An intrusion detection method and system based on hVAE generation model
By using an intrusion detection method based on the hVAE generative model, the loss function is adjusted by the weight parameter λ to generate a dataset that conforms to the real network environment. This solves the problem of data feature selection and labeling in intrusion detection models, reduces the false alarm rate, and improves detection accuracy and stability.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- COMP NETWORK INFORMATION CENT CHINESE ACADEMY OF SCI
- Filing Date
- 2021-06-17
- Publication Date
- 2026-07-21
AI Technical Summary
Existing intrusion detection models face difficulties in selecting network traffic data features and obtaining labeled data. GAN-generated models struggle to distinguish real network attack samples, resulting in high false positive rates.
We employ an hVAE-based generative model, adjust the loss function using the weight parameter λ, generate datasets through supervised and unsupervised learning, and optimize the model using stochastic gradient descent to generate data that conforms to the real network environment, thereby reducing the false alarm rate.
This improved the accuracy of the intrusion detection model in judging normal traffic data, reduced the false alarm rate, and enhanced the accuracy and stability of detection.
Smart Images
Figure CN115495729B_ABST
Abstract
Description
Technical Field
[0001] This invention belongs to the field of intrusion detection, and specifically relates to an intrusion detection method and system based on an hVAE generative model. Background Technology
[0002] With the rapid development of network technology and the widespread application of big data technology, more and more industries are choosing to combine their existing technologies with high-tech information technology. While enjoying the convenience brought by information technology, people also need to bear the risks caused by external network intrusion attacks.
[0003] Currently, selecting appropriate network traffic data features is generally quite difficult in the field of intrusion detection. Furthermore, it is challenging to obtain labeled traffic data from real networks for training network intrusion detection models. This is often due to the significant cost and potential privacy implications of labeling real traffic data.
[0004] Traditional data generation models like GANs can also generate data. However, when considering the impact of real network data samples on intrusion detection model training, it's found that GANs, as generative adversarial neural networks, rely on a Nash equilibrium achieved through a game between the encoder and generator. The model needs samples that match real network attacks; its generated data should maximize the variance of the data samples while ensuring that core features are easily distinguishable, for training purposes. Generating too many intrusion detection data samples that are difficult to distinguish from real attacks can actually make the original model struggle to identify normal traffic data during actual intrusion detection, thus increasing the false alarm rate. Summary of the Invention
[0005] This invention provides an intrusion detection method and system based on an hVAE generative model.
[0006] To achieve the above objectives, the present invention adopts the following technical solution:
[0007] One technical solution of the present invention provides an intrusion detection method based on an hVAE generative model, the method comprising:
[0008] Generate hVAE generative models;
[0009] The hVAE generative model is used to generate the dataset required for intrusion detection.
[0010] In conjunction with the first technical solution, in a first possible implementation of the first technical solution, the method further includes:
[0011] The original training dataset is divided into a first training set and a test set. The first training set is used to train the first intrusion detection model.
[0012] The hVAE generative model is used to generate the dataset required for intrusion detection and then trained to obtain a second intrusion detection model.
[0013] The test set is input into the first intrusion detection model and the second intrusion detection model for detection, and the detection results are output respectively.
[0014] Calculate the detection error between the outputs of the two intrusion detection models. When the error value is greater than the threshold, randomly select t samples from the original training dataset and put them into the dataset required for intrusion detection generated by the hVAE generative model to form a new dataset and train it to obtain a new intrusion detection model. Repeat the above steps until the error value is no greater than the threshold to form the final intrusion detection model, where t > 1.
[0015] In a further improved technical solution, in conjunction with the first technical solution, the generation of the hVAE generative model specifically includes:
[0016] Reconstruct the original training dataset to obtain reconstructed data and its labels;
[0017] The loss function L1(x,y;θ,φ) for reconstructing the data and the reconstruction error L2(x,y;θ,φ) based on the labels of the reconstructed data are obtained.
[0018] Find the loss function L(x,y;θ,φ) for the hVAE generative model;
[0019] A general hVAE generative model framework is constructed, and the model is iteratively optimized using stochastic gradient descent to obtain the optimal parameters of the loss function L(x,y;θ,φ).
[0020] In a further improved technical solution, based on the first technical solution, the loss function L(x,y;θ,φ) is expressed as:
[0021] L(x,y;θ,φ)=λ*L1(x,y;θ,φ)+(1-λ)*L2(x,y;θ,φ).
[0022] In the further improved technical solution, based on the first technical solution,
[0023] In a further improved version of the first technical solution,
[0024]
[0025] In a further improved technical solution, in conjunction with the first technical solution, the reconstructing of the original training dataset to obtain reconstructed data and its labels specifically includes:
[0026] Construct the encoder in the VAE using the original training dataset x and label y;
[0027] Obtain the latent variable z* and the reconstructed data x*;
[0028] Obtain the label y* of the reconstructed data based on the latent variable z* and the reconstructed data x*.
[0029] In a further improved technical solution, building upon the first technical solution, the encoder in the VAE is constructed using the original training dataset x and labels y. Its function is defined as q(z|x,y). The result is represented using reparameterization with parameter φ. The reparameterized distribution is sampled, and the final generated latent variable is represented by z. (i) Let q represent the encoder process. φ (z (i) |x (i) ,y (i) ), where i is the i-th feature of the data sample.
[0030] In a further improved technical solution, combining the first technical solution, P is utilized. θ The distribution obtained from the original function process is fitted to the distribution of (). Initially, a distribution N(0,i) is selected. After sampling from N(0,i), the latent variable z* is obtained. The reconstructed data x* is generated through the decoder process.
[0031] via p θ (y *(i) |x *(i) ,z *(i,l) The label y* of the reconstructed data is obtained.
[0032] The second technical solution of this invention provides an intrusion detection system based on an hVAE generative model, characterized in that the system comprises:
[0033] A model generation module, configured to generate hVAE generative models;
[0034] A dataset generation module is positioned to generate the dataset required for intrusion detection using the hVAE generative model.
[0035] The intrusion detection method and system based on the hVAE generative model provided by this invention introduces a weight parameter λ on top of VAE during the dataset generation process. When calculating the overall loss function of the hVAE generative model, the weight parameter is used to adjust the weight between the input data loss function obtained from VAE and the label reconstruction error. The resulting hVAE generative model comprehensively considers both supervised and unsupervised learning generation and prediction methods. Furthermore, a model with weighted harmonics is constructed based on the stochastic gradient descent method, making the generated data more consistent with the environment of real networks, improving the judgment of normal traffic data, and reducing the false alarm rate. This enhances the ability to train the intrusion detection model using the generated data, thereby improving the accuracy of the intrusion detection model. Attached Figure Description
[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0037] Figure 1 This is a flowchart illustrating an intrusion detection method based on an hVAE generative model, provided in one embodiment of the present invention.
[0038] Figure 2 This is a schematic diagram of the process provided by the present invention for reconstructing the original training dataset to obtain reconstructed data and the labels of the reconstructed data;
[0039] Figure 3 This is the basic core flowchart for generating hVAE generative models provided by the present invention;
[0040] Figure 4 This is a flowchart illustrating an intrusion detection method based on an hVAE generative model, provided in another embodiment of the present invention.
[0041] Figure 5 This is a schematic diagram of the structure of an intrusion detection system based on an hVAE generative model, provided in another embodiment of the present invention. Detailed Implementation
[0042] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.
[0043] One embodiment of the present invention provides an intrusion detection method based on an hVAE generative model, such as... Figure 1 As shown, the method includes:
[0044] S1. Generate the hVAE generative model;
[0045] like Figure 2 As shown, the specific method for generating the hVAE generative model includes:
[0046] S11. Reconstruct the original training dataset to obtain the reconstructed data and its labels.
[0047] Furthermore, the original training dataset is reconstructed to obtain reconstructed data and its labels, specifically as follows:
[0048] 1) Construct the encoder in the VAE using the original training dataset x and labels y;
[0049] See Figure 3 ① represents the encoder process in VAE, defined here as q φ (z|x,y). The distribution of latent variables is obtained from the original training dataset through the Encoder process, and the distribution is sampled to obtain the final result z.
[0050] Based on the above, this invention constructs the encoder in a VAE using the original training dataset x and labels y. The function is defined as q(z|x,y), and the result is represented using reparameterization with parameter φ. The reparameterized distribution is sampled, and the final generated latent variable is represented by z. (i) Let q represent the encoder process. φ (z (i) |x (i) ,y (i) ), where i is the i-th feature of the data sample;
[0051] 2) Obtain the latent variable z* and the reconstructed data x*;
[0052] See Figure 3 Part ② represents the process of obtaining latent variable z* given a fitted distribution. Based on z*, reconstructed data x* can be obtained using a neural network. The decoder process is defined as p θ (x*|z*).
[0053] Therefore, the present invention utilizes P θThe distribution obtained from the original function process is fitted using a neural network. An initial distribution N(0,i) is selected, and samples are taken from N(0,i) to obtain the latent variable z*. The latent variable z* is initially given an initial distribution (following a certain distribution, such as a normal distribution). Then, the parameters of the neural network are adaptively adjusted to obtain a distribution that approximates the sampled latent variable z(i). In short, it uses z*... (i) To fit z (i) The distributions of the two are made similar. Reconstructed data x* is generated through a decoder process.
[0054] 3) Obtain the label y* of the reconstructed data based on the latent variable z* and the reconstructed data x*;
[0055] See Figure 3 ③ is represented as y* obtained from x* and z*.
[0056] Specifically: via p θ (y *(i) |x *(i) ,z *(i,l) The label y* of the reconstructed data is obtained.
[0057] S12. Obtain the loss function L1(x,y;θ,φ) for the reconstructed data and the reconstruction error L2(x,y;θ,φ) based on the labels of the reconstructed data;
[0058] in,
[0059]
[0060] Where L represents the error object that needs to be optimized; D kl Let i represent the KL divergence; since i is a component, N is the sum of all features; X represents the input data; Y represents the label; φ and θ represent the parameters in the encoder and decoder, respectively.
[0061] S13. Find the loss function L(x,y; θ,φ) of the hVAE generative model;
[0062] Among them, L(x,y;θ,φ)=λ*L1(x,y;θ,φ)+(1-λ)*L2(x,y;θ,φ);
[0063] S14. Construct the overall hVAE generative model framework, use stochastic gradient descent to iteratively optimize the model, and find the optimal parameters of the loss function L(x,y;θ,φ); thereby obtaining the hVAE generative model.
[0064] S2. Use the hVAE generative model to generate the dataset required for intrusion detection;
[0065] The trained hVAE generative model is used to generate data from the original sample, and the generated data is then incorporated into the dataset used to train the intrusion detection model.
[0066] The intrusion detection method based on the hVAE generative model provided by this invention introduces a weight parameter λ on top of VAE during the dataset generation process. When calculating the overall loss function of the hVAE generative model, the weight parameter is used to adjust the weight between the input data loss function obtained from VAE and the label reconstruction error. The resulting hVAE generative model comprehensively considers both supervised and unsupervised learning generation and prediction methods. Furthermore, a model with weighted harmonics is constructed based on the stochastic gradient descent method, making the generated data more consistent with the environment of real networks, improving the judgment of normal traffic data, and reducing the false alarm rate. The generated data is used to train the intrusion detection model, thereby improving the accuracy of the intrusion detection model.
[0067] Some embodiments of the present invention provide an intrusion detection method based on an hVAE generative model, the method further comprising:
[0068] The generated dataset is used for training to obtain an intrusion detection model;
[0069] Data sets can be used to train convolutional neural network models, random forest models, and so on.
[0070] The intrusion detection model is used to detect the data to be detected.
[0071] The above methods improve the accuracy of detection.
[0072] Other embodiments of the present invention provide an intrusion detection method based on an hVAE generative model, such as... Figure 4 As shown, the method includes:
[0073] S1. Generate the hVAE generative model;
[0074] like Figure 2 As shown, the specific method for generating the hVAE generative model includes:
[0075] S11. Reconstruct the original training dataset to obtain the reconstructed data and its labels.
[0076] Furthermore, the original training dataset is reconstructed to obtain reconstructed data and its labels, specifically as follows:
[0077] 1) Construct the encoder in the VAE using the original training dataset x and labels y;
[0078] See Figure 3① represents the encoder process in VAE, defined here as q φ (z|x,y). The distribution of latent variables is obtained from the original training dataset through the Encoder process, and the distribution is sampled to obtain the final result z.
[0079] Based on the above, this invention constructs the encoder in a VAE using the original training dataset x and labels y. The function is defined as q(z|x,y), and the result is represented using reparameterization with parameter φ. The reparameterized distribution is sampled, and the final generated latent variable is represented by z. (i) Let q represent the encoder process. φ (z (i) |x (i) ,y (i) ), where i is the i-th feature of the data sample;
[0080] 2) Obtain the latent variable z* and the reconstructed data x*;
[0081] See Figure 3 Part ② represents the process of obtaining latent variable z* given a fitted distribution. Based on z*, reconstructed data x* can be obtained using a neural network. The decoder process is defined as p θ (x*|z*).
[0082] Therefore, the present invention utilizes P θ The distribution obtained from the original function process is fitted using a neural network. An initial distribution N(0,i) is selected, and samples are taken from N(0,i) to obtain the latent variable z*. The latent variable z* is initially given an initial distribution (following a certain distribution, such as a normal distribution). Then, the parameters of the neural network are adaptively adjusted to obtain a distribution that approximates the sampled latent variable z(i). In short, it uses z*... (i) To fit z (i) The distributions of the two are made similar. Reconstructed data x* is generated through a decoder process.
[0083] 3) Obtain the label y* of the reconstructed data based on the latent variable z* and the reconstructed data x*;
[0084] See Figure 3 ③ is represented as y* obtained from x* and z*.
[0085] Specifically: via p θ (y *(i) |x *(i) ,z *(i,l) The label y* of the reconstructed data is obtained.
[0086] S12. Obtain the loss function L1(x,y;θ,φ) for the reconstructed data and the reconstruction error L2(x,y;θ,φ) based on the labels of the reconstructed data;
[0087] in,
[0088]
[0089] Where L represents the error object that needs to be optimized; D kl Let i represent the KL divergence; since i is a component, N is the sum of all features; X represents the input data; Y represents the label; φ and θ represent the parameters in the encoder and decoder, respectively.
[0090] S13. Find the loss function L(x,y; θ,φ) of the hVAE generative model;
[0091] Among them, L(x,y;θ,φ)=λ*L1(x,y;θ,φ)+(1-λ)*L2(x,y;θ,φ);
[0092] S14. Construct the overall hVAE generative model framework, use stochastic gradient descent to iteratively optimize the model, and find the optimal parameters of the loss function L(x,y;θ,φ); thereby obtaining the hVAE generative model.
[0093] S2. Use the hVAE generative model to generate the dataset required for intrusion detection;
[0094] The trained hVAE generation model is used to generate data from the original sample, and the generated data is then incorporated into the dataset used to train the intrusion detection model.
[0095] S3. Divide the original training dataset x and label y into a first training set and a test set. Use the first training set to train and obtain the first intrusion detection model.
[0096] 80% of the samples were used as the first training set, and the remaining samples were used as the test set;
[0097] S4. Use the dataset generated in step S2 to train and obtain the second intrusion detection model;
[0098] S5. Input the test set into the first intrusion detection model and the second intrusion detection model for detection, and output the detection results respectively;
[0099] S6. Calculate the detection error of the two intrusion detection models. When the error value is greater than the threshold, randomly select t samples from the original training dataset x and put them into the dataset required for intrusion detection generated by the hVAE generation model to form a new dataset and train it to obtain a new intrusion detection model. Then, proceed to step S5 until the error value is not greater than the threshold to form the final intrusion detection model, where t > 1.
[0100] The dataset was used to train convolutional neural networks and random forest models.
[0101] The above methods significantly improve the accuracy of intrusion detection and enhance the stability of the model.
[0102] Other embodiments of the present invention provide an intrusion detection system based on an hVAE generative model, such as... Figure 5 As shown, the system includes:
[0103] One embodiment of the present invention provides an intrusion detection system based on an hVAE generative model, such as... Figure 3 As shown, the system includes:
[0104] Model generation module 10, configured to generate hVAE generative models;
[0105] The model generation module 10 includes:
[0106] Reconstruction unit 101, configured to reconstruct the original training dataset to obtain reconstructed data and labels for the reconstructed data;
[0107] Furthermore, the original training dataset is reconstructed to obtain reconstructed data and its labels, specifically as follows:
[0108] 1) Construct the encoder in the VAE using the original training dataset x and labels y;
[0109] See Figure 3 ① represents the encoder process in VAE, defined here as q φ (z|x,y). The distribution of latent variables is obtained from the original training dataset through the Encoder process, and the distribution is sampled to obtain the final result z.
[0110] Based on the above, this invention constructs the encoder in a VAE using the original training dataset x and labels y. The function is defined as q(z|x,y), and the result is represented using reparameterization with parameter φ. The reparameterized distribution is sampled, and the final generated latent variable is represented by z. (i) Let q represent the encoder process. φ(z (i) |x (i) ,y (i) ), where i is the i-th feature of the data sample;
[0111] 2) Obtain the latent variable z* and the reconstructed data x*;
[0112] See Figure 3 Part ② represents the process of obtaining latent variable z* given a fitted distribution. Based on z*, reconstructed data x* can be obtained using a neural network. The decoder process is defined as p θ (x*|z*).
[0113] Therefore, the present invention utilizes P θ The distribution obtained from the original function process is fitted to the distribution of (). Initially, a distribution N(0,i) is selected. After sampling from N(0,i), the latent variable z* is obtained. The reconstructed data x* is generated through the decoder process.
[0114] 3) Obtain the label y* of the reconstructed data based on the latent variable z* and the reconstructed data x*;
[0115] See Figure 3 ③ is represented as y* obtained from x* and z*.
[0116] Specifically: via p θ (y *(i) |x *(i) ,z *(i,l) The label y* of the reconstructed data is obtained.
[0117] The above process describes the data generation process for unsupervised learning.
[0118] The obtaining unit 102 is configured to obtain the loss function L1(x,y;θ,φ) of the reconstructed data and the reconstruction error L2(x,y;θ,φ) based on the labels of the reconstructed data.
[0119] in,
[0120]
[0121] The calculation unit 103 is configured to calculate the loss function L(x,y; θ,φ) of the hVAE generative model.
[0122] Among them, L(x,y;θ,φ)=λ*L1(x,y;θ,φ)+(1-λ)*L2(x,y;θ,φ);
[0123] Construction unit 104 is configured to construct the overall hVAE generative model framework, iteratively optimize the model using stochastic gradient descent, and obtain the optimal parameters of the loss function L(x,y;θ,φ);
[0124] Dataset generation module 20, which is positioned to generate the dataset required for intrusion detection using the hVAE generative model;
[0125] The trained hVAE generative model is used to generate data from the original sample, and the generated data is then incorporated into the dataset used to train the intrusion detection model.
[0126] The intrusion detection system based on the hVAE generative model provided by this invention introduces a weight parameter λ on top of VAE during the dataset generation process. When calculating the overall loss function of the hVAE generative model, the weight parameter is used to adjust the weight between the input data loss function obtained from VAE and the label reconstruction error. The resulting hVAE generative model comprehensively considers both supervised and unsupervised learning generation and prediction methods. Furthermore, a model with weighted harmonics is constructed based on the stochastic gradient descent method, making the generated data more consistent with the environment of real networks, improving the judgment of normal traffic data, and reducing the false alarm rate. The generated data is used to train the intrusion detection model, thereby improving the accuracy of the intrusion detection model.
[0127] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to interchangeably. Each embodiment focuses on describing the differences from other embodiments. In particular, the device embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.
[0128] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. The storage medium can be a magnetic disk, optical disk, read-only memory (ROM), or random access memory (RAM), etc.
[0129] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.
Claims
1. An intrusion detection method based on an hVAE generative model, characterized in that, The method includes: Generate hVAE generative models; specifically including: The original training dataset is reconstructed to obtain reconstructed data and its labels; specifically, this includes: The encoder in the VAE is constructed using the original training dataset x and labels y, with the function q(z|x,y). The result is represented using reparameterization with parameter φ. The reparameterized distribution is sampled, and the final latent variable is represented by z. (i) The encoder process is represented as follows: ) , where i is the i-th feature of the data sample; Obtain the latent variable z* and the reconstructed data x*; Among them, utilizing P θ The distribution obtained from the original function process is fitted to the distribution of (). Initially, a distribution N(0,i) is selected. After sampling from N(0,i), the latent variable z* is obtained. The reconstructed data x* is generated through the decoder process. Obtain the label y* of the reconstructed data based on the latent variable z* and the reconstructed data x*; pass Obtain the label y* of the reconstructed data; The loss function L1(x,y;θ,) for reconstructing the data is obtained. ) and the reconstruction error L2(x,y;θ, based on the labels of the reconstructed data ); in, ) )； Where L represents the error object to be optimized; Dkl represents the KL divergence; N represents the sum of all features; and θ represents the parameters in the decoder. Find the loss function L(x,y;θ,) of the hVAE generative model. The loss function L(x,y;θ, ) is represented as: ； Construct an overall hVAE generative model framework, iteratively optimize the model using stochastic gradient descent, and obtain the loss function L(x,y;θ, The optimal parameters of hVAE are then used to obtain the hVAE model; the hVAE model is then used to generate the dataset required for intrusion detection. The original training dataset is divided into a first training set and a test set. The first training set is used to train the first intrusion detection model. The hVAE generative model is used to generate the dataset required for intrusion detection and then trained to obtain a second intrusion detection model. The test set is input into the first intrusion detection model and the second intrusion detection model for detection, and the detection results are output respectively. Calculate the detection error between the outputs of the two intrusion detection models. When the error value is greater than the threshold, randomly select t samples from the original training dataset and put them into the dataset required for intrusion detection generated by the hVAE generative model to form a new dataset and train it to obtain a new intrusion detection model. Repeat the above steps until the error value is no greater than the threshold to form the final intrusion detection model, where t > 1.
2. An intrusion detection system based on an hVAE generative model, characterized in that, The system includes: A model generation module, configured to generate hVAE generative models, specifically includes: The original training dataset is reconstructed to obtain reconstructed data and its labels; specifically, this includes: The encoder in the VAE is constructed using the original training dataset x and labels y, with the function q(z|x,y). The result is represented using reparameterization with parameter φ. The reparameterized distribution is sampled, and the final latent variable is represented by z. (i) The encoder process is represented as follows: ) , where i is the i-th feature of the data sample; Obtain the latent variable z* and the reconstructed data x*; Among them, utilizing P θ The distribution obtained from the original function process is fitted to the distribution of (). Initially, a distribution N(0,i) is selected. After sampling from N(0,i), the latent variable z* is obtained. The reconstructed data x* is generated through the decoder process. Obtain the label y* of the reconstructed data based on the latent variable z* and the reconstructed data x*; pass Obtain the label y* of the reconstructed data; The loss function L1(x,y;θ,) for reconstructing the data is obtained. ) and the reconstruction error L2(x,y;θ, based on the labels of the reconstructed data ); in, ) )； Where L represents the error object to be optimized; Dkl represents the KL divergence; N represents the sum of all features; and θ represents the parameters in the decoder. Find the loss function L(x,y;θ,) of the hVAE generative model. The loss function L(x,y;θ, ) is represented as: ； Construct an overall hVAE generative model framework, iteratively optimize the model using stochastic gradient descent, and obtain the loss function L(x,y;θ, The optimal parameters are then used to obtain the hVAE model. A dataset generation module is positioned to generate the dataset required for intrusion detection using the hVAE generative model. The original training dataset is divided into a first training set and a test set. The first training set is used to train the first intrusion detection model. The hVAE generative model is used to generate the dataset required for intrusion detection and then trained to obtain a second intrusion detection model. The test set is input into the first intrusion detection model and the second intrusion detection model for detection, and the detection results are output respectively. Calculate the detection error between the outputs of the two intrusion detection models. When the error value is greater than the threshold, randomly select t samples from the original training dataset and put them into the dataset required for intrusion detection generated by the hVAE generative model to form a new dataset and train it to obtain a new intrusion detection model. Repeat the above steps until the error value is no greater than the threshold to form the final intrusion detection model, where t > 1.