A network attack detection method and device based on a binary classification model

Abstract

This invention provides a network attack detection method and apparatus based on a binary classification model, comprising the following steps: Step 1: Calculating network parameters and preprocessing them; Step 2: Genetically optimizing the weights of the binary classifier, wherein the weight vector of the binary classifier is evolved through crossover, mutation, or permutation operators, and the optimal weight configuration is selected; Step 3: Using the genetically optimized binary classifier to detect network attacks, wherein the preprocessed network parameters are used as input feature vectors and input into the trained binary classifier, and the network traffic is judged to be normal or abnormal based on the comparison result between the output of the binary classifier and a preset activation threshold. This technical solution can quickly and accurately detect abnormal traffic in the network, reducing false positives and false negatives.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network attack detection method and apparatus based on a binary classification model. Background Technology

[0002] Binary classification models are fundamental in machine learning, aiming to divide input data into two categories (such as normal and abnormal). In the field of network attack detection, binary classification models are commonly used to distinguish between normal network traffic and abnormal network attack traffic. By inputting network traffic data into a trained binary classification model, real-time classification and detection of network traffic can be achieved, enabling timely discovery and response to potential network attacks.

[0003] Traditional network attack detection methods rely heavily on manual analysis and rule matching, which are inefficient and struggle to cope with complex and ever-changing network attack techniques. With the widespread application of machine learning methods, data-driven automated network attack detection methods have become a research hotspot. In existing technologies, researchers have proposed various classifier-based network attack detection schemes. For example, Abraham and Peddabachigari considered hybrid classifiers combining decision trees, support vector machines (SVMs), and their combinations; Mukamala and Sung used an ensemble of neural networks and support vector machines; Toosi described a scheme based on a two-level adaptive neural-fuzzy classifier; Amini et al. used a K-radial basis function neural network combined with fuzzy clustering methods; Saied constructed a neural network for detecting DDoS attacks; Agarwal combined normalized entropy methods with support vector machines; and He et al. utilized vector compression processes and fuzzy transformations for attack detection.

[0004] However, existing technologies still have the following objective drawbacks: 1) High false positive and false negative rates: Normal behavior is incorrectly classified as abnormal, or abnormal behavior is not detected. 2) Complex feature selection and processing: Network traffic data contains a large number of features and noise, making effective feature extraction difficult. 3) Insufficient real-time performance: Traditional methods have high computational complexity when dealing with high-speed network traffic, making real-time detection difficult. 4) Poor adaptability to new attacks: Methods based on fixed rules are difficult to cope with constantly evolving attack methods. 5) Lack of a global perspective: Existing methods mostly focus on local or single-dimensional detection, lacking a global assessment of the entire network environment. Summary of the Invention

[0005] In view of this, the purpose of the present invention is to provide a network attack detection method and apparatus based on a binary classification model, which can quickly and accurately detect abnormal traffic in the network and reduce false alarms and false negatives.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: a network attack detection method based on a binary classification model, comprising the following steps:

[0007] Step 1: Calculate network parameters and preprocess them. The statistical parameters of network traffic are calculated using the adaptive sliding window method, and the calculated parameters are reduced in dimensionality using principal component analysis (PCA).

[0008] Step 2: Genetic optimization of the weights of the binary classifier, wherein the weight vector of the binary classifier is evolved by at least one of the crossover operator, mutation operator and permutation operator, and the optimal weight configuration is selected based on the fitness function;

[0009] Step 3: Use a genetically optimized binary classifier to detect network attacks. The preprocessed network parameters are used as input feature vectors and input into the trained binary classifier. The network traffic is judged to be normal or abnormal based on the comparison between the output of the binary classifier and the preset activation threshold.

[0010] In a preferred embodiment, the adaptive sliding window method includes: dividing the total observation time interval L into multiple segments of equal length. The sub-intervals, where the beginning of each sub-interval is offset relative to the beginning of the previous sub-interval. Calculate a snapshot of the network parameter values ​​within each sub-interval, and calculate a length of... The average value of the parameter within the time window.

[0011] In a preferred embodiment, the total observation time interval L is 5 seconds, and the smoothing interval... The offset is 1 second. It takes 0.5 seconds.

[0012] In a preferred embodiment, the dimensionality reduction process using principal component analysis (PCA) includes compressing the dimension of the input feature vector to 33 dimensions.

[0013] In a preferred embodiment, the step of genetically optimizing the weights of the binary classifier further includes:

[0014] Step 21: Create the first and second copies of the original binary classifier;

[0015] Step 22: Randomly select a crossover operator, mutation operator, or permutation operator as the current genetic operator;

[0016] Step 23: Randomly select two neurons from the same layer;

[0017] Step 24: Apply the selected genetic operator to the weight vectors corresponding to the two neurons to modify the weights of the first copy and the second copy;

[0018] Step 25: Calculate the fitness function values ​​of the original binary classifier, the first copy, and the second copy;

[0019] Step 26: If the fitness function value of any copy is greater than the fitness function value of the original binary classifier, then replace the original binary classifier with that copy.

[0020] In a preferred embodiment, when the selected genetic operator is a crossover operator, the weight vector is split into two parts and swapped.

[0021] When the selected genetic operator is the mutation operator, a pair of mismatched bits are randomly selected from the genes in the weight vector and swapped.

[0022] When the selected genetic operator is the permutation operator, one element is randomly selected from the genes in the weight vector and inverted.

[0023] In a preferred embodiment, the binary classifier is a multilayer neural network, a radial basis function network, or a recurrent neural network.

[0024] In a preferred embodiment, when the binary classifier is a multilayer neural network, it is trained using the backpropagation algorithm; when the binary classifier is a radial basis function network, the weights of the hidden layer neurons are initialized using the K-means method, and the output layer is trained using the Widrow-Hoff rule.

[0025] In a preferred embodiment, the dataset used to train the binary classifier is the DARPA1998 dataset, which includes normal categories as well as anomaly categories such as neptune, smurf, ipsweep, nmap, portsweep, and satan.

[0026] This invention also provides a network attack detection device based on a binary classification model, which runs the aforementioned network attack detection method based on a binary classification model, including:

[0027] The parameter calculation and preprocessing module is used to calculate network parameters and preprocess them. The module calculates the statistical parameters of network traffic using an adaptive sliding window method and uses principal component analysis (PCA) to reduce the dimensionality of the calculated parameters.

[0028] A genetic optimization module is used to genetically optimize the weights of a binary classifier. This module evolves the weight vector of the binary classifier using at least one of crossover, mutation, and permutation operators, and selects the optimal weight configuration based on a fitness function.

[0029] The attack detection module is used to detect network attacks using a genetically optimized binary classifier. The module takes preprocessed network parameters as input feature vectors and inputs them into the trained binary classifier. Based on the comparison between the output of the binary classifier and a preset activation threshold, it determines whether the network traffic is normal or abnormal.

[0030] Compared with the prior art, the present invention has the following beneficial effects:

[0031] (1) By using adaptive sliding window and PCA dimensionality reduction, the feature dimension and noise interference are effectively reduced, thus improving the detection accuracy.

[0032] (2) The genetic algorithm is used to optimize the weights of the binary classifier, which speeds up the training process and avoids getting stuck in local optima.

[0033] (3) The method of this invention was validated on the DARPA 1998 dataset. Compared with multi-layer neural networks, the correct classification rate (GCR) was improved by an average of 0.707%; compared with neural-fuzzy networks, the true classification rate (GPR) was slightly increased (0.021%). After introducing a random classifier and an error classifier, the aggregation method based on the Fix and Hodges method of this invention showed good fault tolerance, and the performance degradation was much smaller than that of the stack aggregation method.

[0034] (4) The present invention allows for the construction of multiple combination schemes without being strictly bound to a fixed aggregation combination, making the detection method more flexible. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of a three-layer neural network structure in a preferred embodiment of the present invention;

[0036] Figure 2 This is a schematic diagram illustrating the principle of the sliding window method in a preferred embodiment of the present invention;

[0037] Figure 3 This is a graph showing the dependence of information content measurement on the number of principal components in a preferred embodiment of the present invention.

[0038] Figure 4 This is a schematic diagram of the crossover operator in a preferred embodiment of the present invention;

[0039] Figure 5 This is a schematic diagram of the mutation operator in a preferred embodiment of the present invention;

[0040] Figure 6 This is a schematic diagram of the permutation operator in a preferred embodiment of the present invention;

[0041] Figure 7 This is a comparison chart of the performance indicators of the five basic classifiers and four polymer components in a preferred embodiment of the present invention. Detailed Implementation

[0042] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0043] It should be noted that the following detailed descriptions are illustrative and intended to provide further explanation of this application. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains.

[0044] It should be noted that the terminology used herein is for the purpose of describing particular implementations only and is not intended to limit the exemplary implementations according to this application; as used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise; furthermore, it should be understood that when the terms “comprising” and / or “including” are used in this specification, they indicate the presence of features, steps, operations, devices, components and / or combinations thereof.

[0045] A network attack detection method based on a binary classification model, reference Figure 1-7 This includes the following steps:

[0046] Step 1: Calculate network parameters and preprocess them. The statistical parameters of network traffic are calculated using the adaptive sliding window method, and the calculated parameters are reduced in dimensionality using principal component analysis (PCA).

[0047] Step 2: Genetic optimization of the weights of the binary classifier, wherein the weight vector of the binary classifier is evolved by at least one of the crossover operator, mutation operator and permutation operator, and the optimal weight configuration is selected based on the fitness function;

[0048] Step 3: Use a genetically optimized binary classifier to detect network attacks. The preprocessed network parameters are used as input feature vectors and input into the trained binary classifier. The network traffic is judged to be normal or abnormal based on the comparison between the output of the binary classifier and the preset activation threshold.

[0049] Specifically, the detailed explanation of step 1 is as follows:

[0050] Network parameters include connection duration, network services, strength of sending special packets, number of active connections between specific IP address pairs (one of the standards for DoS attacks), binary characteristics of changing TCP window ratio after establishing an actual session, current state of TCP connection, different attributes of scan packets at the TCP, UDP, ICMP, and IP levels, etc.

[0051] To calculate the statistical parameters of network attacks, an adaptive sliding window method is used, which divides a given time interval... The length is L, during which a large number of parameters are continuously observed, and these parameters are divided into several smaller intervals. Having the same length Each start has an offset relative to the start of the previous interval. (See Figure 2 ).if and ,but During the time interval Inside, the parameter values ​​are calculated. A snapshot, and through the formula Calculate their average value (intensity) within a time window of length L'. In the experiment, an interval with parameter L of 5 seconds was used, a smoothing interval L' of 1 second was used, and the offset δ was set to half a second. It is speculated that this method eliminates sporadic network bursts and reduces the false positive rate.

[0052] For preprocessing, principal component analysis (PCA) is used, including the following steps:

[0053] Step 11: Calculate the expected value of the random vector, which is represented by a set of training elements:

[0054]

[0055] Step 12: Generate the unbiased theoretical covariance matrix Elements:

[0056]

[0057] Step 13: Calculate the matrix eigenvalues and eigenvectors As the root of the equation (for this purpose, use relative to the matrix) Jacobi's rotation):

[0058]

[0059] Step 14: Sort the eigenvalues ​​in descending order and the corresponding feature vector Sort:

[0060]

[0061] Step 15: Select the desired number of principal components, as shown below:

[0062]

[0063] in It is a measure of information content. It's the value chosen by the experts.

[0064] Step 16: Input feature vector Centralization has become .

[0065] Step 17: Center the feature vector Projected onto the new coordinate system, by orthogonal normalized vectors express:

[0066] in, Called a vector The i-th principal component.

[0067] Figure 3 This demonstrates the dependence of the information content metric S on the number of principal components.

[0068] In the experiment, the dimension of the input vector was compressed to 33, corresponding to .

[0069] Specifically, step 2 is explained in detail below:

[0070] To accelerate the training process, genetic operators, such as crossover, are used. ,Mutations and substitution After several training epochs, the internal weights of the adaptive classifier are adjusted. To do this, two copies of the original classifier are created, with some of the weight vectors modified. The genetic optimization rule for the weights in the classifier is shown below.

[0071] Step 21: Create two copies of the binary classifier B, B' and B".

[0072] Step 22: Randomly select one of the three genetic operators, for example... .

[0073] Step 23: Randomly select two neurons (τ' and τ") from the same layer.

[0074] Step 24: Apply the genetic operator G (one of steps 24a, 24b, or 24c) to the weight vector and Then, to the nerve τ' and τ".

[0075] Step 24a: If operator G is a crossover operator, then the vector and It can be divided into parameters k ( (A randomly selected number) Adjust the two parts and swap them as follows: and (See Figure 4 ).

[0076] Step 24b: If operator C is a mutation operator, then in the gene Randomly select a pair of mismatched bits and To exchange; to exchange genes Repeat the same operation (see) Figure 5 ).

[0077] Step 24c: If operator G is a substitution operator, then in the gene Random selection position Invert; for genes Repeat the same operation (see) Figure 6 ).

[0078] Step 25: Change classifiers B' and B".

[0079] Step 26: Calculate the fitness functions of classifiers B, B', and B". , and .

[0080] Step 27: If Then classifier B will be replaced with ,in .

[0081] The weight vector of each neuron is represented as a single chromosome, which is composed of multiple genes. The number of genes within this chromosome is equal to the size of the layer preceding the corresponding neuron location (encoded by the chromosome). It can be seen that when applying the crossover operator, the bit information of the genes remains within the offspring: the boundary specifying chromosome separation passes between adjacent genes without disrupting their integrity. Meanwhile, the mutation and permutation operators (steps 24b and 24c) are applied only to the mantissa of the selected genes corresponding to the 64-bit real number; this restriction is to avoid an explosive growth in gene content. Step 6 is performed for each classifier in a separate thread: After genetically correcting the sub-classifiers, it is necessary to calculate their fitness level. First, the sub-classifiers and their ancestor classifiers are trained in parallel for several epochs, and the classifier with the largest fitness function value is selected from the three classifiers. Here, the inverse function of the mean squared error is used. Instead of the fitness function, the newly formed classifier B is used as the parent classifier to generate other classifiers B' and B", which will compete with B again.

[0082] Specifically, step 3 is explained in detail below:

[0083] Step 31: Select a binary classifier (detector) And specify its parameters.

[0084] Step 32: Training the detector Select category set .

[0085] Step 33: Prepare training data ,in

[0086] It is a detector Cardinality of the training set

[0087] It's a category label.

[0088] This is the required output.

[0089] Parameter value It can be either -1 or 0, depending on the classifier. The type and its activation / membership functions on the output layer.

[0090] Step 34: Using the data Training a binary classifier .

[0091] Step 35: For the input object represented as a feature vector Classify: If Then the object Category One of them; if Then the object Category One of them. Here. It can be interpreted as a detector. The activation threshold. More precisely, by setting... Represented as a correctly linked class, if there is Then the detector Identify objects This is normal.

[0092] As a supplement, it should be noted that:

[0093] Structurally and functionally, artificial neural networks resemble the brain, with computational nodes corresponding to neurons and connections to synapses. Establishing connections between elements of the computational structure reduces neural impulse interference when simulating the connection from one neuron to another. The relationships and strengths between neurons can be set by specifying non-zero weight coefficients, whose values ​​proportionally represent the importance of the input signal; the stronger the input signal, the greater the weight assigned to the corresponding connection. After configuring at least two layers of a structure similar to that described above, sufficiently accurate approximations of training instances can be achieved.

[0094] A biological neuron consists of a nucleus, a cell body, and multiple appendages. The first type of appendage is called an axon, represented as a single copy in each neuron, and acts as the original transmitter of nerve impulses. The second type of appendage is called a dendrite, which receives signals from the axons of adjacent cells. The nerve fiber region located at the junction of the axon and dendrite is called a synapse, which can activate or inhibit signal transmission depending on the situation. When these are directed to similar artificial neurons, the signals are correspondingly amplified or attenuated by the relative weights between neurons.

[0095] The input layer of a neural network is a virtual layer, pre-assigned to the input signal before processing it. The input vector of each node in this layer consists of the synaptic weight vector and the input vector. The dot product. (By) The first layer is composed of nodes, and the second layer above it is... The input signal structure of each neuron is as follows: ,in , It is the weight, which specifies the weight in the first hidden layer. Input signals to each neuron The conversion, It is the first The offset of a neuron located in the first hidden layer, the output value of that neuron. Similarly, located in the area of... Each of the nodes in the second hidden layer is a first-order node. Each neuron has input and output signals. and ,in , It is the weight, which specifies the weight in the first position. Input signals to each neuron The transition, it is located in the second layer, It is the first The offset of each neuron, where φ is the number of activations. Resulting signal The structure is ,in These are the weights of the inputs to the last layer of neurons. It is the offset of the output neuron (see Figure 1 Generally, the following formula can be used to represent the function of a binary neural network model:

[0096] .

[0097] The backpropagation algorithm is specifically as follows:

[0098] Step A1: Set up the neural network structure, that is, choose the activation function type and the number of hidden layers and neurons.

[0099] Step A2: Specify the maximum value T for the number of training iterations and the minimum value ε for the total mean square error.

[0100] Step A3: Set the counter for the current generation to 0, i.e., t=0, and initialize the weight coefficients with arbitrary values. Where K represents the layer number, i corresponds to the position of the neuron in the Kth layer, and j represents the position of the current neuron and the neuron in the Kth layer. The connection between the output signals of the j-th neuron in the layer.

[0101] Step A4: For each vector expression Proceed to steps 4a~4c.

[0102] Step A41: Perform signal feedforward propagation—calculate the input signal of each i-th neuron in the K-th layer according to the formula. ,in It is the first The number of neurons in a layer. When hour, , ;when hour, ;when hour, (original signal).

[0103] Step A42: Backpropagation of execution error: According to the formula The cumulative weighting of the neuron system is calculated, starting from the last layer and ending at the first layer, where α is the weight correction coefficient, and If the Kth layer is the output, then ,otherwise ,in This represents the expected output of the neural network in the i-th neuron of the output layer, where the k-th training vector is located.

[0104] Step A43: Using the formula Adjust the weight coefficients of the neurons.

[0105] Step A5: Increase the current generation count, i.e. .

[0106] Step A6: Terminate the algorithm if one of the following conditions is met: or ,in It is the total mean square error of the neural network, and the output value. It consists of three layers and one neuron on the output layer, if the vector Passed to the distributed layer (with the desired output vector) Otherwise, skip to step A4).

[0107] The backpropagation algorithm described above belongs to the general gradient descent algorithm. When performing a minimum search using this algorithm, its direction is opposite to the gradient of the function to be optimized (e.g., mean squared error). A disadvantage of these algorithms is their tendency to fall into local optima, meaning that even if a smaller extreme value exists than the one already found, these algorithms can hardly modify the weight parameters. These problems are partially addressed through various improvements to the backpropagation algorithm. First, a feedforward propagation of the signal is performed, and then an adjusted value is calculated for each weight. Some of these modifications use a variable correction scaling factor for the weights, which depends on maintaining or changing the sign of the derivative, while considering the momentum factor used to change each weight, or considering its second derivative.

[0108] The structure of radial basis function networks differs from that of multilayer neural networks. In this type of network, the first hidden layer is designed to process the input vector. Projected into a new feature space In this space, the original π-dimensional vector is transformed into an N, dimensional vector. Each component of the new vector reflects the input vector. and weight vector The degree of proximity is assigned to the i-th neuron in the first hidden layer, where .here It is a radial basis function, characterized by the fact that the weights of this layer do not change during training. Instead, they are set to static using one of the following methods: 1) random initialization; 2) initialization by randomly selecting training vectors; 3) initialization using a clustering method. The third method, K-means, was used in the experiments, where the number of clusters equals the size of the hidden layer. The goal of this method is to construct points. (This point is called the center), and they are arranged in this way: so that they are located at the point. The total distance to nearby points is minimized. The model representation of a radial basis function network is as follows: The algorithm for training radial basis function networks is as follows:

[0109] Step B1: Set up the neural network structure, i.e., select the hidden layers. The size and output layer activation function type φ.

[0110] Step B2: Specify the minimum values ​​for the maximum number of training iterations T and the total mean square error ε.

[0111] Step B3: Calculate cluster centers using the K-means method The weight coefficients of the first hidden layer neurons are initialized using the combination of these centers. ,Right now .

[0112] Step B4: Set the current iteration counter to Initialize the neuron weights of the second output layer with arbitrary values. .

[0113] Step B5: For each vector pair Perform steps 5a to 5b.

[0114] Step B51: Perform signal feedforward propagation—calculate the output signal for the i-th neuron in the second layer according to the formula. ,in ;when hour, , ;when hour, .

[0115] Step B52: Update the weight coefficients of the neural network output layer using the Widrow-Hoff rule. ,in , It is the expected output of the i-th neuron in the output layer of the k-th instance from the training samples.

[0116] Step B6: Increment the current iteration count, i.e. .

[0117] Step B7: Terminate the algorithm if one of the following conditions is met; or .in , is the total mean square error of the neural network, if the vector Passed to the distributed layer (with the desired output vector) Then the output value It consists of two layers and one neuron located in the output layer. Otherwise, skip to step B5.

[0118] The Jordan recurrent neural network model is an extension of the aforementioned multi-layer neural network model. This model introduces input-output feedback into the context layer, as shown below:

[0119]

[0120] Output signal The signal is analyzed from a previous vector, and several cycles have been stored before processing the new vector derived from that signal value. This allows the network to remember the history of alternating images of abnormal or normal neural network connections. In principle, the rest of the functionality of such a network is similar to the training of a multi-layer neural network, as follows:

[0121] Step C1: Initialization, i.e.

[0122] Step C2: Execute steps A1~A6 of the multi-layer neural network training algorithm, and store the output in a variable after each iteration. middle.

[0123] The DARPA1998 dataset, widely used in research on network attack detection methods, was used in this invention. Over 100 parameters from this dataset were extracted. Most of the parameters considered in this study are statistical parameters; for convenience, the DARPA1998 dataset was used in the experiments: CSV and pcap files containing class labels were available. Furthermore, outdated attack types were excluded (e.g., buffer overflows in mail services, or old vulnerabilities within the TCP / IP stack during packet defragmentation in denial-of-service attacks). This application has handled some anomalies with statistical bias parameters. Thus, a total of seven categories were selected: six anomaly categories—neptune, smurf (DoS), ipsweep, nmap, portsweep, and satan (Probe)—and one general category.

[0124] When creating the dataset, the binary network trace "Training Data Set 1998" was used. It was collected on Wednesdays of the first week of the experiment, Mondays and Tuesdays of the second week, Mondays, Wednesdays and Fridays of the third week, and Tuesdays and Wednesdays of the fourth week.

[0125] The performance metrics tested are: GPR (True Positive Rate), FPR (False Positive Rate), GCR (Correct Classification Rate), and ICR (Incorrect Classification Rate). All of these metrics will be calculated using unique elements not used during training.

[0126] The efficiency of the developed model can be evaluated using Refaeilzadeh's 5-fold cross-validation. (Dataset) Include Each unique record is divided into 5 disjoint subsets. ,in Furthermore, in each set In each set, there are elements of all 7 classes, so that the subsample corresponding to each specific class l is in each set. : Both groups have approximately equal numbers. The training and testing sample ratio is 3:2. The basic classifier training process has been performed. This time, sets are used. ,in The test set is constructed based on these sets. ,in And set metric values ​​on each set, including the i-th base classifier. , , , The j-th polymer component , , , .gather This partitioning was performed 3 times ( Each time, 10 subsets of the dataset are randomly generated. The minimum, maximum, and average values ​​of the index GPR corresponding to the i-th base classifier and the j-th aggregation component can be defined as follows:

[0127] , , ;

[0128] , , ;

[0129] Other indicators can be calculated similarly.

[0130] Figure 7 The performance metrics for using 5-fold cross-validation as a binary classifier and its aggregate component are shown. Compared to multilayer neural networks, the GCR metric is improved by an average of 0.707%, indicating the best results among binary classifiers. Compared to neural-fuzzy networks, the GPR metric is slightly improved (0.021%). The GPR-FPR and GCR-ICR metrics represent the trade-offs between correct detections and false positives, and between correct classification and misclassification, such as... Figure 7 As shown.

[0131] In this experiment, the radial basis function network and recurrent neural network were replaced by two other classifiers: a random classifier and an error classifier. Although the output of the first classifier is a set of random class labels, from which correct labels may exist, the second classifier intentionally excludes this possibility: its correct classification index is always 0. The Fix and Hodges method still leads in GPR and GCR terms, with these index values ​​exceeding the maximum values ​​calculated by the basic classifiers (neural-fuzzy network and multilayer neural network) by 0.017% and 0.67%, respectively. Therefore, these values ​​show a slight decrease compared to previous experiments (a decrease of 0.021% - 0.017% = 0.004% and 0.707% - 0.67% = 0.037%). Similarly, this application calculated the losses on GPR-FPR and GCR-ICR due to the introduction of a "bad" classifier, which were 0.142%-0.137%=0.005% and 1.276%-1.203%=0.073%, respectively. Based on this, the proposed Fix and Hodges methods are computationally tolerant. In the stacked example, a multi-layer neural network was used as the aggregation component. As expected, the stack was the most sensitive aggregation component when a new classifier was introduced, with the average GPR and GCR decreasing by 48.542% and 45.475%, respectively. This is because the new classifiers (random classifier and misclassifier) ​​used weight values ​​configured for the radial basis function network and the recurrent neural network.

[0132] In summary, the application of binary classification models in network attack detection methods has several key points and areas requiring protection. Through continuous technological innovation and the implementation of legal protection measures, it is possible to ensure that this method plays its maximum role in practical applications and protects relevant interests.

Claims

1. A network attack detection method based on a binary classification model, characterized in that, Includes the following steps: Step 1: Calculate network parameters and preprocess them. The statistical parameters of network traffic are calculated using the adaptive sliding window method, and the calculated parameters are reduced in dimensionality using principal component analysis (PCA). Step 2: Genetic optimization of the weights of the binary classifier, wherein the weight vector of the binary classifier is evolved by at least one of the crossover operator, mutation operator and permutation operator, and the optimal weight configuration is selected based on the fitness function; Step 3: Use a genetically optimized binary classifier to detect network attacks. The preprocessed network parameters are used as input feature vectors and input into the trained binary classifier. The network traffic is judged to be normal or abnormal based on the comparison between the output of the binary classifier and the preset activation threshold.

2. The network attack detection method based on a binary classification model according to claim 1, characterized in that, The adaptive sliding window method includes: dividing the total observation time interval L into multiple segments with the same length. The sub-intervals, where the beginning of each sub-interval is offset relative to the beginning of the previous sub-interval. Calculate a snapshot of the network parameter values ​​within each sub-interval, and calculate a length of... The average value of the parameter within the time window.

3. The network attack detection method based on a binary classification model according to claim 2, characterized in that, The total observation time interval L is 5 seconds, and the smoothing interval is... The offset is 1 second. It takes 0.5 seconds.

4. The network attack detection method based on a binary classification model according to claim 1, characterized in that, The dimensionality reduction process using Principal Component Analysis (PCA) includes compressing the dimension of the input feature vector to 33 dimensions.

5. The network attack detection method based on a binary classification model according to claim 1, characterized in that, The steps of genetically optimizing the weights of the binary classifier further include: Step 21: Create the first and second copies of the original binary classifier; Step 22: Randomly select a crossover operator, mutation operator, or permutation operator as the current genetic operator; Step 23: Randomly select two neurons from the same layer; Step 24: Apply the selected genetic operator to the weight vectors corresponding to the two neurons to modify the weights of the first copy and the second copy; Step 25: Calculate the fitness function values ​​of the original binary classifier, the first copy, and the second copy; Step 26: If the fitness function value of any copy is greater than the fitness function value of the original binary classifier, then replace the original binary classifier with that copy.

6. The network attack detection method based on a binary classification model according to claim 5, characterized in that, When the selected genetic operator is the crossover operator, the weight vector is split into two parts and then swapped. When the selected genetic operator is the mutation operator, a pair of mismatched bits are randomly selected from the genes in the weight vector and swapped. When the selected genetic operator is the permutation operator, one element is randomly selected from the genes in the weight vector and inverted.

7. The network attack detection method based on a binary classification model according to claim 1, characterized in that, The binary classifier is a multilayer neural network, a radial basis function network, or a recurrent neural network.

8. The network attack detection method based on a binary classification model according to claim 7, characterized in that, When the binary classifier is a multi-layer neural network, it is trained using the backpropagation algorithm; when the binary classifier is a radial basis function network, the weights of the hidden layer neurons are initialized using the K-means method, and the output layer is trained using the Widrow-Hoff rule.

9. A network attack detection method based on a binary classification model according to claim 1, characterized in that, The dataset used to train the binary classifier is the DARPA1998 dataset, which includes normal categories as well as anomaly categories such as neptune, smurf, ipsweep, nmap, portsweep, and satan.

10. A network attack detection device based on a binary classification model, characterized in that, The network attack detection method based on a binary classification model as described in any one of claims 1-9 includes: The parameter calculation and preprocessing module is used to calculate network parameters and preprocess them. The module calculates the statistical parameters of network traffic using an adaptive sliding window method and uses principal component analysis (PCA) to reduce the dimensionality of the calculated parameters. A genetic optimization module is used to genetically optimize the weights of a binary classifier. This module evolves the weight vector of the binary classifier using at least one of crossover, mutation, and permutation operators, and selects the optimal weight configuration based on a fitness function. The attack detection module is used to detect network attacks using a genetically optimized binary classifier. The module takes preprocessed network parameters as input feature vectors and inputs them into the trained binary classifier. Based on the comparison between the output of the binary classifier and a preset activation threshold, it determines whether the network traffic is normal or abnormal.

Images