the optimized feature vectors. The training of the ensemble model includes stacking the prediction results of the base classifiers to form a new feature vector to train the meta classifier. The traffic feature processing module is used to collect network traffic features in real time and preprocess the network traffic features; The risk level processing module is used to input the preprocessed network traffic feature vector into the trained ensemble model, determine the risk of intrusion behavior based on the output probability of the ensemble model, and perform risk classification and alarm.

Images