A network intrusion detection method based on traffic classification

Abstract

The present invention discloses a network intrusion detection method based on traffic classification, comprising the following steps: 1. Processing network traffic data to obtain a total sample set; 2. Establishing a network intrusion detection model DCADenseIncept based on a deep self-attention mechanism and a dense Inception structure to extract primary features from network traffic data and generate a feature representation X. L ; 3. After DCADenseIncept, a network intrusion detection model CeIT based on the convolution-enhanced Transformer structure is attached. It combines the advantages of convolution feature extraction, spatial local enhancement and Transformer to establish long-range dependencies, and provides a new model for X L Extract high-level features and generate feature representation X H ; 4. Represent the feature X H The classifier is used to perform classification detection and calculate the overall loss, and the Adam optimization algorithm is used to automatically update the model parameters to obtain the final network intrusion detection model. The model in the present invention can enhance the processing method and utilization efficiency of features, has excellent expression ability and network intrusion detection effect, and can assist the system in resisting network attacks.

Description

Technical Field

[0001] The present invention relates to the field of network information security and deep learning, and in particular to a network traffic-oriented intrusion detection method based on DCADenseIncept-CeIT. Background Art

[0002] Network intrusion detection is a reasonable supplement to firewalls. By processing network traffic data, it detects whether there is intrusion in the network, forming a proactive network security protection technology, assisting the system to fight network attacks, and responding to malicious network behaviors before the system is compromised. It expands the security management capabilities of system administrators and improves the integrity of network security infrastructure. With the development of artificial intelligence and deep learning, network intrusion detection has a more effective new approach. The outstanding performance of deep learning in classification tasks has laid the foundation for its application in network intrusion detection and has achieved excellent performance. Network intrusion activities are represented as corresponding patterns, and whether the activities in the network match these patterns, that is, feature detection, can be performed on them. Malicious network traffic can be detected and its specific attack category can be identified. Network traffic data has fewer features, and the feature processing method and utilization efficiency are of great significance to network intrusion detection. Summary of the invention

[0003] In order to process network traffic data more fully and improve the utilization efficiency of its features, enhance the effect and generalizability of network intrusion detection and accelerate the convergence speed, the present invention provides an intrusion detection method for network traffic based on DCADenseIncept-CeIT. The present invention is based on deep learning technology and can detect malicious traffic of types such as Dos / DDos, Probe, U2R, R2L, PortScan, Brute Force, Web Attack, Botnet ARES, Infiltration, etc. in the network and identify its specific attack category to assist the system in fighting against network attacks and expand the security management capabilities of system administrators.

[0004] The technical solution adopted by the present invention is: a network traffic-oriented intrusion detection method based on DCADenseIncept-CeIT, the method comprising the following steps:

[0005] Step 1: Process the network traffic data to obtain the overall sample set;

[0006] Step 2: Establish a network intrusion detection model DCADenseIncept based on deep self-attention mechanism and dense Inception structure to extract primary features from network traffic data and generate its feature representation X L ;

[0007] Step 3: After DCADenseIncept, a network intrusion detection model CeIT based on the convolution-enhanced Transformer structure is attached. It combines the advantages of convolution in feature extraction, spatial local enhancement and Transformer in establishing long-range dependencies to provide X L Extract high-level features and generate the final feature representation X H ;

[0008] Step 4: Final feature representation of network traffic data X H Perform classification detection through the classifier, calculate the overall loss of the task, and use the Adam optimization algorithm to automatically update the model parameters to obtain the final network intrusion detection model;

[0009] The data processing described in step 1 includes the following sub-steps:

[0010] Step 1.1: Eliminate low-value information in network traffic data that is irrelevant to network intrusion detection and has the same value;

[0011] Step 1.2: Determine the data, category labels, and model output for feature extraction from the input model. Feature data includes content related to Internet Protocol addresses, ports, protocols, timestamps, packets, flows, headers, and transmission control protocol tags. Category labels include Normal, Dos / Ddos, Probe, U2R, R2L, PortScan, Brute Force, etc.

[0012] Step 1.3: For feature data, non-numeric data are mapped into binary vectors using one-hot encoding, and discrete / non-discrete data in numeric data are standardized as follows: norm is the standardized result of the source data x, x max 、x min , μ and σ are the maximum, minimum, mean and standard deviation of x, and the category labels are mapped into continuous natural numbers using sequential encoding;

[0013] Discrete:

[0014] Non-discrete:

[0015] Step 1.4: Reshape the processed feature data into the form of an n×n matrix;

[0016] Step 1.5: Use the bicubic interpolation algorithm to accurately enlarge the above matrix to N×N;

[0017] Step 1.6: Use oversampling and SMOTE algorithm to supplement the categories with less data to balance the network traffic data of different categories;

[0018] Step 1.7: Use stratified sampling to randomly divide the total sample set into training set and test set in a ratio of 4:1;

[0019] The network intrusion detection model DCADenseIncept based on deep self-attention mechanism and dense Inception structure described in step 2 extracts primary features from network traffic data and generates its feature representation X L , including the following sub-steps:

[0020] Step 2.1: Construct DenseIncept. The core of DenseIncept is the densely connected Inception structure. Primary features are extracted through the Inception structure. Convolutional feature extraction is performed simultaneously on 6 scales to process richer spatial features at different scales. More nonlinear features can also be combined to increase feature diversity. Moreover, the features extracted at multiple scales no longer obey uniform distribution. Related features are clustered together, and irrelevant features are weakened, thereby reducing feature redundancy. The Inception structure can effectively improve the expression ability of the model and reduce computational complexity. The dense connection mechanism enables each layer to use the features generated by all previous layers, realizing feature reuse and improving feature utilization efficiency.

[0021] Step 2.2: An Inception structure is used as a layer, and batch normalization BN and linear rectification function ReLU are added before it. BN can effectively use ReLU for nonlinear process to transfer information more effectively. The feature X output of the previous layer t-1 After BN and ReLU processing, it is used as the input X' of the Inception structure and outputs X i , X ij is the output of the Inception structure at the jth scale, Conv is the convolution operation, SoftPool is the soft pooling, and the exponential weight w of the natural base e is used. i To reduce the information loss of the previous pooling method, is the pooling result of the receptive field R, a i is the i-th element in R, AFF is attention feature fusion, which can better fuse features based on the attention weight of the features, and is better than other feature connection methods. The formula is as follows:

[0022] X' = ​​ReLU(BN(X t-1 )) (3)

[0023] X i1 =1×1Conv(X') (4)

[0024] X i2=1×1Conv(SoftPool(X')) (5)

[0025] X i3 =1×3Conv(1×1Conv(X')) (6)

[0026] X i4 =3×1Conv(1×1Conv(X')) (7)

[0027] X i5 =1×3Conv(3×3Conv((1×1Conv(X')))) (8)

[0028] X i6 =3×1Conv(3×3Conv((1×1Conv(X')))) (9)

[0029] X i =AFF(X i1 ,X i2 ,X i3 ,X i4 ,X i5 ,X i6 ) (10)

[0030] SoftPool:

[0031] Step 2.3: X i With the features X0, X1, ..., X generated by all previous layers t-1 The result Z is fused by attention feature fusion t As the feature output of this layer, X and Y are feature maps, PointConv is point-by-point convolution, GlobalAvePool is global average pooling, and X g , X l is the global and local attention result of the feature, W1 and W2 are the attention weights of the feature, σ is the Sigmoid function, and Z is the result of feature fusion. The formula is as follows:

[0032]

[0033]

[0034] W2=1-W1 (14)

[0035]

[0036] Step 2.4: Add a self-attention mechanism based on DenseIncept. In addition to focusing on task-related information, the self-attention mechanism is better at capturing internal correlations, thereby reducing external information dependence. It generates feature Z for each DenseIncept layer. t Assign weights, and finally combine the attention results with Z t As the final feature representation of this layer X t , Z t The matrix I (non-identity matrix) and the parameter matrix W q , W k , W v Multiply them to get the matrices Q, K, and V, which are used as the query, key, and value of the self-attention mechanism. Use the normalized exponential function SoftMax to normalize K T Q obtains the attention score representing the degree of association on [0,1], and performs weighted summation of V according to the weight to obtain the sum feature matrix S, as shown in the following formula:

[0037] Q=W q I,K=W k I,V=W v I (16)

[0038] S=VSoftMax(K T Q) (17)

[0039] Step 2.5: Deeply connect the self-attention mechanism, connect adjacent self-attention modules to each other, ensure that it can learn from the products of the current layer of the backbone network and the previous adjacent self-attention module, to improve the learning ability of the self-attention mechanism. The current attention result O and the product T of the previous attention module are weighted. β performs weighted connection, The value of β satisfies And the sum is 1, and finally the total attention result is combined with Z t As the final feature representation of this layer X t ;

[0040]

[0041] Step 2.6: After the entire DCADenseIncept process, the primary feature representation X of the network traffic data is generated L ;

[0042] In step 3, after DCADenseIncept, a network intrusion detection model CeIT based on convolution-enhanced Transformer structure is attached. It combines the advantages of convolution in feature extraction, spatial local enhancement and Transformer in establishing long-range dependencies.L Extract high-level features and generate the final feature representation X H , including the following sub-steps:

[0043] Step 3.1: From X L Extract the sub-block patch from X and transform it into X through convolution and soft pooling L Compress it to S×S, and then divide it into several sub-blocks of size s×s, so that X L It is extracted into a series of sub-blocks in the spatial dimension;

[0044] Step 3.2: CeIT consists of several stacked encoders, including a self-attention module Sa, a locally enhanced feedforward network LeFf, and a layer normalization LN. x and y are the input and output of the encoder, and x' is the intermediate result. The structure of the encoder is as follows:

[0045] x'=LN(x+Sa(x)),y=LN(x'+LeFf(x')) (19)

[0046] Step 3.3: The encoder's self-attention module remains unchanged, retaining its ability to capture global similarities between token tags. The locally enhanced feedforward network is responsible for processing the block tag patch token generated by the self-attention module: First, the block tag is projected to a higher dimension using a convolution-based linear projection to expand the vector. Then, the block tag is restored to an "image" in the spatial dimension based on its relative position in the initial image. Then, a deep convolution is performed on the block tag restored to the "image" to strengthen the association with other neighboring tags. Finally, the sequence generated after flattening the block tag is projected back to the initial dimension again through linear projection. At the same time, a BN-GeLU structure is added after each linear projection or deep convolution. GeLU is a Gaussian error linear unit.

[0047] Step 3.4: CeIT generates a high-level feature representation X of the network traffic data H And use it as the final feature representation;

[0048] Step 4 describes the final feature representation of network traffic data X H The classifier is used to perform classification detection, calculate the overall loss of the task, and use the Adam optimization algorithm to automatically update the model parameters to obtain the final network intrusion detection model, which includes the following sub-steps:

[0049] Step 4.1: After data processing, the network traffic data is input into the network intrusion detection model for training. During training, the loss function Recall loss for the unbalanced image classification task is used to calculate the corresponding loss to balance the precision and accuracy of the results. C is the number of categories, c is a certain category, and FNc is the number of false negative samples in category c, P c is the geometric mean confidence of category c, TP c is the number of true positive samples in category c, N c is the number of samples in category c, log is the logarithmic function, and the formula is as follows:

[0050]

[0051] Step 4.2: Use the Adam optimization algorithm to automatically update the model parameters. After repeated iterative updates, the loss value continues to decrease until the target accuracy is reached and the model training is stopped. The final network intrusion detection model is obtained and the test set is used to verify the effect of network intrusion detection.

[0052] The present invention has the following advantages:

[0053] (1) The present invention uses a network intrusion detection model DCADenseIncept based on a deep self-attention mechanism and a dense Inception structure to extract primary features for network traffic data. The Inception structure simultaneously performs convolutional feature extraction at multiple scales, which increases feature diversity, aggregates relevant features, weakens irrelevant features, and reduces feature redundancy, which can effectively improve the expression ability of the model and reduce computational complexity. The dense connection mechanism enables each layer to use the features generated by all previous layers, realizes feature reuse, and improves feature utilization efficiency. In addition to allocating attention weights to features to focus on task-related information and ignore irrelevant information, the self-attention mechanism also weakens external information dependence, making the model better at capturing internal correlations. The interconnected adjacent self-attention modules further improve the learning and attention ability of the self-attention mechanism, making the results more accurate.

[0054] (2) The present invention utilizes the network intrusion detection model CeIT based on the convolution enhanced Transformer structure to extract advanced features from primary features, combining the advantages of convolutional neural networks in feature extraction, spatial local enhancement and Transformer in establishing long-range dependencies and making up for the shortcomings of both. It not only has a more powerful feature extraction capability, but also can establish the association between non-adjacent elements in the feature sequence, taking into account both space and sequence. In addition, CeIT also reduces the number of training iterations of the model and accelerates the convergence speed of the model.

[0055] (3) The present invention uses attention feature fusion AFF to fuse features, making the fusion and utilization of features more sufficient. It uses soft pooling SoftPool based on the exponential weight of the natural base to perform pooling downsampling, which reduces the information loss in the pooling process. Compared with other loss functions, the Recall Loss loss function has better loss assessment and model evaluation capabilities under unbalanced classification tasks; BRIEF DESCRIPTION OF THE DRAWINGS

[0056] Figure 1 A schematic diagram of a flow chart of a network intrusion detection method based on DCADenseIncept-CeIT provided by the present invention;

[0057] Figure 2 A schematic diagram of the Inception structure of a network intrusion detection method based on DCADenseIncept-CeIT provided by the present invention;

[0058] Figure 3 A DCADenseIncept schematic diagram of a network intrusion detection method based on DCADenseIncept-CeIT provided by the present invention;

[0059] Figure 4 A CeIT schematic diagram of a network intrusion detection method based on DCADenseIncept-CeIT provided by the present invention; DETAILED DESCRIPTION

[0060] The following will be combined Figure 1-4 The present invention is described in detail, and the technical solutions in the embodiments of the present invention are clearly and completely described. Obviously, the embodiments are only some embodiments of the present invention rather than all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in the field without creative work are within the scope of protection of the present invention.

[0061] refer to Figure 1 The present invention provides a network traffic-oriented intrusion detection method based on DCADenseIncept-CeIT, the method comprising the following steps:

[0062] Step 1: Process the network traffic data to obtain the overall sample set;

[0063] Step 2: Establish a network intrusion detection model DCADenseIncept based on deep self-attention mechanism and dense Inception structure to extract primary features from network traffic data and generate its feature representation X L ;

[0064] Step 3: After DCADenseIncept, a network intrusion detection model CeIT based on the convolution-enhanced Transformer structure is attached. It combines the advantages of convolution in feature extraction, spatial local enhancement and Transformer in establishing long-range dependencies to provide X L Extract high-level features and generate the final feature representation X H ;

[0065] Step 4: Final feature representation of network traffic data X H Perform classification detection through the classifier, calculate the overall loss of the task, and use the Adam optimization algorithm to automatically update the model parameters to obtain the final network intrusion detection model;

[0066] The data processing described in step 1 includes the following sub-steps:

[0067] Step 1.1: Eliminate low-value information in network traffic data that is irrelevant to network intrusion detection and has the same value;

[0068] Step 1.2: Determine the data, category labels, and model output for feature extraction from the input model. Feature data includes content related to Internet Protocol addresses, ports, protocols, timestamps, packets, flows, headers, and transmission control protocol tags. Category labels include Normal, Dos / Ddos, Probe, U2R, R2L, PortScan, Brute Force, etc.

[0069] Step 1.3: For feature data, non-numeric data are mapped into binary vectors using one-hot encoding, and discrete / non-discrete data in numeric data are standardized as follows: norm is the standardized result of the source data x, x max 、x min , μ and σ are the maximum, minimum, mean and standard deviation of x, and the category labels are mapped into continuous natural numbers using sequential encoding;

[0070] Discrete:

[0071] Non-discrete:

[0072] Step 1.4: Reshape the processed feature data into the form of an n×n matrix;

[0073] Step 1.5: Use the bicubic interpolation algorithm to accurately enlarge the above matrix to N×N;

[0074] Step 1.6: Use oversampling and SMOTE algorithm to supplement the categories with less data to balance the network traffic data of different categories;

[0075] Step 1.7: Use stratified sampling to randomly divide the total sample set into training set and test set in a ratio of 4:1;

[0076] refer to Figure 2 , 3 In step 2, the network intrusion detection model DCADenseIncept based on deep self-attention mechanism and dense Inception structure is established to extract primary features from network traffic data and generate its feature representation X L , including the following sub-steps:

[0077] Step 2.1: Construct DenseIncept. The core of DenseIncept is the densely connected Inception structure. Primary features are extracted through the Inception structure. Convolutional feature extraction is performed simultaneously on 6 scales to process richer spatial features at different scales. More nonlinear features can also be combined to increase feature diversity. Moreover, the features extracted at multiple scales no longer obey uniform distribution. Related features are clustered together, and irrelevant features are weakened, thereby reducing feature redundancy. The Inception structure can effectively improve the expression ability of the model and reduce computational complexity. The dense connection mechanism enables each layer to use the features generated by all previous layers, realizing feature reuse and improving feature utilization efficiency.

[0078] Step 2.2: An Inception structure is used as a layer, and batch normalization BN and linear rectification function ReLU are added before it. BN can effectively use ReLU for nonlinear process to transfer information more effectively. The feature X output of the previous layer t-1 After BN and ReLU processing, it is used as the input X' of the Inception structure and outputs X i , X ij is the output of the Inception structure at the jth scale, Conv is the convolution operation, SoftPool is the soft pooling, and the exponential weight w of the natural base e is used. i To reduce the information loss of the previous pooling method, is the pooling result of the receptive field R, a i is the i-th element in R, AFF is attention feature fusion, which can better fuse features based on the attention weight of the features, and is better than other feature connection methods. The formula is as follows:

[0079] X' = ​​ReLU(BN(X t-1 )) (3)

[0080] X i1 =1×1Conv(X') (4)

[0081] X i2 =1×1Conv(SoftPool(X')) (5)

[0082] X i3 =1×3Conv(1×1Conv(X')) (6)

[0083] X i4 =3×1Conv(1×1Conv(X')) (7)

[0084] X i5 =1×3Conv(3×3Conv((1×1Conv(X')))) (8)

[0085] X i6 =3×1Conv(3×3Conv((1×1Conv(X')))) (9)

[0086] X i =AFF(X i1 ,X i2 ,X i3 ,X i4 ,X i5 ,X i6 ) (10)

[0087] SoftPool:

[0088] Step 2.3: X i With the features X0, X1, ..., X generated by all previous layers t-1 The result Z is fused by attention feature fusion t As the feature output of this layer, X and Y are feature maps, PointConv is point-by-point convolution, GlobalAvePool is global average pooling, and X g , X l is the global and local attention result of the feature, W1 and W2 are the attention weights of the feature, σ is the Sigmoid function, and Z is the result of feature fusion. The formula is as follows:

[0089]

[0090]

[0091] W2=1-W1 (14)

[0092]

[0093] Step 2.4: Add a self-attention mechanism based on DenseIncept. In addition to focusing on task-related information, the self-attention mechanism is better at capturing internal correlations, thereby reducing external information dependence. It generates feature Z for each DenseIncept layer. t Assign weights, and finally combine the attention results with Z t As the final feature representation of this layer X t , Z t The matrix I (non-identity matrix) and the parameter matrix W q , W k , W v Multiply them to get the matrices Q, K, and V, which are used as the query, key, and value of the self-attention mechanism. Use the normalized exponential function SoftMax to normalize K T Q obtains the attention score representing the degree of association on [0,1], and performs weighted summation of V according to the weight to obtain the sum feature matrix S, as shown in the following formula:

[0094] Q=W q I,K=W k I,V=W v I (16)

[0095] S=VSoftMax(K T Q) (17)

[0096] Step 2.5: Deeply connect the self-attention mechanism, connect adjacent self-attention modules to each other, ensure that it can learn from the products of the current layer of the backbone network and the previous adjacent self-attention module, to improve the learning ability of the self-attention mechanism. The current attention result O and the product T of the previous attention module are weighted. β performs weighted connection, The value of β satisfies And the sum is 1, and finally the total attention result is combined with Z t As the final feature representation of this layer X t ;

[0097]

[0098] Step 2.6: After the entire DCADenseIncept process, the primary feature representation X of the network traffic data is generated L ;

[0099] refer to Figure 4In step 3, after DCADenseIncept, a network intrusion detection model CeIT based on convolution-enhanced Transformer structure is attached. Combining the advantages of convolution in feature extraction, spatial local enhancement and Transformer in establishing long-range dependencies, it is X L Extract high-level features and generate the final feature representation X H , including the following sub-steps:

[0100] Step 3.1: From X L Extract the sub-block patch from X and transform it into X through convolution and soft pooling L Compress it to S×S, and then divide it into several sub-blocks of size s×s, so that X L It is extracted into a series of sub-blocks in the spatial dimension;

[0101] Step 3.2: CeIT consists of several stacked encoders, including a self-attention module Sa, a locally enhanced feedforward network LeFf, and a layer normalization LN. x and y are the input and output of the encoder, and x' is the intermediate result. The structure of the encoder is as follows:

[0102] x'=LN(x+Sa(x)),y=LN(x'+LeFf(x')) (19)

[0103] Step 3.3: The encoder's self-attention module remains unchanged, retaining its ability to capture global similarities between token tags. The locally enhanced feed-forward network is responsible for processing the block tag patch token generated by the self-attention module: first, the block tag is projected to a higher dimension using a convolution-based linear projection to expand the vector. After that, the block tag is restored to an "image" in the spatial dimension based on its relative position in the initial image. Then, a deep convolution is performed on the block tag restored to the "image" ( Figure 4 The black area in the figure) is used to strengthen the correlation with other neighboring tags. Finally, the sequence generated after flattening the block tags is projected back to the initial dimension through linear projection. At the same time, a BN-GeLU structure is added after each linear projection or depth convolution, where GeLU is a Gaussian error linear unit.

[0104] Step 3.4: CeIT generates a high-level feature representation X of the network traffic data H And use it as the final feature representation;

[0105] Step 4 describes the final feature representation of network traffic data X H The classifier is used to perform classification detection, calculate the overall loss of the task, and use the Adam optimization algorithm to automatically update the model parameters to obtain the final network intrusion detection model, which includes the following sub-steps:

[0106] Step 4.1: After data processing, the network traffic data is input into the network intrusion detection model for training. During training, the loss function Recall loss for the unbalanced image classification task is used to calculate the corresponding loss to balance the precision and accuracy of the results. C is the number of categories, c is a certain category, and FN c is the number of false negative samples in category c, P c is the geometric mean confidence of category c, TP c is the number of true positive samples in category c, N c is the number of samples in category c, log is the logarithmic function, and the formula is as follows:

[0107]

[0108] Step 4.2: Use the Adam optimization algorithm to automatically update the model parameters. After repeated iterative updates, the loss value continues to decrease until the target accuracy is reached and the model training is stopped. The final network intrusion detection model is obtained and the test set is used to verify the effect of network intrusion detection.

[0109] The details described above are only one of the embodiments of the present invention and are not intended to limit the scope of implementation of the present invention. Therefore, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. These changes and modifications should also be regarded as the protection scope of the present invention. The patent protection scope of the present invention shall be based on the claims. All equivalent structural changes made using the description and drawings of the present invention should, by the same token, be included in the protection scope of the present invention.

Claims

1. A network intrusion detection method based on traffic classification, characterized in that: The following steps are involved: Step 1: Process the network traffic data to obtain the overall sample set; Step 2: Establish a network intrusion detection model DCADenseIncept based on deep self-attention mechanism and dense Inception structure to extract primary features from network traffic data and generate its feature representation X L ; Step 3: After DCADenseIncept, a network intrusion detection model CeIT based on the convolution-enhanced Transformer structure is attached. It combines the advantages of convolution in feature extraction, spatial local enhancement and Transformer in establishing long-range dependencies to provide X L Extract high-level features and generate the final feature representation X H ; Step 4: Final feature representation of network traffic data X H Perform classification detection through the classifier, calculate the overall loss of the task, and use the Adam optimization algorithm to automatically update the model parameters to obtain the final network intrusion detection model; The step 2 includes the following sub-steps: Step 2.1: Build DenseIncept. The core of DenseIncept is the densely connected Inception structure. Primary features are extracted through the Inception structure. Convolutional feature extraction is performed simultaneously on 6 scales to process richer spatial features at different scales. More nonlinear features can also be combined to increase feature diversity. Step 2.2: An Inception structure is used as a layer, and batch normalization BN and linear rectification function ReLU are added before it. BN can effectively use ReLU for nonlinear process to transfer information more effectively. The feature X output of the previous layer t-1 After BN and ReLU processing, it is used as the input X' of the Inception structure and outputs X i , X ij is the output of the Inception structure at the jth scale, Conv is the convolution operation, SoftPool is the soft pooling, and the exponential weight w of the natural base e is used. i To reduce the information loss of the previous pooling method, is the pooling result of the receptive field R, a i is the i-th element in R, AFF is attention feature fusion, which can better fuse features based on the attention weight of the features, and is better than other feature connection methods. The formula is as follows: X'=ReLU(BN(X t-1 )) (3) X i1 =1×1Conv(X') (4) X i2 =1×1Conv(SoftPool(X')) (5) X i3 =1×3Conv(1×1Conv(X')) (6) X i4 =3×1Conv(1×1Conv(X')) (7) X i5 =1×3Conv(3×3Conv((1×1Conv(X')))) (8) X i6 =3×1Conv(3×3Conv((1×1Conv(X')))) (9) X i =AFF(X i1 ,X i2 ,X i3 ,X i4 ,X i5 ,X i6 ) (10) SoftPool: Step 2.3: X i With the features X0, X1, ..., X generated by all previous layers t-1 The result Z is fused by attention feature fusion t As the feature output of this layer, X and Y are feature maps, PointConv is point-by-point convolution, GlobalAvePool is global average pooling, and X g , X l is the global and local attention result of the feature, W1 and W2 are the attention weights of the feature, σ is the Sigmoid function, and Z is the result of feature fusion. The formula is as follows: Step 2.4: Add a self-attention mechanism based on DenseIncept. In addition to focusing on task-related information, the self-attention mechanism is better at capturing internal correlations, thereby reducing external information dependence. It generates feature Z for each DenseIncept layer. t Assign weights, and finally combine the attention results with Z t As the final feature representation of this layer X t , Z t The matrix I and the parameter matrix W q , W k , W v Multiply them to get the matrices Q, K, and V, which are used as the query, key, and value of the self-attention mechanism. Use the normalized exponential function SoftMax to normalize K T Q obtains the attention score representing the degree of association on [0,1], and V is weighted and summed according to the weight to obtain the sum feature matrix S, where I is a non-unit matrix; the formula is as follows: Q=W q I,K=W k I,V=W v I (16) S=VSoftMax(K T Q) (17) Step 2.5: Deeply connect the self-attention mechanism, connect adjacent self-attention modules to each other, ensure that it can learn from the products of the current layer of the backbone network and the previous adjacent self-attention module, to improve the learning ability of the self-attention mechanism. The current attention result O and the product T of the previous attention module are weighted. β performs weighted connection, The value of β satisfies And the sum is 1, and finally the total attention result is combined with Z t As the final feature representation of this layer X t ; Step 2.6: After the entire DCADenseIncept process, the primary feature representation X of the network traffic data is generated L .

2. A network intrusion detection method based on traffic classification according to claim 1, characterized in that: The step 1 includes the following sub-steps: Step 1.1: Eliminate low-value information in network traffic data that is irrelevant to network intrusion detection and has the same value; Step 1.2: Determine the data, category labels, and model outputs for extracting features from the input model. Feature data includes content related to Internet Protocol addresses, ports, protocols, timestamps, packets, flows, headers, and transmission control protocol tags. Category labels include Normal, Dos / Ddos, Probe, U2R, R2L, PortScan, and Brute Force. Step 1.3: For feature data, non-numeric data are mapped into binary vectors using one-hot encoding, and discrete / non-discrete data in numeric data are standardized as follows: norm is the standardized result of the source data x, x max 、x min , μ and σ are the maximum, minimum, mean and standard deviation of x, and the category labels are mapped into continuous natural numbers using sequential encoding; Discrete: Non-discrete: Step 1.4: Reshape the processed feature data into the form of an n×n matrix; Step 1.5: Use the bicubic interpolation algorithm to accurately enlarge the above matrix to N×N; Step 1.6: Use oversampling and SMOTE algorithm to supplement the categories with less than 10,000 data volumes to balance the network traffic data of different categories; Step 1.7: Use stratified sampling to randomly divide the total sample set into training set and test set in a ratio of 4:

1.

3. A network intrusion detection method based on traffic classification according to claim 1, characterized in that: The step 3 includes the following sub-steps: Step 3.1: From X L Extract the sub-block patch from X and transform it into X through convolution and soft pooling L Compress it to S×S, and then divide it into several sub-blocks of size s×s, so that X L It is extracted into a series of sub-blocks in the spatial dimension; Step 3.2: CeIT consists of several stacked encoders, including a self-attention module Sa, a locally enhanced feedforward network LeFf, and a layer normalization LN. x and y are the input and output of the encoder, and x' is the intermediate result. The structure of the encoder is as follows: x'=LN(x+Sa(x)),y=LN(x'+LeFf(x')) (19) Step 3.3: The encoder's self-attention module remains unchanged, retaining its ability to capture global similarities between token tags. The locally enhanced feedforward network is responsible for processing the block tag patch token generated by the self-attention module: First, the block tag is projected to a higher dimension using a convolution-based linear projection to expand the vector. Then, the block tag is restored to an "image" in the spatial dimension based on its relative position in the initial image. Then, a deep convolution is performed on the block tag restored to the "image" to strengthen the association with other neighboring tags. Finally, the sequence generated after flattening the block tag is projected back to the initial dimension again through linear projection. At the same time, a BN-GeLU structure is added after each linear projection or deep convolution. GeLU is a Gaussian error linear unit. Step 3.4: CeIT generates a high-level feature representation X of the network traffic data H And use it as the final feature representation.

4. A network intrusion detection method based on traffic classification according to claim 1, characterized in that: The step 4 includes the following sub-steps: Step 4.1: After data processing, the network traffic data is input into the network intrusion detection model for training. During training, the loss function Recall loss for the unbalanced image classification task is used to calculate the corresponding loss to balance the precision and accuracy of the results. C is the number of categories, c is a certain category, and FN c is the number of false negative samples in category c, P c is the geometric mean confidence of category c, TP c is the number of true positive samples in category c, N c is the number of samples in category c, log is the logarithmic function, and the formula is as follows: Step 4.2: Use the Adam optimization algorithm to automatically update the model parameters. After repeated iterative updates, the loss value continues to decrease until it reaches the target accuracy. Then, the model training is stopped to obtain the final network intrusion detection model. The test set is used to verify the effect of network intrusion detection.

Images