Method and device for adversarial training of intrusion detection system in new space-based network

Abstract

The present invention discloses an adversarial training method and device for an intrusion detection system in a new space-based network, including: obtaining a flow sample; inputting the flow sample into the intrusion detection system to obtain a first output label; determining a loss function according to the first output label; using a natural evolution strategy to determine the gradient of the expected value of the loss function; determining a perturbation value according to the gradient of the expected value of the loss function; determining an adversarial sample according to the perturbation value; inputting the adversarial sample into the intrusion detection system to obtain a second output label; and determining an adversarial training result according to the second output label. The present invention solves the problem that an intrusion detection system based on ensemble learning cannot obtain a gradient value and that a large amount of satellite resources in the new space-based network need to be consumed in the process of generating a proxy model by calculating the gradient of the intrusion detection system in the new space-based network, thereby realizing efficient adversarial training and achieving a better ability to evade detection by the intrusion detection system on the basis of low computing overhead.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method and a device for adversarial training of an intrusion detection system in a novel space-based network. Background Art

[0002] IDS stands for Intrusion Detection System, which generally distinguishes benign and malicious network traffic through machine learning or deep learning. In recent years, IDS has been widely deployed behind network firewalls. When malicious traffic is detected flowing through the network, an alarm is issued to prompt network administrators that the current network may be under attack, thereby improving the overall security of the network. The development trend of satellite Internet is to provide network access services in collaboration with ground networks to build a new type of space-based network. Therefore, it is an inevitable trend to deploy IDS in the new type of space-based network. IDS based on machine learning or deep learning generally achieves a relatively high accuracy after training, that is, it can accurately distinguish whether the traffic flowing through the new type of space-based network is benign or malicious. However, machine learning or deep learning algorithms are easily affected by adversarial attacks, especially for classification models. Adding some slight perturbations to the input of the model can cause the model to misclassify. For IDS in the new type of space-based network, adding slight perturbations to malicious traffic can cause IDS to misclassify malicious traffic as normal traffic, so that network attacks can evade IDS detection and threaten the security of the new type of space-based network. But in fact, it is very necessary to study adversarial attacks, because the research on network attack and defense promote each other. Network attack experiments can conduct in-depth evaluation of the vulnerability and robustness of new space-based network IDS, and can explore the security vulnerabilities of intrusion detection systems in new space-based networks based on the idea of ​​adversarial attacks, so as to prevent them and make IDS more robust.

[0003] In order to further improve the detection capability of IDS and weaken the impact of adversarial attacks on classification models, IDS deployed in ground networks are currently developing towards classification models based on ensemble learning, and have achieved great success. Classic adversarial attack algorithms such as FGSM, PGD, DeepFool, and C&W have failed on IDS based on ensemble learning. Therefore, it can be predicted that IDS deployed in new space-based networks will also develop towards classification models based on ensemble learning. The failure of classic adversarial attack algorithms when attacking IDS based on ensemble learning is because these algorithms require the gradient of the target classification model when calculating perturbations, and the ensemble learning model that integrates multiple classification algorithms is not differentiable, resulting in the inability to calculate the gradient value. In order to solve the problem of non-differentiability of the classification model based on ensemble learning, the adversarial attack on the ensemble learning model currently adopts the method of transfer learning. A differentiable proxy model similar to the classification boundary of the ensemble classification model is trained through a large number of interactions with the target classification model. However, the effect of attacking IDS based on ensemble learning classification models in new space-based networks through transfer learning is heavily dependent on the similarity between the proxy model and the target ensemble model. In order to calculate the gradient, the proxy models obtained are all single classification models rather than integrated models. Therefore, the proxy models obtained by interacting with a large amount of data of the target classification model are quite different from the target integrated classification model, and the attack effect is unsatisfactory, which cannot provide further development direction for the IDS deployed in the new space-based network. In addition, since the communication links of the new space-based network include "ground node-ground node", "satellite node-satellite node", and "satellite node-ground node", it is obvious that the "satellite node-ground node" communication link is long, which will bring a large communication delay. And because the satellite nodes move at high speed, there is no perfect ground infrastructure to provide a steady stream of energy for the satellite system, so the design of the satellite payload needs to meet the low energy cost, which leads to the poor computing power of the satellite node. When the computational complexity is high, the computational cost of the satellite node will be too high and the computation time will be long. The current method of obtaining the proxy model by interacting with the target IDS through a large amount of initial data requires a lot of connections with the satellite and makes the satellite payload calculate continuously, which can easily lead to the exhaustion of satellite node computing resources and cause the new space-based network to crash.

[0004] In summary, there is an urgent need for a method for adversarial training of intrusion detection systems in new space-based networks to solve the problems existing in the above-mentioned prior arts. Summary of the invention

[0005] Since the existing methods have the above problems, the present invention proposes an adversarial training method and device for an intrusion detection system in a new space-based network.

[0006] In a first aspect, the present invention provides an adversarial training method for an intrusion detection system in a novel space-based network, comprising:

[0007] Get traffic samples;

[0008] Inputting the traffic sample into an intrusion detection system to obtain a first output label;

[0009] Determining a loss function according to the first output label;

[0010] Determining the gradient of the expected value of the loss function using a natural evolution strategy;

[0011] Determining a disturbance value according to the gradient of the expected value of the loss function;

[0012] Determining an adversarial sample according to the disturbance value;

[0013] Inputting the adversarial sample into the intrusion detection system to obtain a second output label;

[0014] Determine an adversarial training result according to the second output label.

[0015] Furthermore, the adopting of the natural evolution strategy to determine the gradient of the expected value of the loss function includes:

[0016] Get search distribution;

[0017] A natural evolution strategy is used to update the parameters of the search distribution to obtain the gradient of the expected value of the loss function.

[0018] Furthermore, the search distribution is a Gaussian distribution.

[0019] Further, determining the disturbance value according to the gradient of the expected value of the loss function includes:

[0020] The perturbation value is determined according to the gradient of the expected value of the loss function using an iterative gradient ascent method.

[0021] Further, determining the adversarial sample according to the disturbance value includes:

[0022] Obtain malicious traffic samples;

[0023] The disturbance value is superimposed on the malicious traffic sample to obtain an adversarial sample.

[0024] Further, determining the adversarial training result according to the second output label includes:

[0025] Determining whether the second output label indicates that the adversarial sample is benign traffic;

[0026] If yes, the adversarial training result is a successful attack, otherwise the adversarial training result is a failed attack.

[0027] In a second aspect, the present invention provides an adversarial training device for an intrusion detection system in a novel space-based network, comprising:

[0028] An acquisition module, used to obtain traffic samples;

[0029] A processing module is used to input the traffic sample into an intrusion detection system to obtain a first output label; determine a loss function based on the first output label; determine the gradient of the expected value of the loss function using a natural evolution strategy; determine a perturbation value based on the gradient of the expected value of the loss function; determine an adversarial sample based on the perturbation value; input the adversarial sample into the intrusion detection system to obtain a second output label; and determine an adversarial training result based on the second output label.

[0030] Furthermore, the processing module is specifically used for:

[0031] Get search distribution;

[0032] A natural evolution strategy is used to update the parameters of the search distribution to obtain the gradient of the expected value of the loss function.

[0033] Furthermore, the processing module is specifically used for:

[0034] The search distribution is a Gaussian distribution.

[0035] Furthermore, the processing module is specifically used for:

[0036] The perturbation value is determined according to the gradient of the expected value of the loss function using an iterative gradient ascent method.

[0037] Furthermore, the processing module is specifically used for:

[0038] Obtain malicious traffic samples;

[0039] The disturbance value is superimposed on the malicious traffic sample to obtain an adversarial sample.

[0040] Furthermore, the processing module is specifically used for:

[0041] Determining whether the second output label indicates that the adversarial sample is benign traffic;

[0042] If yes, the adversarial training result is a successful attack, otherwise the adversarial training result is a failed attack.

[0043] In a third aspect, the present invention further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, the adversarial training method for an intrusion detection system in a new space-based network as described in the first aspect is implemented.

[0044] In a fourth aspect, the present invention further provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the adversarial training method for an intrusion detection system in a new space-based network as described in the first aspect.

[0045] It can be seen from the above technical scheme that the adversarial training method and device for the intrusion detection system in the new space-based network provided by the present invention solves the problem that the intrusion detection system based on ensemble learning cannot obtain the gradient value and needs to consume a large amount of satellite resources in the new space-based network in the process of generating the proxy model by calculating the gradient of the intrusion detection system in the new space-based network. It realizes efficient adversarial training and achieves the ability to evade detection of the intrusion detection system with good effect on the basis of low computing overhead. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0047] Figure 1 A system framework for the adversarial training method for an intrusion detection system in a novel space-based network provided by the present invention;

[0048] Figure 2 A schematic diagram of the process of the adversarial training method for an intrusion detection system in a novel space-based network provided by the present invention;

[0049] Figure 3 A schematic diagram of the process of adversarial training for an intrusion detection system in a novel space-based network provided by the present invention;

[0050] Figure 4 A schematic diagram of the structure of an adversarial training device for an intrusion detection system in a novel space-based network provided by the present invention;

[0051] Figure 5 This is a schematic structural diagram of an electronic device provided by the present invention. DETAILED DESCRIPTION

[0052] The specific implementation of the present invention is further described below in conjunction with the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and cannot be used to limit the protection scope of the present invention.

[0053] The adversarial training method for an intrusion detection system in a novel space-based network provided by the embodiment of the present invention can be applied to Figure 1 In the system architecture shown, the system architecture includes an intrusion detection system 100 and an adversarial sample generation model 200.

[0054] Specifically, the adversarial sample generation model 200 is used to obtain traffic samples;

[0055] Inputting the traffic sample into the intrusion detection system 100 to obtain a first output label;

[0056] Determining a loss function based on the first output label;

[0057] A natural evolution strategy is used to determine the gradient of the expected value of the loss function;

[0058] Determine the perturbation value according to the gradient of the expected value of the loss function;

[0059] Determine the adversarial sample based on the perturbation value.

[0060] The intrusion detection system 100 is used to obtain a second output label after the adversarial sample is input;

[0061] The adversarial sample generation model 200 determines the adversarial training result according to the second output label.

[0062] It should be noted that Figure 1 This is only an example of the system architecture of the embodiment of the present invention, and the present invention does not make any specific limitation to this.

[0063] Based on the system architecture shown above, Figure 2 A flowchart corresponding to an adversarial training method for an intrusion detection system in a novel space-based network provided by an embodiment of the present invention is shown in FIG. Figure 2 As shown, the method includes:

[0064] Step 201, obtaining a traffic sample.

[0065] Step 202: Input the traffic sample into the intrusion detection system to obtain a first output label.

[0066] With the rapid development of space network technology, especially the emergence of intersatellite links, space information systems have begun to develop in the direction of networking. In addition, due to the increasing needs of national security, aerospace, disaster warning, and the gradual deepening of space exploration and other tasks, various strategic information tasks are constantly carried out in different dimensions of space such as land, sea, air, and space, which requires the original independent networks to share information and realize cross-regional and cross-space communications and coordinated work of network nodes. This has prompted the further development of space information systems and required them to be organically integrated with ground networks to form a new type of space-based network.

[0067] It should be noted that the intrusion detection system in the embodiment of the present invention is deployed in a new space-based network.

[0068] Step 203: determine a loss function according to the first output label.

[0069] Specifically, the loss function of the intrusion detection system in the new space-based network when inputting traffic sample t and outputting label l is recorded as L(θ), where θ represents the hyperparameter of the classification model.

[0070] Step 204: Determine the gradient of the expected value of the loss function using a natural evolution strategy.

[0071] It should be noted that the natural evolution strategy is an optimization technique that uses search gradients in the search space to update the parameters of the search distribution to find the optimal solution.

[0072] Specifically, the steps are as follows: Figure 3 As shown below:

[0073] Step 301, obtaining search distribution;

[0074] Step 302, using the natural evolution strategy to update the parameters of the search distribution, and obtain the gradient of the expected value of the loss function. It should be noted that the natural evolution strategy is a type of evolution strategy that iteratively updates the search distribution using the estimated gradient strategy on the distribution parameters. The population evolution steps are:

[0075] 1. Generate a batch of search points using a parameterized search distribution and calculate the fitness function value for each individual. The parameters of the distribution allow the algorithm to adaptively capture the local structure of the fitness function.

[0076] 2. Estimate a parameter of the search gradient and then perform a gradient ascent step along the natural gradient.

[0077] 3. The whole process is iterated until the stopping condition is met.

[0078] In the embodiment of the present invention, the noise around the traffic sample is sampled by searching the distribution s(θ|t), and the expected value of the loss function is expressed as follows:

[0079] E π(θ|t) [L(θ)]=∫L(θ)·s(θ|t)dθ

[0080] Furthermore, according to the log-likelihood equation, the gradient of the expected value of the loss function is calculated.

[0081] It should be noted that the embodiment of the present invention maximizes the expected value of the loss function instead of directly maximizing the loss function.

[0082] The above scheme uses a natural evolution strategy to update the parameters of the search distribution, obtains the gradient of the expected value of the loss function, and improves the accuracy of the gradient calculation.

[0083] Step 205: determine the disturbance value according to the gradient of the expected value of the loss function.

[0084] Step 206, determining the adversarial sample according to the perturbation value.

[0085] Step 207: input the adversarial sample into the intrusion detection system to obtain a second output label.

[0086] Step 208: determine the adversarial training result according to the second output label.

[0087] The above scheme solves the problem that the intrusion detection system based on ensemble learning cannot obtain gradient values ​​and consumes a large amount of satellite resources in the new space-based network in the process of generating proxy models by calculating the gradient of the intrusion detection system in the new space-based network. It realizes efficient adversarial training and achieves the ability to evade detection of the intrusion detection system with good results on the basis of low computing overhead.

[0088] In a possible implementation, the search distribution is a Gaussian distribution.

[0089] In an embodiment of the present invention, considering the limited computing power and resources of satellite nodes in the new space-based network, according to the central limit theorem, a large number of random variables in nature approximately obey the Gaussian distribution, so the search distribution of random Gaussian noise ξ~N(0,I) around the traffic sample is selected.

[0090] Furthermore, the specific calculation formula for the gradient of the expected value of the loss function is as follows:

[0091]

[0092] In the embodiment of the present invention, according to the natural evolution strategy, n points are sampled to generate a ξ i The gradient of the expected value of the loss function can be approximated as follows:

[0093]

[0094] Where λ represents the sampling interval; ξ i represents noise that follows a Gaussian distribution.

[0095] The above scheme adopts Gaussian distribution to avoid consuming a large amount of computing power on the satellite while ensuring real-time performance.

[0096] It should be noted that the search distribution may also be a chi-square distribution, a Laplace distribution, etc., which is not specifically limited in the embodiment of the present invention.

[0097] In a possible implementation, an iterative gradient ascent method is used to determine the disturbance value according to the gradient of the expected value of the loss function.

[0098] After obtaining the gradient of the expected value of the loss function of the intrusion detection system under the input traffic sample, the embodiment of the present invention uses the iterative gradient ascent method for optimization to obtain the disturbance value that maximizes the expected value of the loss function.

[0099] In the embodiment of the present invention, the disturbance η superimposed on the malicious traffic sample t is calculated, and l represents the output label after the input sample is disturbed. The loss function of the classification model needs to be maximized, which is expressed by the following formula:

[0100] max{L(f θ (t+η),l)}

[0101] Specifically, perform the following steps:

[0102] The loss function L(f θ (t+η),l) is divided into i segments, and the loss function of each segment can be approximately considered to be linear. Then in the kth segment, when the direction of the perturbation η is along the gradient of the loss function g of this segment k When the direction of improvement is such that the loss function is maximized, the perturbation η k It can be expressed as:

[0103] η k =τ·sgn(g k )

[0104] Among them, g k Represents the calculated gradient value of the loss function; sgn is the sign function, that is, the current gradient value g k When sgn(g k ) is normalized to +1, the current gradient value g k When sgn(g k ) is normalized to -1; τ represents the size of the disturbance allowed to be introduced.

[0105] Furthermore, in the kth segment of adversarial traffic sample t k ' can be expressed as:

[0106] t k ′=t k +η k =t k +τ·sgn(g k )

[0107] Furthermore, starting from the first segment to the kth segment, the above steps are repeated continuously, that is, the adversarial traffic sample of each segment is calculated through the gradient value of each segment. Then each adversarial traffic sample of each segment is used as the input of the classifier. When the classifier misclassifies the adversarial traffic sample as benign traffic, the iteration is stopped, and the adversarial traffic sample obtained through the segment is considered to be the adversarial traffic sample of the current network.

[0108] In the embodiment of the present invention, the entire process of the iterative gradient ascent method can be expressed as:

[0109] t k+1 =Π(t k =τ·sgn(g k ))

[0110] The above scheme uses the iterative gradient ascent method to reduce the calculation while having a better attack effect, balancing the relationship between the tight satellite computing resources and the effectiveness of adversarial samples.

[0111] It should be noted that a gradient ascent method may also be used, and the embodiment of the present invention does not specifically limit this.

[0112] The above scheme uses an iterative gradient ascent method to determine the perturbation value according to the gradient of the expected value of the loss function, thereby improving the accuracy of the gradient and thus improving the effect of the perturbation value.

[0113] Furthermore, in step 206, the embodiment of the present invention obtains a malicious traffic sample;

[0114] The perturbation value is superimposed on the malicious traffic sample to obtain the adversarial sample.

[0115] The above scheme uses the calculated disturbance value together with the malicious traffic sample as input, simplifies the process of malicious traffic evading intrusion detection system detection by automatically generating adversarial samples, and reduces repetitive work.

[0116] Further, determining whether the second output label indicates that the adversarial sample is benign traffic;

[0117] If yes, the adversarial training result is a successful attack, otherwise the adversarial training result is a failed attack.

[0118] In the embodiment of the present invention, the adversarial sample is used as the input of the intrusion detection system, and the effect of the adversarial training is judged according to the output label of the intrusion detection system.

[0119] Specifically, when the intrusion detection system misclassifies the malicious traffic samples with the disturbance value added as benign traffic, the attack is successful; when the intrusion detection system still classifies the malicious traffic samples with the disturbance value added as malicious traffic, the attack fails.

[0120] Furthermore, according to the new space-based network traffic data set, the automatically generated adversarial samples provided by the embodiments of the present invention are compared with the adversarial samples generated by the existing methods which are basically unable to circumvent the intrusion detection system based on the integrated classification model. The embodiments of the present invention can achieve a detection evasion rate of more than 93%, which greatly improves the ability of the new space-based network to evade detection by the intrusion detection system based on integrated learning.

[0121] The above scheme realizes adversarial training of the integrated classification model by calculating the gradient of the intrusion detection system, effectively reduces the amount of calculation to prevent the exhaustion of onboard resources, and effectively improves the success rate of the attack.

[0122] Based on the same inventive concept, Figure 4 An adversarial training device for an intrusion detection system in a novel space-based network provided by an embodiment of the present invention is exemplarily shown. The device may be a process of an adversarial training method for an intrusion detection system in a novel space-based network.

[0123] The device comprises:

[0124] An acquisition module 401 is used to acquire a flow sample;

[0125] Processing module 402 is used to input the traffic sample into the intrusion detection system to obtain a first output label; determine the loss function based on the first output label; use a natural evolution strategy to determine the gradient of the expected value of the loss function; determine the perturbation value based on the gradient of the expected value of the loss function; determine the adversarial sample based on the perturbation value; input the adversarial sample into the intrusion detection system to obtain a second output label; and determine the adversarial training result based on the second output label.

[0126] Furthermore, the processing module 402 is specifically used for:

[0127] Get search distribution;

[0128] A natural evolution strategy is used to update the parameters of the search distribution to obtain the gradient of the expected value of the loss function.

[0129] Furthermore, the processing module 402 is specifically used for:

[0130] The search distribution is a Gaussian distribution.

[0131] Furthermore, the processing module 402 is specifically used for:

[0132] The perturbation value is determined according to the gradient of the expected value of the loss function using an iterative gradient ascent method.

[0133] Furthermore, the processing module 402 is specifically used for:

[0134] Obtain malicious traffic samples;

[0135] The disturbance value is superimposed on the malicious traffic sample to obtain an adversarial sample.

[0136] Furthermore, the processing module 402 is specifically used for:

[0137] Determining whether the second output label indicates that the adversarial sample is benign traffic;

[0138] If yes, the adversarial training result is a successful attack, otherwise the adversarial training result is a failed attack.

[0139] Based on the same inventive concept, another embodiment of the present invention provides an electronic device, see Figure 5 , the electronic device specifically includes the following contents: a processor 501, a memory 502, a communication interface 503 and a communication bus 504;

[0140] The processor 501, the memory 502, and the communication interface 503 communicate with each other through the communication bus 504; the communication interface 503 is used to realize information transmission between various devices;

[0141] The processor 501 is used to call the computer program in the memory 502. When the processor executes the computer program, all steps of the above-mentioned adversarial training method for the intrusion detection system in the new space-based network are implemented. For example, when the processor executes the computer program, the following steps are implemented: obtaining a traffic sample; inputting the traffic sample into the intrusion detection system to obtain a first output label; determining a loss function according to the first output label; determining the gradient of the expected value of the loss function using a natural evolution strategy; determining a perturbation value according to the gradient of the expected value of the loss function; determining an adversarial sample according to the perturbation value; inputting the adversarial sample into the intrusion detection system to obtain a second output label; and determining an adversarial training result according to the second output label.

[0142] Based on the same inventive concept, another embodiment of the present invention provides a non-transitory computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, all the steps of the above-mentioned adversarial training method for the intrusion detection system in the new space-based network are implemented. For example, when the processor executes the computer program, the following steps are implemented: obtaining a traffic sample; inputting the traffic sample into the intrusion detection system to obtain a first output label; determining a loss function based on the first output label; determining the gradient of the expected value of the loss function using a natural evolution strategy; determining a perturbation value based on the gradient of the expected value of the loss function; determining an adversarial sample based on the perturbation value; inputting the adversarial sample into the intrusion detection system to obtain a second output label; and determining the adversarial training result based on the second output label.

[0143] In addition, the logic instructions in the above-mentioned memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on such an understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a device for resisting client DNS cache poisoning attacks, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0144] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the embodiments of the present invention. Those of ordinary skill in the art may understand and implement them without creative effort.

[0145] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a device for resisting client DNS cache poisoning attacks, or a network device, etc.) to execute the method for resisting client DNS cache poisoning attacks described in each embodiment or some parts of the embodiment.

[0146] In addition, in the present invention, terms such as "first" and "second" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0147] In addition, in the present invention, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0148] In addition, in the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "example", "specific example", or "some examples" etc. means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representations of the above terms do not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner. In addition, those skilled in the art may combine and combine the different embodiments or examples described in this specification and the features of the different embodiments or examples, without contradiction.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An adversarial training method for an intrusion detection system in a new space-based network, characterized in that: include: Get traffic samples; Inputting the traffic sample into an intrusion detection system to obtain a first output label; Determining a loss function according to the first output label; Determining the gradient of the expected value of the loss function using a natural evolution strategy; Determining a disturbance value according to the gradient of the expected value of the loss function; Determining an adversarial sample according to the disturbance value; Inputting the adversarial sample into the intrusion detection system to obtain a second output label; Determine an adversarial training result according to the second output label; Wherein, the adopting of the natural evolution strategy to determine the gradient of the expected value of the loss function includes: Get search distribution; A natural evolution strategy is used to update the parameters of the search distribution to obtain the gradient of the expected value of the loss function; the search distribution is a Gaussian distribution; The natural evolution strategy is a type of evolution strategy that uses the estimated gradient strategy on the distribution parameters to iteratively update the search distribution. The population evolution steps are: A batch of search points are generated using a parameterized search distribution, and the fitness function value is calculated for each individual. The parameters of the distribution allow the algorithm to adaptively capture the local structure of the fitness function. Estimate a parameter of the search gradient and then perform a gradient ascent step along the natural gradient; The whole process is iterated until the stopping condition is met.

2. The adversarial training method for an intrusion detection system in a novel space-based network according to claim 1 is characterized in that: The determining of the disturbance value according to the gradient of the expected value of the loss function comprises: The perturbation value is determined according to the gradient of the expected value of the loss function using an iterative gradient ascent method.

3. The adversarial training method for an intrusion detection system in a novel space-based network according to claim 1, characterized in that: The determining the adversarial sample according to the disturbance value includes: Obtain malicious traffic samples; The disturbance value is superimposed on the malicious traffic sample to obtain an adversarial sample.

4. The adversarial training method for an intrusion detection system in a novel space-based network according to claim 1, characterized in that: The determining the adversarial training result according to the second output label includes: Determining whether the second output label indicates that the adversarial sample is benign traffic; If yes, the adversarial training result is a successful attack, otherwise the adversarial training result is a failed attack.

5. An adversarial training device for an intrusion detection system in a new space-based network, characterized in that: include: An acquisition module, used to obtain traffic samples; A processing module, used for inputting the traffic sample into an intrusion detection system to obtain a first output label; Determine a loss function according to the first output label; determine a gradient of an expected value of the loss function using a natural evolution strategy; determine a perturbation value according to the gradient of the expected value of the loss function; Determining an adversarial sample according to the disturbance value; Inputting the adversarial sample into the intrusion detection system to obtain a second output label; Determine an adversarial training result according to the second output label; Wherein, the adopting of the natural evolution strategy to determine the gradient of the expected value of the loss function includes: Get search distribution; A natural evolution strategy is used to update the parameters of the search distribution to obtain the gradient of the expected value of the loss function; the search distribution is a Gaussian distribution; The natural evolution strategy is a type of evolution strategy that uses the estimated gradient strategy on the distribution parameters to iteratively update the search distribution. The population evolution steps are: A batch of search points are generated using a parameterized search distribution, and the fitness function value is calculated for each individual. The parameters of the distribution allow the algorithm to adaptively capture the local structure of the fitness function. Estimate a parameter of the search gradient and then perform a gradient ascent step along the natural gradient; The whole process is iterated until the stopping condition is met.

6. The adversarial training device for an intrusion detection system in a novel space-based network according to claim 5, characterized in that: The processing module is specifically used for: Get search distribution; A natural evolution strategy is used to update the parameters of the search distribution to obtain the gradient of the expected value of the loss function.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the steps of the method according to any one of claims 1 to 4 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 4 are implemented.

Images