Convolutional Neural Network Intrusion Data Detection Method and System Based on LMDR Algorithm

Abstract

The present invention provides a method and system for detecting intrusion data in a convolutional neural network based on the LMDR algorithm. The intrusion data is processed through four aspects: data preprocessing, LMDR feature enhancement, feature reduction and data visualization, and convolutional neural network processing. The LMDR algorithm is mainly used to perform data transformation on the original data set to achieve feature enhancement of the original data. Compared with the existing processing methods using machine learning algorithms and neural network models, it can more fully explore the connections between different data features, thereby effectively improving the classification accuracy of intrusion data / non-intrusion data and reducing the false alarm rate of data classification.

Description

Technical Field

[0001] The present invention relates to the technical field of data information security processing, and particularly to a convolutional neural network intrusion data detection method and system based on the LMDR algorithm. Background Art

[0002] Currently, when processing intrusion detection data, usually some feature data that has little relation with the main feature target is removed through feature reduction. However, while deleting data with low feature correlation, the correlation problem between the deleted data and the selected main feature data is ignored. The above data processing operation will sacrifice the accuracy of part of the data. In addition, the existing intrusion detection data classification models can no longer meet the detection accuracy requirements for intrusion detection data in today's big data environment. Summary of the Invention

[0003] Aiming at the defects existing in the prior art, the present invention provides a convolutional neural network intrusion data detection method and system based on the LMDR algorithm. By performing data preprocessing on the target data object, normalized and standardized preprocessed data is obtained. Then, through the logarithmic marginal density ratio (LMDR) algorithm, data feature enhancement processing is performed on the preprocessed data to obtain a feature-enhanced data set. Feature reduction processing and data imaging processing are performed on the feature-enhanced data set to obtain an image feature data set. Finally, through a convolutional neural network (CNN), classification processing is performed on the image feature data set to determine the intrusion data existing in the target data object. It can be seen that the convolutional neural network intrusion data detection method and system based on the LMDR algorithm processes intrusion data through four aspects: data preprocessing, LMDR feature enhancement, feature reduction and data imaging, and convolutional neural network processing. It mainly uses the LMDR algorithm to perform data transformation on the original data set to achieve feature enhancement of the original data. Compared with the existing processing methods using machine learning algorithms and neural network models, it can more fully explore the connections between different data features, thereby effectively improving the classification accuracy of intrusion data / non-intrusion data and reducing the false alarm rate of data classification.

[0004] The present invention provides a convolutional neural network intrusion data detection method based on the LMDR algorithm, which is characterized by including the following steps:

[0005] Step S1, perform data preprocessing on the target data object to obtain normalized and standardized preprocessed data;

[0006] Step S2, through the logarithmic marginal density ratio (LMDR) algorithm, perform data feature enhancement processing on the preprocessed data to obtain a feature-enhanced data set;

[0007] Step S3, performing feature reduction processing and data imaging processing on the feature enhanced data set, so as to obtain an image feature data set;

[0008] Step S4, classifying the image feature data set through a convolutional neural network (CNN), thereby determining the intrusion data present in the target data object;

[0009] Furthermore, in step S1, data preprocessing is performed on the target data object to obtain normalized and standardized preprocessed data, specifically including:

[0010] Step S101, performing data discrete feature dummy coding processing on the data set corresponding to the target data object, so as to obtain a discrete dummy coded data set;

[0011] Step S102, performing data normalization and data standardization processing on the discrete dummy coded data set, so as to obtain the preprocessed data;

[0012] Further, in the step S2, the pre-processed data is subjected to data feature enhancement processing by using the logarithmic marginal density ratio (LMDR) algorithm, so as to obtain a feature-enhanced data set, specifically including:

[0013] Step S201, dividing the preprocessed data set S corresponding to the preprocessed data into two subsets S1 and S2 which are mutually exclusive in terms of data content;

[0014] Step S2, obtaining the class conditional density values ​​g* and f* corresponding to the subset S1, and the logarithmic marginal density ratio matrix Y corresponding to the subset S1;

[0015] Step S3, obtaining the logarithmic marginal density ratio matrix X(2)* of the subset S2 according to the class conditional density values ​​g* and f*, thereby constructing a new data set Z*=(X(2)*, Y), and using the new data set Z* as the feature enhanced data set;

[0016] Further, in step S3, the feature enhancement data set is subjected to feature reduction processing and data imaging processing, so as to obtain an image feature data set, specifically including:

[0017] Step S301, performing feature reduction processing on the feature enhanced data set by using a random forest algorithm, thereby reducing the original data dimension value n of the feature enhanced data set to a dimension value m, and the dimension value m satisfies m=a*a, a is a positive integer greater than 1, wherein the feature reduction processing is to eliminate data in the feature enhanced data set whose actual correlation with the main feature data is lower than a preset correlation threshold;

[0018] Step S302, perform data imaging processing on the feature-enhanced data set obtained after reducing the dimensionality value to m and then reconstructing, so as to obtain an a*a-dimensional image feature data set, where the data imaging processing is to perform binary difference on all the data in the reconstructed feature-enhanced data set to obtain the image feature data set;

[0019] Further, in the said step S4, through a convolutional neural network CNN, classify the image feature data set to determine the specific intrusion data existing in the target data object, specifically including,

[0020] Step S401, construct a convolutional neural network CNN, input the image feature data set with different specific numerical dimensions a*a into the convolutional neural network CNN, and use the method of 10-fold cross-validation to train the convolutional neural network CNN repeatedly for multiple times, and correspondingly obtain several model convergence values of the trained convolutional neural network CNN;

[0021] Step S402, determine the convolutional neural network CNN with optimal training according to several said model convergence values;

[0022] Step S403, through the convolutional neural network CNN with optimal training, classify the image feature data set to distinguish the intrusion data and non-intrusion data existing therein.

[0023] The present invention also provides a convolutional neural network intrusion data detection system based on the LMDR algorithm, which is characterized in that it includes a data preprocessing module, an LMDR feature enhancement module, a feature reduction and data imaging module, and a convolutional neural network processing module; wherein,

[0024] The data preprocessing module is used to perform data preprocessing on the target data object to obtain preprocessed data that is normalized and standardized;

[0025] The LMDR feature enhancement module is used to perform data feature enhancement processing on the preprocessed data through the logarithmic marginal density ratio LMDR algorithm to obtain a feature-enhanced data set;

[0026] The feature reduction and data imaging module is used to perform feature reduction processing and data imaging processing on the feature-enhanced data set to obtain an image feature data set;

[0027] The convolutional neural network processing module is used to classify the image feature data set through a convolutional neural network CNN to determine the intrusion data existing in the target data object;

[0028] Furthermore, the data preprocessing module includes a discrete feature dummy coding processing submodule, a normalization processing submodule and a standardization processing submodule; wherein,

[0029] The discrete feature dummy coding processing submodule is used to perform data discrete feature dummy coding processing on the data set corresponding to the target data object, so as to obtain a discrete dummy coded data set;

[0030] The normalization processing submodule and the standardization processing submodule are used to perform data normalization processing and data standardization processing on the discrete dummy coded data set, respectively, so as to obtain the preprocessed data;

[0031] Furthermore, the LMDR feature enhancement module includes a data set segmentation submodule, a data subset parameter calculation submodule and a feature enhancement data construction submodule; wherein,

[0032] The data set segmentation submodule is used to segment the preprocessed data set S corresponding to the preprocessed data into two subsets S1 and S2 which are mutually exclusive in terms of data content;

[0033] The data subset parameter calculation submodule is used to calculate the class conditional density values ​​g* and f* corresponding to the subset S1, calculate the logarithmic marginal density ratio matrix Y corresponding to the subset S1, and calculate the logarithmic marginal density ratio matrix X(2)* of the subset S2 based on the class conditional density values ​​g* and f*;

[0034] The feature enhancement data construction submodule is used to construct a new data set Z* according to the formula Z*=(X(2)*, Y), so that the new data set Z* is used as the feature enhancement data set;

[0035] Furthermore, the feature reduction and data imaging module includes a feature reduction processing submodule and a data imaging processing submodule; wherein,

[0036] The feature reduction processing submodule is used to perform feature reduction processing on the feature enhanced data set by using a random forest algorithm, so as to reduce the original data dimension value n of the feature enhanced data set to a dimension value m, and the dimension value m satisfies m=a*a, where a is a positive integer greater than 1, wherein the feature reduction processing is to eliminate data in the feature enhanced data set whose actual correlation with the main feature data is lower than a preset correlation threshold;

[0037] The data image processing sub-module is used to perform data image processing on the feature enhanced data set obtained by reconstructing after reducing the dimensionality value to m, so as to obtain an a*a dimensional image feature data set. Wherein, the data image processing is to perform binary difference on all the data in the reconstructed feature enhanced data set to obtain the image feature data set;

[0038] Furthermore, the convolutional neural network processing module includes a convolutional neural network CNN construction and training sub-module, an optimal convolutional neural network CNN determination sub-module, and a data classification processing sub-module; wherein,

[0039] The convolutional neural network CNN construction and training sub-module is used to construct a convolutional neural network CNN, input the image feature data sets with different specific numerical dimensions a*a into the convolutional neural network CNN, and repeatedly train the convolutional neural network CNN in the way of 10-fold cross-validation for multiple times, and correspondingly obtain several model convergence values of the trained convolutional neural network CNN;

[0040] The optimal convolutional neural network CNN determination sub-module is used to determine the convolutional neural network CNN with the smallest model convergence value as the optimally trained convolutional neural network CNN according to several model convergence values;

[0041] The data classification processing sub-module is used to classify the image feature data set through the optimally trained convolutional neural network CNN, so as to distinguish the intrusion data and non-intrusion data existing therein.

[0042] Compared with the prior art, the convolutional neural network intrusion data detection method and system based on the LMDR algorithm perform data preprocessing on the target data object to obtain preprocessed data that is normalized and standardized. Then, through the logarithmic marginal density ratio (LMDR) algorithm, the preprocessed data is subjected to data feature enhancement processing to obtain a feature-enhanced data set. The feature-enhanced data set is subjected to feature reduction processing and data imaging processing to obtain an image feature data set. Finally, through the convolutional neural network (CNN), the image feature data set is classified to determine the intrusion data existing in the target data object. It can be seen that the convolutional neural network intrusion data detection method and system based on the LMDR algorithm process intrusion data through four aspects: data preprocessing, LMDR feature enhancement, feature reduction and data imaging, and convolutional neural network processing. It mainly uses the LMDR algorithm to perform data transformation on the original data set to achieve feature enhancement of the original data. Compared with the existing processing methods using machine learning algorithms and neural network models, it can more fully explore the connections between different data features, thereby effectively improving the classification accuracy of intrusion data / non-intrusion data and reducing the false alarm rate of data classification.

[0043] Other features and advantages of the present invention will be described in the following specification, and in part, will be obvious from the specification, or can be understood by implementing the present invention. The objectives and other advantages of the present invention can be achieved and obtained by the structures specifically pointed out in the written specification, claims, and drawings.

[0044] The technical solution of the present invention will be further described in detail below through the accompanying drawings and embodiments. Description of the Drawings

[0045] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the accompanying drawings required for the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0046] Figure 1 It is a schematic flowchart of the convolutional neural network intrusion data detection method based on the LMDR algorithm provided by the present invention.

[0047] Figure 2 It is the encoded data set obtained after the data discrete feature sub-encoding processing in the convolutional neural network intrusion data detection method based on the LMDR algorithm provided by the present invention.

[0048] Figure 3The grayscale image obtained after data imaging processing in the convolutional neural network intrusion data detection method based on the LMDR algorithm provided by the present invention.

[0049] Figure 4 The structural schematic diagram of the convolutional neural network intrusion data detection system based on the LMDR algorithm provided by the present invention. Specific implementation manners

[0050] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0051] Refer to Figure 1 , which is the flowchart of the convolutional neural network intrusion data detection method based on the LMDR algorithm provided by the embodiments of the present invention. The convolutional neural network intrusion data detection method based on the LMDR algorithm includes the following steps:

[0052] Step S1: Perform data preprocessing on the target data object to obtain normalized and standardized preprocessed data;

[0053] Step S2: Perform data feature enhancement processing on the preprocessed data through the logarithmic marginal density ratio (LMDR) algorithm to obtain a feature-enhanced data set;

[0054] Step S3: Perform feature reduction processing and data imaging processing on the feature-enhanced data set to obtain an image feature data set;

[0055] Step S4: Perform classification processing on the image feature data set through a convolutional neural network (CNN) to determine the intrusion data existing in the target data object.

[0056] Different from the prior art that only uses a convolutional neural network as an overall model classifier to convert intrusion detection data into an image to adapt to the input of the convolutional neural network, the convolutional neural network intrusion data detection method based on the LMDR algorithm takes into account that after traditional feature dimensionality reduction and image conversion, the overall classification performance of the overall model will be poor due to insufficiently obvious classification features. It uses the logarithmic marginal density ratio (LMDR) algorithm as a means of data feature enhancement, which can effectively improve data feature characteristics and still maintain the high feature characteristics of the data itself after subsequent feature reduction processing, so as to fully explore the connections between different data features, effectively improve the classification accuracy of intrusion data / non-intrusion data, and reduce the false alarm rate of data classification.

[0057] Preferably, in step S1, data preprocessing is performed on the target data object to obtain normalized and standardized preprocessed data, specifically including:

[0058] Step S101: Perform one-hot encoding on the data set corresponding to the target data object to obtain a one-hot encoded data set;

[0059] Step S102: Perform data normalization and data standardization on the one-hot encoded data set to obtain the preprocessed data.

[0060] Among them, the implementation process of the one-hot encoding of data discrete features is as follows: Select the NSL_KDD data set as the experimental data set. Since the convolutional neural network requires numerical data as input, it is necessary to first perform one-hot encoding conversion on the three discrete feature values of protocol_type, service, and flag in the original data set. Through data analysis, it can be seen that the entire data set contains a total of 3 protocol types (protocol_type), 70 service types (service), and 11 flag types (flag). Use a specific model to convert these three discrete feature values into a sequence represented by several 0s and one 1, that is, implement numerical one-hot encoding processing, and a new data set with 122-dimensional features is obtained. The obtained new data set is as Figure 2 shown.

[0061] Among them, the implementation process of the data normalization and the data standardization is as follows: Due to the requirements in LMDR feature enhancement and the fact that the data set itself may be affected by large data differences and affect the final classification result, the present invention uses MinMax standardization to normalize the overall data to the interval range of [0, 1]. The MinMax normalization formula is as follows:

[0062]

[0063] In the above formula, x* represents the standardized data, x represents the data in the original data set, x min represents the minimum data value in a certain feature of the data set, and x max represents the maximum data value in the data set feature.

[0064] By performing a series of processes such as one-hot encoding, data normalization, and data standardization on the data set corresponding to the target data object, the data can meet the processing requirements of the subsequent Logarithmic Marginal Density Ratio (LMDR) algorithm, and can also effectively reduce the noise of the data itself, thereby improving the processing progress and efficiency of the subsequent LMDR algorithm.

[0065] Preferably, in step S2, the preprocessed data is subjected to data feature enhancement processing through the logarithmic marginal density ratio (LMDR) algorithm, so as to obtain a feature-enhanced data set, specifically including:

[0066] Step S201: Divide the preprocessing data set S corresponding to the preprocessed data into two mutually exclusive subsets S1 and S2 in terms of data content;

[0067] Step S2: Obtain the class-conditional density values g* and f* corresponding to the subset S1, and the logarithmic marginal density ratio matrix Y corresponding to the subset S1;

[0068] Step S3: According to the class-conditional density values g* and f*, obtain the logarithmic marginal density ratio matrix X(2)* of the subset S2, and construct a new data set Z* = (X(2)*, Y), and use the new data set Z* as the feature-enhanced data set.

[0069] Among them, the process of calculating the class-conditional density values g* and f* corresponding to the subset S1 is as follows:

[0070] First, the division of the data set: Randomly and mutually exclusively divide the data set S into two data sets S1 and S2, and these two data sets will satisfy S 1 ∪S 2 = S, and define S 1 =(X 1 , Y 1 ), S 2 =(X 2 , Y 2 ), and at the same time, let N1 and N2 be the sample numbers of S1 and S2 respectively, then N1 + N2 = N;

[0071] Second, according to the kernel density estimation of the class-conditional density, apply the kernel density estimation to the S1 data set to find the class-conditional density, and define this estimation with g* and f* respectively, where: g * =(g 1 * , g 2 * , …, g p * ) T , f * =(f 1 * , f 2 * , …, f p * ) T ,

[0072] Let X1+ define the label Y in the first data set S1i (1) = 1, i = 1, 2, …, N 1 The data set related thereto That is Similarly, X can be set 1- Define S 1 When Y appears in the set i (1) = 0, i = 1, 2, …, N 1 At this time The data set, that is And satisfy X 1+ ∪X 1- = X (1) Therefore, define g j * (·) and f j * (·) are respectively based on the following two data subsets And Of, and N 1+ And N 1- Respectively represent the sample numbers of the two data sets X 1+ And X 1- And there is N 1+ + N 1- = N

[0073] Therefore, the above concept can be expressed as follows

[0074]

[0075]

[0076] Where j = 1, 2, … p, p represents the predetermined dimension, K() represents the kernel function, and h is the bandwidth.

[0077] Among them, according to the conditional density values g* and f*, the process of obtaining the logarithmic marginal density ratio matrix X(2)* of the subset S2 is

[0078] Through data conversion, apply LMDR feature enhancement to the data set S 2 So as to convert X (2) Into X (2)* That is

[0079]

[0080] Then a new data set can be formed Among them are

[0081]

[0082] Data augmentation processing is achieved through the Logarithmic Marginal Density Ratio (LMDR) algorithm, which can effectively enhance data features. Moreover, the processing process of the LMDR algorithm is simple. It can quickly and efficiently achieve feature enhancement with a relatively small amount of computation, thereby reducing the complexity and workload of data feature enhancement.

[0083] Preferably, in step S3, feature reduction processing and data imaging processing are performed on the feature-enhanced data set to obtain an image feature data set, specifically including:

[0084] Step S301: Perform feature reduction processing on the feature-enhanced data set through the random forest algorithm, thereby reducing the original data dimension value n of the feature-enhanced data set to the dimension value m, and the dimension value m satisfies m = a * a, where a is a positive integer greater than 1. The feature reduction processing is to eliminate the data in the feature-enhanced data set whose actual correlation degree with the main feature data is lower than the preset correlation degree threshold. The random forest algorithm is a random algorithm in the prior art and will not be elaborated further here.

[0085] Step S302: Perform data imaging processing on the feature-enhanced data set reconstructed after reducing the dimension value to m to obtain an a * a-dimensional image feature data set. The data imaging processing is to perform binary difference on all the data in the reconstructed feature-enhanced data set to obtain the image feature data set.

[0086] Among them, the process of the data imaging processing is as follows: All the features of the data set are scaled to the range of 0 - 255 (RGB color range), and their values are displayed using a grayscale image. Different types of intrusions can be reflected by different grayscale images. A well-distinguishable image data set can also be used as the input data of a convolutional neural network to achieve good classification results by the model. The converted grayscale image is as Figure 3 shown. As can be seen from the Figure 3 figure, the first column is the grayscale image of the data obtained by reducing the features of the original data set to 40 dimensions (5x8). The middle column is the grayscale image of the data obtained by reducing the 122-dimensional features after one-hot encoding to 81 dimensions (9*9). The third column is the grayscale image of the data obtained by first enhancing the data set through LMDR feature enhancement and then reducing the features to 81 dimensions (9x9). By comparing the grayscale images in each column, it can be found that the grayscale images of the same type have the same or similar features. After data enhancement through LMDR, more information is contained in each unit pixel point, and there is a stronger distinguishability between intrusion attack traffic and normal traffic.

[0087] By performing feature reduction processing and data visualization processing on the feature-enhanced data set, the feature-enhanced data set can be converted into data adapted to the subsequent convolutional neural network CNN, thereby improving the data processing efficiency and accuracy of the convolutional neural network CNN.

[0088] Preferably, in this step S4, through the convolutional neural network CNN, the image feature data set is classified to determine the specific intrusion data existing in the target data object, including

[0089] Step S401: Construct a convolutional neural network CNN. Input the image feature data set with different specific numerical dimensions a*a into the convolutional neural network CNN, and use the 10-fold cross-validation method to repeatedly train the convolutional neural network CNN for multiple times, and correspondingly obtain several model convergence values of the trained convolutional neural network CNN.

[0090] Step S402: Determine the optimally trained convolutional neural network CNN according to several of the model convergence values.

[0091] Step S403: Through the optimally trained convolutional neural network CNN, classify the image feature data set to distinguish the existing intrusion data and non-intrusion data.

[0092] By training and optimizing the convolutional neural network CNN through the 10-fold cross-validation method and classifying the image feature data set under the optimized condition, it can ensure accurate and efficient distinction between intrusion data and non-intrusion data, thereby maximizing the detection reliability of intrusion data.

[0093] Refer to Figure 4 , which is the structural schematic diagram of the convolutional neural network intrusion data detection system based on the LMDR algorithm provided by the embodiment of the present invention. The convolutional neural network intrusion data detection system based on the LMDR algorithm includes a data preprocessing module, an LMDR feature enhancement module, a feature reduction and data visualization module, and a convolutional neural network processing module; wherein,

[0094] The data preprocessing module is used to perform data preprocessing on the target data object to obtain normalized and standardized preprocessed data.

[0095] The LMDR feature enhancement module is used to perform data feature enhancement processing on the preprocessed data through the logarithmic marginal density ratio LMDR algorithm to obtain a feature-enhanced data set.

[0096] The feature reduction and data visualization module is used to perform feature reduction processing and data visualization processing on the feature-enhanced data set to obtain an image feature data set.

[0097] The convolutional neural network processing module is used to classify the image feature data set through a convolutional neural network (CNN) to determine the intrusion data existing in the target data object.

[0098] Different from the prior art which only uses a convolutional neural network as an overall model classifier and converts intrusion detection data into an image format to adapt to the input of the convolutional neural network, the convolutional neural network intrusion data detection system based on the LMDR algorithm takes into account that after traditional feature dimensionality reduction and image conversion, the overall classification performance of the overall model may be poor due to insufficiently obvious classification features. It uses the logarithmic marginal density ratio (LMDR) algorithm as a means of data feature enhancement, which can effectively improve the data characteristics and still maintain the high characteristics of the data itself after subsequent feature reduction processing, so as to fully explore the relationship between different data features, effectively improve the classification accuracy of intrusion data / non-intrusion data, and reduce the false alarm rate of data classification.

[0099] Preferably, the data preprocessing module includes a discrete feature dummy coding processing sub-module, a normalization processing sub-module, and a standardization processing sub-module; among them,

[0100] The discrete feature dummy coding processing sub-module is used to perform data discrete feature dummy coding processing on the data set corresponding to the target data object to obtain a discrete dummy coded data set;

[0101] The normalization processing sub-module and the standardization processing sub-module are respectively used to perform data normalization processing and data standardization processing on the discrete dummy coded data set to obtain the preprocessed data.

[0102] By performing a series of processing such as data discrete feature dummy coding processing, data normalization processing, and data standardization processing on the data set corresponding to the target data object, the data can meet the processing requirements of the subsequent logarithmic marginal density ratio (LMDR) algorithm, and can also effectively reduce the noise of the data itself, thereby improving the processing progress and efficiency of the subsequent logarithmic marginal density ratio (LMDR) algorithm.

[0103] Preferably, the LMDR feature enhancement module includes a data set segmentation sub-module, a data subset parameter calculation sub-module, and a feature enhanced data construction sub-module; among them,

[0104] The data set segmentation sub-module is used to divide the preprocessing data set S corresponding to the preprocessed data into two mutually exclusive subsets S1 and S2 in terms of data content;

[0105] The data subset parameter calculation submodule is used to calculate the class conditional density values ​​g* and f* corresponding to the subset S1, calculate the logarithmic marginal density ratio matrix Y corresponding to the subset S1, and calculate the logarithmic marginal density ratio matrix X(2)* of the subset S2 based on the class conditional density values ​​g* and f*;

[0106] The feature-enhanced data construction submodule is used to construct a new data set Z* according to the formula Z*=(X(2)*, Y), so that the new data set Z* is used as the feature-enhanced data set.

[0107] Data enhancement processing is achieved through the logarithmic marginal density ratio LMDR algorithm, which can effectively enhance data features. The processing process of the LMDR algorithm is simple, and it can quickly and efficiently achieve feature enhancement with a small amount of computation, thereby reducing the complexity and workload of data feature enhancement.

[0108] Preferably, the feature reduction and data imaging module includes a feature reduction processing submodule and a data imaging processing submodule; wherein,

[0109] The feature reduction processing submodule is used to perform feature reduction processing on the feature enhanced data set by using a random forest algorithm, so as to reduce the original data dimension value n of the feature enhanced data set to a dimension value m, and the dimension value m satisfies m=a*a, where a is a positive integer greater than 1, wherein the feature reduction processing is to eliminate data in the feature enhanced data set whose actual correlation with the main feature data is lower than a preset correlation threshold;

[0110] The data imaging processing submodule is used to perform data imaging processing on the feature enhanced data set reconstructed after reducing the dimension value to m, so as to obtain an a*a dimensional image feature data set, wherein the data imaging processing is to perform binary difference on all data in the reconstructed feature enhanced data set, so as to obtain the image feature data set.

[0111] By performing feature reduction processing and data imaging processing on the feature enhanced data set, the feature enhanced data set can be converted into data compatible with the subsequent convolutional neural network CNN, thereby improving the data processing efficiency and accuracy of the convolutional neural network CNN.

[0112] Preferably, the convolutional neural network processing module includes a convolutional neural network CNN construction and training submodule, an optimal convolutional neural network CNN determination submodule and a data classification processing submodule; wherein,

[0113] The convolutional neural network (CNN) construction and training sub-module is used to construct a convolutional neural network (CNN), input the image feature data set with different specific numerical dimensions of a*a into the convolutional neural network (CNN), and use the method of 10-fold cross-validation to train the convolutional neural network (CNN) repeatedly for several times, and correspondingly obtain several model convergence values of the trained convolutional neural network (CNN).

[0114] The optimal convolutional neural network (CNN) determination sub-module is used to determine the convolutional neural network (CNN) with the smallest model convergence value as the optimally trained convolutional neural network (CNN) according to several such model convergence values.

[0115] The data classification and processing sub-module is used to classify the image feature data set through the optimally trained convolutional neural network (CNN), so as to distinguish the intrusion data and non-intrusion data existing therein.

[0116] By training and optimizing the convolutional neural network (CNN) in the way of 10-fold cross-validation and classifying the image feature data set under the condition of obtaining the optimization, it can ensure the accurate and efficient distinction between intrusion data and non-intrusion data, thus maximizing the detection reliability of intrusion data.

[0117] From the content of the above embodiments, the convolutional neural network intrusion data detection method and system based on the LMDR algorithm processes intrusion data through four aspects: data preprocessing, LMDR feature enhancement, feature reduction and data visualization, and convolutional neural network processing. It mainly uses the LMDR algorithm to perform data transformation on the original data set to achieve feature enhancement of the original data. Compared with the existing processing methods using machine learning algorithms and neural network models, it can more fully explore the connections between different data features, thus effectively improving the classification accuracy of intrusion data / non-intrusion data and reducing the false alarm rate of data classification.

[0118] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these changes and modifications.

Claims

1. Convolutional neural network intrusion data detection method based on LMDR algorithm, It is characterized in that The steps include: Step S1, performing data preprocessing on the target data object to obtain normalized and standardized preprocessed data; Step S2, performing data feature enhancement processing on the preprocessed data by using a logarithmic marginal density ratio (LMDR) algorithm, thereby obtaining a feature-enhanced data set; Step S3, performing feature reduction processing and data imaging processing on the feature enhanced data set, so as to obtain an image feature data set; Step S4, classifying the image feature data set through a convolutional neural network (CNN), thereby determining the intrusion data present in the target data object.

2. The convolutional neural network intrusion data detection method based on the LMDR algorithm as claimed in claim 1, Features: In step S1, data preprocessing is performed on the target data object to obtain normalized and standardized preprocessed data, specifically including: Step S101, performing data discrete feature dummy coding processing on the data set corresponding to the target data object, so as to obtain a discrete dummy coded data set; Step S102, performing data normalization processing and data standardization processing on the discrete dummy coded data set, so as to obtain the preprocessed data.

3. The convolutional neural network intrusion data detection method based on the LMDR algorithm as claimed in claim 1, Features: In the step S2, the preprocessed data is subjected to data feature enhancement processing by using the logarithmic marginal density ratio (LMDR) algorithm, so as to obtain a feature-enhanced data set, specifically including: Step S201, dividing the preprocessed data set S corresponding to the preprocessed data into two subsets S1 and S2 which are mutually exclusive in terms of data content; Step S2, obtaining the class conditional density values ​​g* and f* corresponding to the subset S1, and the logarithmic marginal density ratio matrix Y corresponding to the subset S1; Step S3, according to the class conditional density values ​​g* and f*, obtain the logarithmic marginal density ratio matrix X(2)* of the subset S2, thereby constructing a new data set Z*=(X(2)*, Y), and use the new data set Z* as the feature enhanced data set.

4. The convolutional neural network intrusion data detection method based on the LMDR algorithm as claimed in claim 1, Features: In the step S3, the feature enhancement data set is subjected to feature reduction processing and data imaging processing, so as to obtain an image feature data set, specifically including: Step S301, performing feature reduction processing on the feature enhanced data set by using a random forest algorithm, thereby reducing the original data dimension value n of the feature enhanced data set to a dimension value m, and the dimension value m satisfies m=a*a, a is a positive integer greater than 1, wherein the feature reduction processing is to eliminate data in the feature enhanced data set whose actual correlation with the main feature data is lower than a preset correlation threshold; Step S302: Perform data imaging processing on the feature-enhanced data set obtained after reducing the dimensionality to m and then reconstructing it, so as to obtain an a*a-dimensional image feature data set. Herein, the data imaging processing is to perform binary difference on all the data in the reconstructed feature-enhanced data set to obtain the image feature data set.

5. The convolutional neural network intrusion data detection method based on the LMDR algorithm as described in claim 4, characterized in that: In the step S4, through the convolutional neural network CNN, perform classification processing on the image feature data set to determine the specific intrusion data existing in the target data object, specifically including, Step S401: Construct a convolutional neural network CNN, input the image feature data set with different specific numerical dimensions a*a into the convolutional neural network CNN, and use the method of 10-fold cross-validation to repeatedly train the convolutional neural network CNN for multiple times, and correspondingly obtain several model convergence values of the trained convolutional neural network CNN; Step S402: Determine the convolutional neural network CNN with the most optimized training according to several of the model convergence values; Step S403: Through the convolutional neural network CNN with the most optimized training, perform classification processing on the image feature data set to distinguish the intrusion data and non-intrusion data existing therein.

6. A convolutional neural network intrusion data detection system based on the LMDR algorithm, characterized in that it includes a data preprocessing module, an LMDR feature enhancement module, a feature reduction and data imaging module, and a convolutional neural network processing module; wherein, The data preprocessing module is used to perform data preprocessing on the target data object to obtain preprocessed data that is normalized and standardized; The LMDR feature enhancement module is used to perform data feature enhancement processing on the preprocessed data through the logarithmic marginal density ratio LMDR algorithm to obtain a feature-enhanced data set; The feature reduction and data imaging module is used to perform feature reduction processing and data imaging processing on the feature-enhanced data set to obtain an image feature data set; The convolutional neural network processing module is used to perform classification processing on the image feature data set through the convolutional neural network CNN to determine the intrusion data existing in the target data object.

7. The convolutional neural network intrusion data detection system based on the LMDR algorithm as described in claim 6, characterized in that: The data preprocessing module includes a discrete feature dummy encoding processing sub-module, a normalization processing sub-module, and a standardization processing sub-module; wherein, The discrete feature dummy encoding processing sub-module is used to perform data discrete feature dummy encoding processing on the data set corresponding to the target data object to obtain a discrete dummy-encoded data set; The normalization processing sub-module and the standardization processing sub-module are respectively used to perform data normalization processing and data standardization processing on the discrete dummy-encoded data set to obtain the preprocessed data.

8. The convolutional neural network intrusion data detection system based on the LMDR algorithm as claimed in claim 6, Features: The LMDR feature enhancement module includes a data set segmentation submodule, a data subset parameter calculation submodule and a feature enhancement data construction submodule; wherein, The data set segmentation submodule is used to segment the preprocessed data set S corresponding to the preprocessed data into two subsets S1 and S2 which are mutually exclusive in terms of data content; The data subset parameter calculation submodule is used to calculate the class conditional density values ​​g* and f* corresponding to the subset S1, calculate the logarithmic marginal density ratio matrix Y corresponding to the subset S1, and calculate the logarithmic marginal density ratio matrix X(2)* of the subset S2 based on the class conditional density values ​​g* and f*; The feature enhancement data construction submodule is used to construct a new data set Z* according to the formula Z*=(X(2)*, Y), so that the new data set Z* is used as the feature enhancement data set.

9. The convolutional neural network intrusion data detection system based on the LMDR algorithm as claimed in claim 6, Features: The feature reduction and data imaging module includes a feature reduction processing submodule and a data imaging processing submodule; wherein, The feature reduction processing submodule is used to perform feature reduction processing on the feature enhanced data set by using a random forest algorithm, so as to reduce the original data dimension value n of the feature enhanced data set to a dimension value m, and the dimension value m satisfies m=a*a, where a is a positive integer greater than 1, wherein the feature reduction processing is to eliminate data in the feature enhanced data set whose actual correlation with the main feature data is lower than a preset correlation threshold; The data imaging processing submodule is used to perform data imaging processing on the feature enhanced data set reconstructed after reducing the dimension value to m, so as to obtain an a*a dimensional image feature data set, wherein the data imaging processing is to perform binary difference on all data in the reconstructed feature enhanced data set, so as to obtain the image feature data set.

10. The convolutional neural network intrusion data detection system based on the LMDR algorithm as claimed in claim 6, Features: The convolutional neural network processing module includes a convolutional neural network CNN construction and training submodule, an optimal convolutional neural network CNN determination submodule and a data classification processing submodule; wherein, The convolutional neural network CNN construction and training submodule is used to construct a convolutional neural network CNN, input the image feature data set with different specific numerical dimensions a*a into the convolutional neural network CNN, and repeatedly train the convolutional neural network CNN multiple times using a 10-fold cross-validation method, and correspondingly obtain several model convergence values ​​of the trained convolutional neural network CNN; The optimal convolutional neural network CNN determination submodule is used to determine the convolutional neural network CNN with the minimum model convergence value as the convolutional neural network CNN with the most optimized training according to the plurality of model convergence values; The data classification and processing sub-module is used to classify the image feature data set through the trained and optimized Convolutional Neural Network (CNN) to distinguish the intrusion data and non-intrusion data therein.

Images