Intrusion detection system and method based on hybrid neural network CNN-DNN

Abstract

The application discloses an intrusion detection system and method based on a hybrid neural network CNN-DNN. The method specifically comprises the following steps: acquiring network traffic data with labels; converting character, text and other information in the network traffic data into numbers and performing a normalization operation; finally, reducing the dimension of the network traffic data by using a combined autoencoder; and constructing a hybrid neural network CNN-DNN. The application adopts the CNN-DNN hybrid neural network to analyze data, has high accuracy, adopts the combined autoencoder, can perform dimension reduction processing on input data of different dimensions, can flexibly highlight key features or feature combinations, and improves the calculation efficiency.

Description

Technical Field

[0001] This invention belongs to the field of computer network security technology, specifically relating to an intrusion detection system and method based on a hybrid neural network CNN-DNN. Background Technology

[0002] Network traffic security issues are becoming increasingly prominent, and various network intrusion methods are emerging one after another. With the rapid development of informatization in all industries, the shortcomings of traditional intrusion detection systems in identifying new network attacks are becoming increasingly apparent, and the false alarm rate and false negative rate are still at a high level, which will not be able to meet the changing trends of information network development in various industries. Summary of the Invention

[0003] One objective of this invention is to address the problems of high false positives and many false negatives in traditional intrusion detection methods based on misuse, and the difficulty in porting traditional machine learning-based intrusion detection methods. This invention provides an abnormal traffic detection system based on a hybrid neural network CNN-DNN.

[0004] This was achieved through the following technical solutions:

[0005] An abnormal traffic detection system based on a hybrid neural network (CNN-DNN) includes:

[0006] The network traffic collection module is used to acquire real-time network traffic data.

[0007] The traffic data preprocessing module is used to receive network traffic data from the network traffic collection module, convert the characters, text and other information in the network traffic data into numbers, perform normalization operations, and finally use a combined autoencoder to reduce the dimensionality of the network traffic data.

[0008] The hybrid neural network CNN-DNN module is used to perform real-time anomaly detection on the data transmitted by the traffic data preprocessing module.

[0009] The prediction result output module is used to output and store the prediction results of the hybrid neural network CNN-DNN module, and also provides an interface for third-party applications to directly obtain the prediction results of the hybrid neural network CNN-DNN module.

[0010] Another objective of this invention is to provide an abnormal traffic detection method based on a hybrid neural network (CNN-DNN), comprising the following steps:

[0011] Step S100: Obtain network traffic data with tags; the tags are either normal or abnormal.

[0012] Step S200: Data Preprocessing

[0013] The network traffic data is converted into numbers from characters and text, and then normalized. Finally, a combined autoencoder is used to reduce the dimensionality of the network traffic data.

[0014] Step S300: 80% of the data preprocessed in step S200 is used as the training set and 20% as the test set;

[0015] Step S400: Construct a hybrid neural network CNN-DNN and train it using the results obtained in step S300.

[0016] S500: Test the trained hybrid neural network CNN-DNN using the test set;

[0017] S600: Acquire the unlabeled network traffic dataset of the object detection network in real time; then repeat step S200 and input it into the tested hybrid neural network CNN-DNN to achieve intrusion detection.

[0018] Compared with existing intrusion detection methods, the present invention has the following advantages:

[0019] This invention uses a CNN-DNN hybrid neural network for data analysis, which has high accuracy. It employs a combined autoencoder, which can perform dimensionality reduction processing on input data of different dimensions, and can flexibly highlight key features or feature combinations, thereby improving computational efficiency. Attached Figure Description

[0020] Figure 1 This is a flowchart of the intrusion detection method based on a hybrid neural network (CNN-DNN) according to the present invention;

[0021] Figure 2 This is a schematic diagram of the intrusion detection system based on a hybrid neural network (CNN-DNN) according to the present invention;

[0022] Figure 3 for Figure 2 Schematic diagram of CNN convolutional neural network module and DNN deep neural network module.

[0023] Figure 4 for Figure 2 Schematic diagram of the combined autoencoder module. Detailed Implementation

[0024] The technical solution of the present invention will be further described below with reference to the accompanying drawings, but the embodiments of the present invention are not limited thereto.

[0025] This invention provides an intrusion detection method based on a hybrid neural network (CNN-DNN), such as... Figure 1 As shown, it includes the following steps

[0026] S100: Obtain network traffic datasets from object detection networks or network environments with high similarity to object detection networks, and label them, with labels being either normal or abnormal;

[0027] The network environment with a high similarity to the target detection network is specifically:

[0028] Networks with the same network structure framework and the same proportion of labels distributed through network traffic.

[0029] The network traffic dataset includes multiple network packets, each network packet includes multiple different features, wherein each feature data type adopts one of character, text, or numerical data (such as the widely used KDD99 dataset);

[0030] S200: Data Preprocessing

[0031] The process involves converting character and text information in network traffic data into numbers and performing normalization; finally, a combined autoencoder is used to reduce the dimensionality of the network traffic data. Specifically:

[0032] S210: Perform feature imputation on each network data packet obtained above;

[0033] The missing feature filling specifically involves filling the missing features with corresponding default feature values, where the default feature values ​​are manually set based on experience.

[0034] S220: Perform data type judgment on the network data packets after missing feature filling. If all are numerical, jump to S240; otherwise, jump to S230.

[0035] S230: Determine whether there are associated features in the non-numerical features (i.e., character or text type features) of the network data packet after missing feature imputation. If they exist, convert all associated features to numerical values ​​using one-hot encoding (LabelEncoder) and convert other non-numerical features to numerical values ​​using label encoding. If there are no associated features, convert all non-numerical features to numerical values ​​using label encoding (OneHotEncoder).

[0036] For example, if the features such as ACK, SYN, and FIN in TCP transmission are all part of the flags bits, then these features are considered to be related features.

[0037] S240: Perform maximum / minimum normalization on the numerical features to limit the values ​​to between -1 and 1;

[0038] S250: Use a combined autoencoder to reduce the dimensionality of the data processed in step S240;

[0039] The combined autoencoder adds a combined feature filtering layer between the hidden layer and the input layer of a traditional autoencoder; the combined feature filtering layer includes... Each sub-autoencoder is used for dimensionality reduction; the input of each sub-autoencoder is an m-dimensional numerical feature randomly selected from the n-dimensional numerical features received by the combined autoencoder input layer; the numerical features received by all sub-autoencoders are different.

[0040] like Figure 4 The combined autoencoder input layer outputs 4-dimensional features. The combined autoencoder combined feature filtering layer includes 4 sub-autoencoders. The input of each sub-autoencoder is a 3-dimensional feature randomly selected from the output features of the input layer. Then, the dimensionality of the feature is reduced, and the dimensionality-reduced data is used as the input of the hidden layer.

[0041] Step S300: 80% of the data preprocessed in step S200 is used as the training set and 20% as the test set;

[0042] S400: Construct a hybrid neural network CNN-DNN and train it using the training set.

[0043] The hybrid neural network CNN-DNN takes the dimensionality-reduced network traffic dataset as input and the classification result as output; it includes a convolutional neural network module CNN and a deep neural network module DNN cascaded in sequence.

[0044] The convolutional neural network module CNN includes an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, and a third convolutional layer, which are cascaded in sequence. The number of neurons in the first to third convolutional layers varies from 64 to 256. A pooling layer is used after the first two convolutional layers to prevent overfitting.

[0045] The deep neural network module (DNN) includes three cascaded fully connected layers and an output layer; the number of neurons in the fully connected layers ranges from 128 to 256, and a 10% dropout strategy is used to prevent overfitting.

[0046] The backpropagation algorithm (BP algorithm) is used during model training. The model is evaluated using binary cross-entropy. Training stops when the error converges and the parameters are recorded.

[0047] S500: Test the trained hybrid neural network CNN-DNN using the test set;

[0048] S600: Acquire the unlabeled network traffic dataset of the object detection network in real time; then repeat steps S200-S300 and input it into the tested hybrid neural network CNN-DNN to achieve intrusion detection.

[0049] Object detection networks acquire network traffic datasets using sniffers.

Claims

1. An intrusion detection system based on a hybrid neural network CNN-DNN, characterized in that... include: The network traffic collection module is used to acquire real-time network traffic data; The traffic data preprocessing module is used to receive network traffic data from the network traffic collection module, convert characters and text in the network traffic data into numbers, perform normalization operations, and finally use a combined autoencoder to reduce the dimensionality of the network traffic data. The hybrid neural network CNN-DNN module is used to perform real-time anomaly detection on the data transmitted by the traffic data preprocessing module; The prediction result output module is used to output and store the prediction results of the hybrid neural network CNN-DNN module, and also provides an interface for third-party applications to directly obtain the prediction results of the hybrid neural network CNN-DNN module; The intrusion detection system performs the following method: Step S100: Obtain tagged network traffic data; Step S200: Data Preprocessing The process involves converting character and text information in network traffic data into numbers and performing normalization; finally, a combined autoencoder is used to reduce the dimensionality of the network traffic data; specifically: S210: Perform feature imputation on each network data packet obtained above; S220: Perform data type judgment on the network data packets after missing feature filling. If all are numerical, jump to S240; otherwise, jump to S230. S230: Determine whether there are related features in the non-numerical features of the network data packet after missing feature imputation. If there are, use LabelEncoder to convert all related features into numerical values ​​and use label encoding to convert other non-numerical features into numerical values. If there are no related features, use OneHotEncoder to convert all non-numerical features into numerical values. S240: Perform maximum / minimum value normalization on numerical features; S250: Use a combined autoencoder to reduce the dimensionality of the data processed in step S240; The combined autoencoder adds a combined feature filtering layer between the hidden layer and the input layer of a traditional autoencoder; the combined feature filtering layer includes... Each sub-autoencoder is used for dimensionality reduction; the input of each sub-autoencoder is an m-dimensional numerical feature randomly selected from the n-dimensional numerical features received by the combined autoencoder input layer. Step S300: Use one part of the data preprocessed in step S200 as the training set and the other part as the test set; Step S400: Construct a hybrid neural network CNN-DNN and train it using the information obtained in step S300; S500: Test the trained hybrid neural network CNN-DNN using the test set; S600: Acquire the unlabeled network traffic dataset of the object detection network in real time; then repeat step S200 and input it into the tested hybrid neural network CNN-DNN to achieve intrusion detection.

2. The intrusion detection system based on a hybrid neural network CNN-DNN as described in claim 1, characterized in that... Step S210, the missing feature filling, specifically involves filling the missing features with the corresponding default feature values.

3. The intrusion detection system based on a hybrid neural network CNN-DNN as described in claim 1, characterized in that... The hybrid neural network CNN-DNN takes the dimensionality-reduced network traffic dataset as input and the classification result as output. It includes a cascaded convolutional neural network module (CNN) and a deep neural network module (DNN).

4. The intrusion detection system based on a hybrid neural network CNN-DNN as described in claim 3, characterized in that... The convolutional neural network module CNN includes an input layer, a first convolutional layer, a first pooling layer, a second convolutional layer, a second pooling layer, and a third convolutional layer, which are cascaded in sequence. The number of neurons in the first to third convolutional layers varies from 64 to 256. A pooling layer is used after the first two convolutional layers to prevent overfitting. The deep neural network module (DNN) includes three cascaded fully connected layers and an output layer.

5. An intrusion detection system based on a hybrid neural network CNN-DNN as described in claim 1, characterized in that... Object detection networks acquire network traffic datasets using sniffers.

Images