An intrusion detection method based on information entropy theory combined with convolutional neural network

Abstract

The application discloses an intrusion detection method based on information entropy theory and a convolutional neural network, which comprises the following steps: firstly, converting character type data into numerical type data, data standardization and data normalization operation are performed on a data set; then, the data set is put into a convolutional neural network for dimension reduction and classification, and information entropy uncertainty calculation is combined to perform delayed relearning classification decision on part of the data, and a random forest method is selected as the delayed decision method; when an intrusion behavior occurs, a trained model can be used to distinguish normal data and attack data. The application utilizes the characteristics that the convolutional neural network has better feature extraction capability and classification learning effect, and combines information entropy theory to evaluate the classified data, and the evaluation result is used as the basis for secondary learning classification decision, so that the method can avoid the risk of misclassification caused by insufficient information extraction as much as possible, and the performance of intrusion detection is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to an intrusion detection method based on information entropy theory combined with convolutional neural network, belonging to the technical field of intrusion detection in network. BACKGROUND

[0002] In recent years, with the continuous evolution of network technology and the continuous expansion of network scale, network security incidents occur frequently at home and abroad, and network security problems have been paid more attention to. Therefore, the research on intrusion detection system has become an important content of the current network security development. The research on intrusion detection system is to make up for the deficiency of traditional firewall internal attack defense and to strengthen the monitoring of the running status of network and system, to discover various attack attempts, attack behaviors or attack results as much as possible to protect the confidentiality, integrity and availability of network system resources. The intrusion detection system has experienced decades of development and has achieved certain results, but there is still a lot of space for the research on intrusion detection system.

[0003] The traditional intrusion detection system still has some problems, specifically: it cannot independently investigate and distinguish attack behaviors, the response is not timely enough when facing large-scale detection data, and the signature database needs to be updated in real time. The above problems will lead to low accuracy of detecting data flow and relatively high false positive rate when the system detects. There is no better way to divide when facing unknown abnormal flow, and it lacks autonomous learning ability. SUMMARY

[0004] In order to make up for the deficiencies of the prior art, the present application provides an intrusion detection method based on information entropy theory combined with convolutional neural network. The excellent performance of feature extraction and classification of convolutional neural network improves the detection accuracy, and the information entropy theory is introduced as a secondary judgment to reduce the occurrence of misjudgment and reduce the false positive rate, so as to solve the problems mentioned in the background art.

[0005] In order to achieve the above purpose, the present application provides the following technical scheme: an intrusion detection method based on information entropy theory combined with convolutional neural network, the specific steps are as follows:

[0006] Step 1: obtain training data set and test data set from data set, and pre-process data set;

[0007] Step 2: the training set after data preprocessing is transmitted into the network model for training, and a trained network model is obtained;

[0008] Step 3: the probability distribution and confidence of data are obtained through the convolutional neural network model, and the information entropy value is calculated through the information entropy theory for evaluation;

[0009] Fourth step: data with entropy value less than the threshold value is directly outputted by the convolutional neural network to obtain the classification result, and data with entropy value greater than the threshold value is classified again after learning by the random forest model.

[0010] Fifth step: the test set after data preprocessing is transmitted into the trained network model to obtain the classification result.

[0011] As a preferred solution, the first step of data preprocessing of the intrusion detection data set is specifically as follows:

[0012] (1) Since some features in the intrusion detection data set are character type data, the character type data needs to be converted into numerical type data;

[0013] (2) In order to reduce the influence of high data dispersion and numerical size in the features on the model, the converted numerical type data needs to be standardized;

[0014] (3) In order to reduce the calculation amount of the model, the data after standardization is normalized, so that the data is mapped to interval.

[0015] As a preferred solution, the second step of training the network data after processing on the network model to obtain the trained network model is specifically as follows:

[0016] (1) forward calculation of the output value of each neuron;

[0017] (2) determine the optimization objective function;

[0018] (3) according to the gradient of the loss function of the convolutional neural network, update the network weight parameters by forward and backward propagation;

[0019] (4) repeat the above three steps until the network error is less than a given value, and determine the optimal convolutional neural network model.

[0020] As a preferred solution, the third step of obtaining the probability distribution and confidence of the data is specifically as follows:

[0021] (1) calculate the entropy value of the probability distribution output by the convolutional neural network through the information entropy theory;

[0022] (2) compare the entropy value with the threshold value to divide the data that needs to be classified again.

[0023] As a preferred solution, the fourth step of directly outputting the classification result of the data with entropy value less than the threshold value by the convolutional neural network, and classifying the data with entropy value greater than the threshold value again after learning by the random forest model is specifically as follows:

[0024] (1) the data category output by the convolutional neural network is less than a threshold value, and the random forest further learns to divide the data higher than the threshold value;

[0025] (2) the rate of uncertain samples when statistically classifying;

[0026] (3) the first classification result and the second learning classification result are combined and output.

[0027] As a preferred scheme, the specific process of passing the test set after data preprocessing into the trained network model to obtain the classification result is as follows:

[0028] (1) the intrusion detection model is parameterized by the training set, and the optimal intrusion detection model is obtained when the rate of uncertain samples in the secondary classification reaches the minimum through the adjustment of the threshold value;

[0029] (2) the test set is input to test the intrusion detection model, and the final classification result is obtained.

[0030] Compared with the prior art, the present application provides an intrusion detection method based on information entropy theory combined with a convolutional neural network, which has the following beneficial effects:

[0031] The present application uses a deep learning effective algorithm, convolutional neural network, to face large data scale feature extraction and excellent classification ability, and applies it to intrusion detection to improve the accuracy of intrusion detection. By combining the information entropy theory, the confidence of the convolutional neural network classification is further evaluated and divided. The data type with high uncertainty of the entropy value is relearned to reduce the false positive rate of intrusion detection. And further improve the overall intrusion detection performance. BRIEF DESCRIPTION OF DRAWINGS

[0032] Figure 1 is the method flowchart in the present application;

[0033] Figure 2 is the CNN model classification method diagram;

[0034] Figure 3 is the RF model classification method diagram. DETAILED DESCRIPTION

[0035] In order to have a clearer understanding of the technical features, objectives and effects of the present application, the specific embodiments of the present application will be described with reference to the drawings.

[0036] As Figure 1 shown, the specific steps of the intrusion detection method based on information entropy theory combined with a convolutional neural network are as follows:

[0037] Step 1: data preprocessing is performed on the intrusion detection data set;

[0038] Data preprocessing consists of three steps:

[0039] 1) Convert character data to numeric data

[0040] Since some features in the intrusion detection dataset are character-based data, while convolutional neural networks can only process numerical data, the character-based data in the dataset is first converted into numerical data.

[0041] 2) Data standardization

[0042] To reduce the impact of high data dispersion and numerical value on the convolutional neural network, the converted numerical data is standardized. First, the mean and mean absolute error of each feature value are calculated, as shown in the following formula:

[0043]

[0044]

[0045] in, Indicates the first The mean of each attribute, Indicates the first The mean absolute error of each feature Indicates the first The k-th attribute of each record. Then, a standardized metric is applied to each data record, using the following formula:

[0046]

[0047] in, This represents the k-th attribute value of the i-th data record after standardization.

[0048] 3) Data normalization

[0049] The standardized data is then normalized to ensure that the numerical values ​​fall within the range of [0,1], thereby reducing the computational burden on the model. The normalization formula is as follows:

[0050]

[0051] Step Two: As Figure 2 As shown, the data is preprocessed and then fed into a convolutional neural network model for training, resulting in a trained network model.

[0052] Training and optimizing a convolutional neural network involves the following three stages:

[0053] 1) After the pretreated data is convolved, the mapping of the corresponding position is obtained every time a position is traversed, and when the entire feature matrix is traversed, the new feature matrix is formed through the network parameter setting and the activation function. When all the feature samples complete the feature mapping, the stacked combination forms the feature map of the convolution. The convolution calculation formula is as follows:

[0054]

[0055] is the input sample set, is the feature matrix output by the last layer, is the convolution operation, is the current layer, is the convolution kernel, is the bias, is the activation function, and the Relu function is selected as the activation function. Compared with other activation functions, the non-saturation characteristic of the Relu activation function can effectively avoid the gradient disappearance phenomenon.

[0056] 2) The features output by the convolution layer are sampled by the pooling layer, and the data features of probability statistics are used to summarize all the features. Not only can the dimension be reduced, but also the most effective information can be retained. The maximum value pooling method is selected in this method. is the feature matrix after the pooling, and the pooling method calculation formula is as follows:

[0057]

[0058] 3) Update the network parameters The convolutional neural network can obtain the original feature output value through the forward propagation, and the network parameters need to be updated through the back propagation. The loss function of the convolutional neural network is:

[0059]

[0060] wherein is the actual value, is the predicted value. The parameter value is updated once every time it is trained. When the network trains the data sample, the weights and the bias are updated in the process of reducing the network loss

[0061]

[0062]

[0063] is the learning rate , is the loss function of the weight and the bias The partial derivative of .

[0064] Step 3: The output layer of the CNN network passes through The activation function yields the probability distribution values ​​of two types of data. Entropy values ​​are calculated using the probability distribution of the obtained data flow, and the data is further screened and evaluated using information entropy theory.

[0065] The data evaluation method is as follows:

[0066] The probability distribution values ​​of the two types of data obtained The formula for calculating information entropy is as follows:

[0067]

[0068] The entropy value represents the information entropy, and also indicates the degree of uncertainty in the data. Since classification results in two data types, therefore... , It represents the probability distribution of two prediction outcomes, or the confidence level of the data for two categories. The output layer of a CNN network... The activation function yields the probability distribution values ​​of two types of data. The probability distribution of all samples is quickly sampled to calculate the uncertainty, and the result reflects the magnitude of the data uncertainty. The formula for calculating information entropy is as follows:

[0069]

[0070] When the categorized data The more evenly the probability distribution is calculated, the better. The larger the value, the higher the uncertainty of the classification sample, and vice versa. The greater the difference in probability values, the lower the uncertainty of the classified samples. This is achieved through... The division can divide the sample into samples with high uncertainty and samples with low uncertainty, and the uncertainty of the data sample can be used as a basis for judgment on delayed classification decisions.

[0071] Step 4: Ensure the entropy value is less than the threshold. The data is directly classified by the convolutional neural network, and data exceeding the threshold will be classified accordingly. Data as Figure 3 The random forest model shown is used to learn and reclassify, and the uncertain sample rate is counted when performing secondary classification.

[0072] Step five: the optimal intrusion detection model is obtained when the secondary classification is uncertain sample rate reaches the minimum by adjusting the threshold, and the test data is input into the trained optimal model to obtain the classification result;

[0073] The application firstly passes through a data preprocessing stage, then transmits the data into a convolutional neural network for classification, calculates the information entropy of the data confidence generated by the CNN, and directly outputs the classification result from the CNN when the entropy value is less than a threshold When the entropy value is greater than the threshold , the random forest model is further classified. The classification results obtained by the two are combined as the common output. The overall performance of the model can be improved, and the risk of model misclassification can be reduced.

[0074] The specific embodiments of the application are described in detail above in combination with the drawings, but the application is not limited to the above embodiments, and various changes can be made within the knowledge of those skilled in the art without departing from the purpose of the application.

Claims

1. An intrusion detection method based on information entropy theory combined with a convolutional neural network, characterized in that, Includes the following steps: S1. Perform data preprocessing on the intrusion detection dataset, converting character features into numerical features, and then performing standardization and normalization on the data in sequence, so that the processed feature data is mapped to the [0,1] interval; S2. Input the preprocessed training data into the convolutional neural network model for training. The training and optimization of the convolutional neural network involves the following three stages: 1) Convolution is performed on the preprocessed data. Each time a position is traversed, a corresponding mapping is obtained. After traversing the entire feature matrix, the activation function, through network parameter settings, forms a new feature matrix. When all feature samples have completed feature mapping, they are stacked and combined to form the feature map of the convolution. The convolution calculation formula is as follows: ； M is an input sample set, is the feature matrix of the output of the previous layer, "*" is the convolution operation, and n is the current layer, is the convolution kernel, is the bias, is the activation function, and the Relu function is selected as the activation function. Compared with other activation functions, the non-saturation characteristic of the Relu activation function can effectively avoid the gradient disappearance phenomenon; 2) The features outputted by the convolutional layer are sampled by the pooling layer, and the data features of probability statistics are used to summarize all features, which can not only reduce the dimension, but also retain the most effective information. In this method, the maximum value pooling method is selected, is the feature matrix after pooling, and the formula for calculating the pooling method is as follows: ; 3) Updating Network Parameters: Convolutional neural networks can obtain the original feature output values ​​through forward propagation, but the network parameters need to be updated through backpropagation. The loss function of a convolutional neural network is: ; where y is the actual value, is the predicted value, the parameter value is updated once per training, and the weight and bias b are updated in the process of reducing the network loss when the network is trained on the data sample The iterative update formula for and the bias b is: ; is the learning rate , is the partial derivative of the loss function with respect to the weights w and biases b; S3. Input the samples to be classified into the trained convolutional neural network model, and output the probability distributions (P1, P2) corresponding to each category through the softmax function. Then, based on the information entropy formula H = −P1log2P1−P2log2P2 Calculate the information entropy value H of the sample prediction result to characterize the uncertainty of the sample classification result; S4. Compare the information entropy value H with a preset threshold θ: When H ≤ θ, the classification result output by the convolutional neural network model is directly used as the final classification result; When H > θ, the corresponding sample is input into the random forest model for secondary classification, and the output of the random forest model is used as the final classification result of the sample. S5. The classification results of the convolutional neural network model and the secondary classification results of the random forest model are fused and output to obtain the final intrusion detection result. 2.The intrusion detection method based on information entropy theory combined with convolutional neural network according to claim 1, characterized in that, The standardization process in step S1 includes: calculating the mean xk and standard deviation Sk of the sample value xik of the k-th feature, and then standardizing it using the following formula: Zik = (xik − xk) / Sk Where Zik is the standardized eigenvalue. 3.The intrusion detection method based on information entropy theory combined with convolutional neural network according to claim 1, characterized in that, The threshold θ in step S4 is determined as follows: the classification results under different thresholds are evaluated based on the training set, and the threshold that minimizes the uncertain sample rate of secondary classification is selected as the optimal threshold θ. 4.The intrusion detection method based on information entropy theory combined with convolutional neural network according to claim 1, characterized in that, The random forest model is trained and classified only for samples whose information entropy value H is greater than the threshold θ, in order to reduce the overall computational load and improve the recognition accuracy of samples with high uncertainty. 5.The intrusion detection method based on information entropy theory combined with convolutional neural network according to claim 1, characterized in that, The final intrusion detection result is composed of the output of the convolutional neural network model and the output of the random forest model. The low uncertainty sample uses the result of the convolutional neural network model, and the high uncertainty sample uses the result of the random forest model.

Images