A network intrusion detection method introducing sample geometry and multi-view information

Abstract

The present invention discloses a network intrusion detection system that introduces sample geometry and multi-view information, including a process of constructing a highly separable metric space on a training set and classifying the network intrusion data to be detected using a K-nearest neighbor classifier. First, the collected intrusion data is subjected to a large margin criterion framework at each viewpoint; second, the density between heterogeneous sample clusters in the training set at each viewpoint is minimized; then, an adjacency matrix with label information is introduced for each viewpoint; and then, an adaptive maximization viewpoint cross-correlation method is adopted. The above steps are substituted into a unified learning framework, the optimal solution is calculated and the final metric space is obtained; finally, the network intrusion data to be detected is sent into the metric space and classified using a K-nearest neighbor classifier. The present invention makes up for the defect that the existing system cannot mine sample and viewpoint data information, and can make full use of sample geometry information and viewpoint complementary information to guide multi-viewpoint network intrusion detection tasks.

Description

Technical Field

[0001] The invention relates to a network intrusion detection method that introduces sample geometry and multi-viewing angle information, and belongs to the technical field of data classification. Background Art

[0002] At present, the Internet has become one of the most important ways for people to communicate, obtain information, and entertain themselves, but many network security issues have also arisen. Among them, network attacks are attacks on systems and resources using loopholes and security flaws in network information systems. The phenomenon of network attacks will have very serious consequences for humans and society, and affect people's lives and personal privacy issues. There are many types of attacks on the Internet, and different types of attacks need to be blocked by different response mechanisms to protect users from being able to surf the Internet safely. The network intrusion detection system monitors the network in real time, identifies the attack type when it is attacked, and takes corresponding measures to protect users from network attacks. Among them, the ability of the detection system to identify the attack type is the key to determining the quality of the system, so a method with a high recognition rate is needed to support the detection system. However, network intrusion data has complex structures and characteristics, and learning from data from only one perspective cannot fully mine the feature information of the network intrusion data set. Therefore, the present invention takes into account that learning network intrusion data from different perspectives can study the object more comprehensively, and trains a superior model for multi-perspective data sets to greatly improve the accuracy of classification.

[0003] With the continuous development of data acquisition technology, a target can obtain various features through different feature extractors or sensors, and these feature sets constitute a multi-perspective dataset. Multi-perspective datasets have more comprehensive and rich feature information than the original single-source datasets, but at the same time they will also increase the complexity of model training. The rational use of multi-perspective datasets is one of the current hot research topics in the field of pattern recognition. Multi-perspective learning has two basic principles: consensus and complementarity. Consensus reflects the similar information between each perspective, and the output of each perspective should be as consistent as possible. Complementarity reflects the unique information of each perspective, and perspectives need to learn from each other to make up for each other's shortcomings. Since complementarity is often easily overlooked, the present invention is committed to integrating the complementary information of perspectives into multi-perspective classification learning to design a higher-quality classification system.

[0004] Geometry is a course in mathematics that studies spatial structures. Geometric information can help people better understand abstract target content and has a more intuitive form of expression. In the field of data classification, mining the geometric relationship of samples can be more effectively classified. Geometric information includes the distance and direction angle between samples, the local and non-local geometric structure of samples, and the positional relationship between samples and hyperplanes. Metric learning is a learning method for mining sample geometric information. The present invention uses metric learning as the basic framework to learn and classify multi-view network intrusion data. Summary of the invention

[0005] Technical problem: In view of the problem that the existing network intrusion detection system cannot mine the data information of samples and perspectives, resulting in unsatisfactory classification performance, the present invention provides a network intrusion detection method that introduces sample geometry and multi-perspective information. The invention constructs a highly separable metric space by exploring the distance, density and local geometric structure between samples and the complementary information between perspectives, and performs the final classification through the K nearest neighbor classifier.

[0006] Technical solution: First, the original multi-view network intrusion data set is divided into two parts: a training set and a network intrusion data to be detected; secondly, a geometric information mining method is implemented on the training set of each view; then, an adaptive maximization of the cross-correlation of views is used to obtain a metric space that considers sample geometric information and multi-view complementary information; then, the obtained metric space is substituted into the learning framework, and the optimal solution is calculated through the optimization method to obtain the final metric space; finally, the network intrusion data to be detected is sent into the final metric space obtained by training, and the Mahalanobis distance between each network intrusion data to be detected and all samples in the training set is calculated, and the categories of the first k training set samples closest to the network intrusion data to be detected are counted, and the category with the most occurrences in these k results is taken as the category of the network intrusion data to be detected.

[0007] The technical solution adopted by the present invention to solve its technical problems can be further refined. The specific process of implementing the geometric information mining method on the training set of each perspective is as follows. First, the collected intrusion data is used as the training set to apply the large margin criterion framework at each perspective to obtain a metric space where similar sample pairs are close and heterogeneous sample pairs are far away; secondly, the density between heterogeneous sample clusters in the training set at each perspective is minimized to obtain a metric space that considers the distance between sample pairs and the density between classes; finally, an adjacency matrix with label information is introduced for each perspective to obtain a metric space that considers both global and local data structures.

[0008] Beneficial effects: Compared with the prior art, the present invention has the following advantages:

[0009] First, most of the existing technologies directly apply the large margin criterion framework. The inter-class density considered in the present invention solves the problem of samples being disordered in the metric space caused by the large margin criterion framework. The present invention minimizes the density between different classes, making each class cluster more separated and distributed more regularly, thereby increasing the separability of the classes.

[0010] Secondly, unlike the existing technology that only considers the global structure of the model and ignores the local information between samples, the present invention maintains the manifold structure of the original space by introducing an adjacency matrix with sample label information, so that the local geometric structure between samples can be explored, reducing the loss of important information in the process of mapping samples to the metric space.

[0011] Finally, existing technical models often only study the consistency of multiple perspectives, while ignoring another important principle of multiple perspectives: complementarity. Unlike the existing technology, this invention mines the complementary information between perspectives, allowing different perspectives to learn from each other to supplement their own lost data, reflecting the diverse characteristics of multi-perspective datasets, and can learn target samples more comprehensively, thereby improving the final classification accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a training flow chart of the network intrusion detection system that introduces geometric and multi-view information in the present invention.

[0013] Figure 2 It is a flow chart of the geometric information mining method of the present invention. DETAILED DESCRIPTION

[0014] In order to more clearly describe the content of the present invention, the following is further explained in conjunction with examples and drawings of the specification. The examples mentioned below are not intended to limit the scope of the present invention. The network intrusion detection system that introduces geometric and multi-view information of the present invention includes the following steps:

[0015] Step 1: Input training set samples Where N tr is the number of training set samples, V is the number of viewing angles, d v is the dimension of the vth visual feature. Input sample label Regularization parameters γ, β, η and weight parameter r, convergence threshold ζ.

[0016] Step 2: First, mine the geometric information of the sample. The specific steps are as follows:

[0017] Step 2.1: For each perspective, use the large margin criterion framework to constrain the distance between sample pairs, so that heterogeneous sample pairs are as far apart as possible, and the distance between homogeneous sample pairs is shortened. Specifically, the training data is divided into heterogeneous sample pairs and homogeneous sample pairs according to the labels of the training set. That is, if two samples have different labels, they are heterogeneous sample pairs, and if they have the same label, they are homogeneous sample pairs. All heterogeneous sample pairs constitute a set All similar sample pairs consist of Calculate the distance of all heterogeneous sample pairs at each viewing angle and add them up and divide them by the number of heterogeneous sample pairs D. Calculate the distance of all homogeneous sample pairs at each viewing angle and add them up and divide them by the number of homogeneous sample pairs S. Subtract the above two results to obtain the large margin framework constraint term, which can be achieved by maximizing the following sub-formula:

[0018]

[0019] in, represents a sample pair, and They represent the i-th and j-th samples of the v-th view respectively. and They represent the set of heterogeneous sample pairs and the set of homogeneous sample pairs respectively. D and S are the sets and The number of elements contained. v is the Mahalanobis metric matrix M v The weight vector obtained by decomposition. According to the characteristics of Mahalanobis metric, M v is a symmetric positive semidefinite matrix, so it satisfies

[0020] Step 2.2: For each viewpoint, minimize the inter-class density of the sample set, that is, make the density centers of different category clusters as far apart as possible, and make the category clusters more dispersed to enhance separability. The density center is calculated by the average value of all samples belonging to the category. First, divide the training data into different class subsets according to the labels of the training set, and then calculate the average value of the feature set corresponding to each viewpoint of the sample data in each class subset as the class center at the corresponding viewpoint of each class subset. That is, the features of each data sample of a certain class subset at a certain perspective are added and divided by the number of samples of the class subset. Then, the distances between the class centers of different class subsets at different perspectives are added to obtain the sum of the inter-class distances of all class subsets at all perspectives. Finally, substituting into the metric space, it can be achieved by maximizing the following sub-formula:

[0021]

[0022] Among them, c i,c j ∈[1,2,...,C] represents different categories, C is the total number of sample categories, They belong to c i ,c j The sample sets of the categories, the number of elements they contain are respectively expressed as express;

[0023] Step 2.3: Introduce an adjacency matrix with sample label information to maintain the manifold structure of the original feature space and explore the local geometric structure of the sample:

[0024] Step 2.3.1: Construct the adjacency matrix P based on the idea of ​​graph structure. Specifically, count the labels corresponding to each data in the input training set. If the labels of two data samples are the same, set the corresponding P ij for Otherwise, set the corresponding P ij is 0:

[0025]

[0026] Step 2.3.2: For each view, introduce the adjacency matrix into the metric space. This can be achieved by minimizing the following subformula:

[0027]

[0028] in, Represents all pairs of samples in the sample set X;

[0029] Step 2.3.3: Simplify the above formula using the Laplace matrix to get:

[0030]

[0031] Among them, trace(·) represents the operation of finding the trace, L ap is the Laplace matrix, and its specific expression is:

[0032] L ap =DP(6)

[0033] Where D is a diagonal matrix and satisfies

[0034] Step 3: Then explore the complementary information of perspectives. The specific steps are as follows:

[0035] Step 3.1: Calculate the cross-correlations between the various perspectives and maximize them:

[0036]

[0037] Among them, v,u∈[1,2,...,V] are different perspectives;

[0038] Step 3.2: Assign different weights to different perspectives and optimize them adaptively to maximize the complementarity between perspectives:

[0039]

[0040] There are two constraints here. The first one means that the sum of the weights for each view is fixed to 1, and the second one is to ensure that it makes sense when doing parameter updates.

[0041] Step 4: Unify the above mentioned modules into a joint optimization framework:

[0042]

[0043] Step 5: Optimize the above framework to obtain the weight matrix W v , the specific steps are as follows:

[0044] Step 5.1: Rewrite the first three terms of the objective function into the form of finding the trace, and combine and simplify them to obtain:

[0045]

[0046] in,

[0047]

[0048] Step 5.2: Put λ v As a constant, W v To optimize, the specific steps are:

[0049] Step 5.2.1: Construct the matrix

[0050]

[0051] Then, formula (10) can be expressed in vector form:

[0052]

[0053] Step 5.2.2: Matrix Perform eigenvalue decomposition to obtain W v ;

[0054] Step 5.3: Put W v As a constant, v To optimize, the specific steps are:

[0055] Step 5.3.1: Use the Lagrange multiplier method to link the optimization formula and the constraint terms. α is the Lagrange multiplier:

[0056]

[0057] Step 5.3.2: Set F(λ v ,α) vs.λ v Take partial derivatives of and α and set them to 0, and we get:

[0058]

[0059] Step 5.3.3: Solve the above equations to get λ v The expression is:

[0060]

[0061] Repeat steps 5.2-5.3 until Exit the optimization process. t Refers to the value of the objective function after the tth repetition.

[0062] Step 6: Use the optimized weight matrix W v Construct the metric matrix M v .

[0063] Step 7: Enter the network intrusion data to be detected Where N te is the number of network intrusion data to be detected, and the K nearest neighbor classifier is used to classify the network intrusion data to be detected in this metric space. The specific steps are as follows:

[0064] Step 7.1: Calculate the Mahalanobis distance between each network intrusion data to be detected and all training set samples in the final metric space learned in the training step:

[0065]

[0066] Among them, x i and x j They belong to the training set samples and the network intrusion data to be detected respectively.

[0067] Step 7.2: Count the categories of the first k training set samples that are closest to the network intrusion data to be detected, and take the category that appears most frequently among these k results as the category of the network intrusion data to be detected.

[0068] The above describes the specific implementation of the present invention according to the accompanying drawings. However, those skilled in the art will understand that, without departing from the spirit and principle of the present invention, several improvements and equivalent substitutions may be made. The technologies and solutions after improvements and equivalent substitutions in the claims of the present invention all fall within the protection scope of the present invention.

[0069] Experimental design

[0070] Experimental data set selection: This paper selects the network security data set NSL-KDD for intrusion detection. The detailed information of the data set is shown in the following table.

[0071] Dataset type Number of viewing angles Number of categories Number of samples Dimensions NSL-KDD Word 3 5 2526 464 / 1144 / 104

[0072] The regularization parameters γ, β and η are selected from {10 -4 ,10 -3 ,10 -2 ,10 -1 ,10 0 ,10 1 ,10 2 ,10 3}, r is set to 2. The grid search method is used to obtain the best parameter combination. All algorithms use 5-fold cross validation to obtain the average value as the final result.

[0073] Comparison model: The model of the present invention is named DLMMLC. We compared the performance among FISH-MML, MvGMML, DMLMJ, LMNN and Euclidean.

[0074] Performance measurement method: This experiment uses classification accuracy ACC and macro F1-score as indicators to measure model performance. The calculation method of the two is as follows:

[0075]

[0076] Among them, TP, TN, FP, and FN represent true positive, true negative, false positive, and false negative, respectively.

[0077]

[0078] Where c represents the number of categories,

[0079] Experimental results:

[0080] Table 1 Comparison results of classification accuracy ACC [mean ∷ standard deviation] on NSL-KDD

[0081]

[0082] Note: The unit is %, and the best results are indicated in bold.

[0083] Table 2 Comparison results of macro F1-score [average ∷ standard deviation] for classification on NSL-KDD

[0084]

[0085] Note: Unit: %, NAN means the calculation result is meaningless, the best result is indicated in bold.

[0086] Among them, DMLMJ, LMNN and Euclidean are single-view metric learning, so we take two measures to evaluate their classification performance on multi-view datasets. The first is to concatenate the features of multiple views together to form a large single-view dataset and implement the method on it, denoted as method name-FC. The second is to implement the method separately for each view and take the best result, denoted as method name-BSV.

[0087] From the above two experimental result tables, we can conclude that this system has higher results than other comparison systems in both ACC and macro F1-score, which shows that this system has a good effect on network intrusion detection.

Claims

1. A network intrusion detection method that introduces sample geometry and multi-view information, characterized in that: The specific steps include: 1) The first step of system training: the collected intrusion data is used as the training set to apply the large margin criterion framework at each perspective to obtain the metric space where similar sample pairs are close to heterogeneous sample pairs and far away from each other; 2) Second step of training: In the metric space obtained in the first step of training, the density between heterogeneous sample clusters in the training set at each perspective is minimized to obtain a metric space that considers the distance between sample pairs and the density between classes. The specific steps are as follows: First, the training data is divided into different class subsets according to the labels of the training set, and then the average value of the feature set corresponding to each view of the sample data in each class subset is calculated as the class center at the corresponding view of each class subset. That is, add the features of each data sample of the class subset at the viewpoint and divide it by the number of samples of the class subset. Then add the distances between the class centers of different class subsets at different viewpoints to get the sum of the inter-class distances of all class subsets at all viewpoints. Finally, substituting into the metric space, we get: in, and represent the i-th and j-th samples of the v-th view, respectively, V is the total number of views, W v is the Mahalanobis metric matrix M of the vth perspective v The weight vector obtained by decomposition, according to the characteristics of Mahalanobis metric, M v is a symmetric positive semidefinite matrix, so it satisfies c i ,c j ∈[1,2,...,C] represents different categories, C is the total number of sample categories, They belong to c i ,c j The sample sets of the categories, the number of elements they contain are respectively expressed as express; 3) Training Step 3: In the metric space obtained in Step 2, an adjacency matrix with label information is introduced for each perspective to obtain a metric space that considers both global and local data structures. The specific steps are as follows: First, construct an adjacency matrix P with sample label information, and count the labels corresponding to each data in the input training set. If the labels of two data samples are the same, set the corresponding P ij for Otherwise, set the corresponding P ij is 0: Secondly, the adjacency matrix P is introduced into the metric space to obtain: in, represents sample pairs, S represents the set of similar sample pairs, S is the number of elements contained in the set S, and X represents all sample pairs in the sample set X. 4) Training step 4: In the metric space obtained in the third step of training, an adaptive maximization of the cross-correlation method of perspectives is used to obtain a metric space that considers sample geometric information and multi-perspective complementary information; 5) Training step 5: Substitute the metric space obtained in the fourth step of training into the learning framework, and calculate the optimal solution through the optimization method to obtain the final metric space. The specific steps are: First, a large margin framework is used to constrain the distance of sample pairs. The training data is divided into heterogeneous sample pairs and homogeneous sample pairs according to the labels of the training set. That is, if two samples have different labels, they are heterogeneous sample pairs, and if they have the same labels, they are homogeneous sample pairs. All heterogeneous sample pairs form a set D, and all homogeneous sample pairs form S. The distance of all heterogeneous sample pairs at each perspective is calculated and added and divided by the number of heterogeneous sample pairs D. The distance of all homogeneous sample pairs at each perspective is calculated and added and divided by the number of homogeneous sample pairs S. The above two results are subtracted to obtain the large margin framework constraint term, and then the regularization term obtained by the method in the second step of training is added, and then the regularization term obtained by the method in the third step of training is subtracted and converted into the Laplace matrix form. Finally, the regularization term obtained by the adaptive maximization of perspective cross-correlation method is added, and a weight λ is set for each perspective. v , calculate the cross-correlation of training data from different perspectives And add them together to get the final objective function: Among them, L ap is the Laplace matrix converted from the adjacency matrix P, trace() is the trace operation, X v is the sample set of the vth perspective, v,u∈[1,V], the first constraint is to ensure the property of the symmetric semi-positive definite matrix, the second constraint means that the sum of the weights of different perspectives is 1, and ensures that the weight optimization process is meaningful, γ, β, η and r are balance parameters; 6) Network intrusion detection process: input the network intrusion data to be detected The Mahalanobis distance between each network intrusion data to be detected and all training set samples is calculated in the final metric space learned in the training step: Where N te is the number of network intrusion data to be detected, x i and x j They belong to the training set samples and the network intrusion data to be detected respectively. Finally, the maximum voting method is used, that is, the categories of the first k training set samples closest to the network intrusion data to be detected are counted, and the category with the most occurrences in these k results is taken as the category of the network intrusion data to be detected.

Images