Network intrusion data classification method and device, electronic equipment and storage medium

Abstract

The application provides a network intrusion data classification method and device, electronic equipment and a storage medium, wherein the network intrusion detection method comprises the following steps: preprocessing collected traffic data to obtain to-be-classified traffic data; inputting the to-be-classified traffic data into a classification detection model pool to obtain initial classification results output by each classification detection model in the classification detection model pool; the classification detection model comprises a first model group, a second model group and a target stacked sparse auto-encoding network model; the first model group comprises N target deep belief network models, and the second model group comprises a target conditional variational autoencoder and a target deep neural network model; and each initial classification result is fused to obtain a target classification result. Through the above method, the accuracy of network intrusion data classification is improved.

Description

Technical Field

[0001] This invention relates to the field of computer technology, and in particular to a method, apparatus, electronic device, and storage medium for classifying network intrusion data. Background Technology

[0002] With the rapid development of technologies such as big data, the Internet and the Internet of Things, increasingly complex network activities have placed higher demands on network system security; among them, network intrusion data classification is a hot research topic in the industry.

[0003] In related technologies, machine learning is typically used to detect and classify network intrusion data. However, modern network intrusions are becoming more complex, distributed, and large-scale. When faced with more intelligent network intrusions, traditional shallow machine learning methods for detecting network intrusion data may encounter issues such as feature imbalance, class imbalance, and unknown network intrusion data. Consequently, traditional shallow machine learning methods may struggle to accurately classify network intrusion data.

[0004] Therefore, improving the accuracy of network intrusion data classification is an urgent problem to be solved. Summary of the Invention

[0005] To address the problems existing in the prior art, embodiments of the present invention provide a method, apparatus, electronic device, and storage medium for classifying network intrusion data.

[0006] This invention provides a method for classifying network intrusion data, comprising:

[0007] The collected traffic data is preprocessed to obtain traffic data to be classified;

[0008] The traffic data to be classified is input into the classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer;

[0009] The initial classification results are then fused to obtain the target classification result.

[0010] Optionally, the step of fusing the initial classification results to obtain the target classification result includes:

[0011] Obtain the classification accuracy and classification recall for each of the classification detection models; the classification accuracy and classification recall are obtained during the training process of the classification detection models.

[0012] For each of the classification detection models, a weight value is determined based on the classification accuracy and the classification recall; the weight value is used to characterize the classification performance of the classification detection model.

[0013] Based on the traffic data to be classified, a focus vector for each of the classification detection models is determined; the focus vector is used to characterize the degree of correlation between the traffic data to be classified and each of the classification detection models.

[0014] The initial classification result, the weight value, and the focus vector of each classification detection model are fused to obtain the target classification result.

[0015] Optionally, the first model group is trained in the following way:

[0016] The traffic data samples are divided using the density peak clustering algorithm to obtain N traffic data sample subsets; each of the traffic data sample subsets corresponds to an initial deep belief network model;

[0017] Each subset of traffic data samples is input into the corresponding initial deep belief network model for training, resulting in N target deep belief network models.

[0018] Optionally, the initial classification results output by the first model group are obtained in the following way:

[0019] The traffic data to be classified is divided using the density peak clustering algorithm to obtain N subsets of traffic data to be classified; each subset of traffic data to be classified corresponds to a target deep belief network model; N is a positive integer;

[0020] Each subset of traffic data to be classified is input into the corresponding target deep belief network model to obtain N first classification results output by the target deep belief network model;

[0021] Based on the traffic data to be classified, a membership coefficient of the traffic data to be classified for each subset of traffic data to be classified is determined; each membership coefficient is used to characterize the degree of association between the traffic data to be classified and each subset of traffic data to be classified.

[0022] The initial classification result is determined based on the N membership coefficients and the N first classification results.

[0023] Optionally, the second model group is trained in the following manner:

[0024] The first traffic data sample is input into the initial conditional variational autoencoder for training to obtain the target conditional variational autoencoder;

[0025] The labels of the target traffic data samples are input into the target conditional variational autoencoder to obtain the target traffic data samples;

[0026] The first traffic data sample and the target traffic data sample are input into the initial deep neural network model for training to obtain the target deep neural network model.

[0027] Optionally, the target stacked sparse autoencoder network model is trained in the following manner:

[0028] Input traffic data samples into the initial stacked sparse autoencoder network model to obtain the parameter set corresponding to the initial stacked sparse autoencoder network model;

[0029] The initial stacked sparse autoencoder network model is trained based on the parameter set until the loss function reaches a preset threshold, thereby obtaining the target stacked sparse autoencoder network model.

[0030] The present invention also provides a network intrusion data classification device, comprising:

[0031] The preprocessing module is used to preprocess the collected traffic data to obtain traffic data to be classified.

[0032] The first input module is used to input the traffic data to be classified into the classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer;

[0033] The fusion module is used to fuse the initial classification results to obtain the target classification result.

[0034] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the network intrusion data classification method as described above.

[0035] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network intrusion data classification method as described above.

[0036] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements the network intrusion data classification method as described above.

[0037] The network intrusion data classification method, apparatus, electronic device, and storage medium provided by this invention, because the first model group in the classification detection model pool includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model; therefore, by inputting the traffic data to be classified into the N target deep belief network models, the traffic data to be classified can be expressed in multiple dimensions. When the traffic data to be classified has high dimensionality or a large number of features, the false negative rate and false positive rate of the traffic data to be classified are reduced, thereby avoiding the problem of feature imbalance; inputting the traffic data to be classified into the target conditional variational autoencoder in the second model group can expand the number of traffic data samples of a specified category, based on... The target deep neural network model trained on expanded traffic data samples achieves higher classification accuracy, thus avoiding class imbalance and improving the accuracy of classifying traffic data. By inputting the traffic to be classified into the target stacked sparse autoencoder network model, multi-level feature attribute representation and learning are performed on the traffic data of unknown types. This efficiently extracts features from various types of traffic data, enabling the identification of unknown types of traffic data and avoiding the problem of intrusion detection of unknown categories. Furthermore, the initial classification results output from each classification detection model in the pool are fused to further improve the accuracy of network intrusion data classification. Attached Figure Description

[0038] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0039] Figure 1 This is a flowchart illustrating the network intrusion data classification method provided by the present invention;

[0040] Figure 2 This is a schematic diagram illustrating the process by which the first model group provided by the present invention outputs the initial classification results;

[0041] Figure 3 This is a schematic diagram illustrating the process of classifying traffic data provided by the present invention;

[0042] Figure 4 This is a schematic diagram of the network intrusion data classification device provided by the present invention;

[0043] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0044] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0045] To facilitate a clearer understanding of the various embodiments of this application, some relevant background knowledge will be introduced as follows.

[0046] Modern network intrusions are evolving towards greater complexity, distribution, and scale. Their difficulty in measurement and understanding renders traditional passive network security defenses ineffective, placing higher demands on the proactive defense capabilities of network security systems. Currently, facing increasingly intelligent network intrusions, intrusion detection methods based on traditional shallow machine learning mainly suffer from the following problems:

[0047] (1) Feature imbalance problem: Traditional shallow machine learning methods are often based on manual feature partitioning based on existing knowledge. This method cannot efficiently represent intrusion information with abnormal feature dimensions and data volume through manual partitioning and selection of features, which reduces the detection performance of the system and results in a high false negative rate and a high false positive rate for intrusion data with high-dimensional features or a large number of features, and low classification accuracy.

[0048] (2) Class Imbalance Problem: In real-world intrusion detection scenarios, intrusion systems aim for high detection accuracy for intrusions with small sample sizes. However, due to the significantly larger proportion of normal traffic than abnormal traffic in network traffic data, a severe class imbalance problem exists in the training samples. Models trained on such imbalanced training sets often exhibit better fit to the categories with more samples, thus tending to classify network intrusions as belonging to the category with more samples, leading to overfitting and poor model performance, making it unable to effectively identify intrusion types with small sample sizes.

[0049] (3) Unknown category intrusion detection problem: Traditional machine learning methods train models based on existing intrusion training sets and match network intrusions with known intrusion behavior features, which is relatively efficient for the detection and classification of known intrusions. However, various new types of network attacks are emerging one after another, and the types of intrusions are diverse. When facing unknown categories of intrusions, especially the increasing number of malicious attacks based on machine learning, traditional machine learning methods are difficult to cope with.

[0050] In summary, to address the aforementioned problems and improve the accuracy of network intrusion data classification, this invention provides a network intrusion data classification method, apparatus, electronic device, and storage medium.

[0051] The following is combined Figure 1 The network intrusion data classification method provided by this invention will be described in detail. Figure 1 This is a flowchart illustrating the network intrusion data classification method provided by the present invention. See [link / reference]. Figure 1 As shown, the method includes steps 101-103, wherein:

[0052] Step 101: Preprocess the collected traffic data to obtain traffic data to be classified.

[0053] First, it should be noted that the subject of this invention can be any electronic device capable of classifying network intrusion data, such as any smartphone, smartwatch, desktop computer, laptop, etc.

[0054] It is understandable that the quality of network traffic data collection directly determines the performance of network attack detection. Therefore, in one possible implementation of this embodiment, it is necessary to deploy each classification detection model in the classification detection model pool on a network switch or Internet gateway to collect data in order to obtain complete network traffic data.

[0055] After collecting traffic data, it is necessary to preprocess the collected traffic data to obtain traffic data to be classified; the data structure of the traffic data to be classified conforms to the data structure required by deep networks.

[0056] Preprocessing traffic data is achieved through the following steps:

[0057] Step 1: Perform feature mapping on the traffic data.

[0058] Network traffic data consists of digital data and symbolic data. Since deep learning networks only learn from digital data, the traffic data must first be feature-mapped and converted into digital features.

[0059] Specifically, one-hot encoding can be used to encode symbolic features digitally, converting them into more dimensional digital features. For example, the protocol type features “tcp”, “udp”, and “icmp” are mapped to one-hot encodings [0, 0, 1], [0, 1, 0], and [1, 0, 0], respectively.

[0060] Step 2: Normalize the traffic data after feature mapping.

[0061] Since digital features often have certain dimensional differences, in order to reduce the impact of dimensional range differences, it is necessary to normalize the traffic data after feature mapping, mapping it to the range of [0, 1] to obtain the traffic data to be classified; specifically, data normalization is performed using the following formula (1):

[0062]

[0063] Where, x' i This represents traffic data to be categorized; x i x represents the eigenvalues ​​before normalization; max With x min These represent the maximum and minimum values ​​of the eigenvalues ​​before normalization, respectively.

[0064] Step 102: Input the traffic data to be classified into the classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer.

[0065] The classification and detection model pool includes the first model group, the second model group, and the target stacked sparse autoencoder (SSAE) network model.

[0066] The first model group includes N target deep belief network (DBN) models;

[0067] The second model group includes target Conditional Variational Autoencoders (CVAEs) and target Deep Neural Networks (DNNs).

[0068] In this embodiment, after obtaining the traffic data to be classified, the traffic data to be classified is input into each classification detection model (i.e., the first model group, the second model group, and SSAE) to obtain the initial classification results output by the first model group, the second model group, and SSAE, respectively.

[0069] It should be noted that by inputting the traffic data to be classified into N DBN models, the traffic data to be classified can be expressed in multiple dimensions using the DBN models.

[0070] Inputting the traffic data to be classified into CVAE enables CVAE to generate traffic data of the specified category. Using the traffic data of the specified category to train the DNN network can avoid the problem of low classification accuracy of the DNN network due to insufficient data.

[0071] By inputting traffic data to be classified into SSAE, it is possible to identify traffic data of unknown types, thereby avoiding the problem of intrusion detection of unknown categories.

[0072] Step 103: Merge the initial classification results to obtain the target classification result.

[0073] In this embodiment, based on the initial classification results output by multiple parallel classification and detection models, multi-source information fusion classification prediction is performed, and differentiated decision fusion is carried out for the intrusion information features of the traffic data to be classified, so as to realize network intrusion data classification based on cluster decision fusion.

[0074] The network intrusion data classification method provided by this invention, since the first model group in the classification detection model pool includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model; therefore, by inputting the traffic data to be classified into the N target deep belief network models, the traffic data to be classified can be expressed in multiple dimensions. When the traffic data to be classified has high dimensionality or a large number of features, this reduces the false positive and false negative rates, thus avoiding the problem of feature imbalance. Furthermore, by inputting the traffic data to be classified into the target conditional variational autoencoder in the second model group, the number of traffic data samples for a specified category can be expanded. Based on the expanded number of traffic samples... The target deep neural network model trained on the samples achieves higher classification accuracy, thus avoiding the problem of class imbalance and improving the accuracy of classifying traffic data. The traffic to be classified is input into the target stacked sparse autoencoder network model. For traffic data of unknown types, the target stacked sparse autoencoder network model performs multi-level feature attribute representation and learning on the traffic data to be classified, efficiently extracting features of various traffic data to be classified, and realizing the identification of traffic data of unknown types, thereby avoiding the problem of intrusion detection of unknown categories. The initial classification results output by each classification detection model in the classification detection model pool are fused to further improve the classification accuracy of network intrusion data.

[0075] Optionally, the first model group is trained in the following manner, specifically including steps 1) to 2):

[0076] Step 1) Divide the traffic data samples using the density peak clustering algorithm to obtain N traffic data sample subsets; each traffic data sample subset corresponds to an initial deep belief network model;

[0077] Step 2) Input each subset of traffic data samples into the corresponding initial deep belief network model for training to obtain N target deep belief network models.

[0078] To address the issue of excessively large volume and dimensionality of network intrusion data, a combination of density peak clustering algorithm and deep belief network is used to perform feature dimensionality reduction and classification on network intrusion data, which can avoid the problem of feature imbalance.

[0079] In this embodiment, after preprocessing the collected traffic data to obtain the traffic data to be classified, the density peak clustering algorithm is used to divide the traffic data samples to obtain N traffic data sample subsets.

[0080] Among them, the density peak clustering algorithm is officially called the clustering by fast search and find of density peaks (DPCA).

[0081] Specifically, the traffic data samples are divided using the density peak clustering algorithm, which is achieved through the following steps 1-2:

[0082] Step 1: Calculate the local density of sample points in the flow data sample and the relative distance between sample points in the flow data sample.

[0083] Specifically, the local density of the sample points can be calculated using the following formula (2):

[0084]

[0085] Where, ρ i d represents the local density of a sample point; ij d represents the Euclidean distance between sample point i and sample point j; c This represents the neighborhood cutoff distance of sample point i.

[0086] The relative distance σ between sample points of the traffic data sample i This refers to the minimum distance between sample point i and other sample points with higher density; before calculating sample point i, it is necessary to calculate the local density ρ of each sample point. i Sort them.

[0087] For the sample points with the highest density, the relative distance σ i This can be expressed by the following formula (3):

[0088]

[0089] For the remaining sample points, the relative distance σi This can be expressed by the following formula (4):

[0090]

[0091] Step 2, output with local density ρ i The horizontal axis represents the relative distance σ. i The decision graph is plotted with ρ as the vertical axis. Using the decision graph, ρ... i and σ i Points with relatively high values ​​are marked as cluster centers; ρ i Relatively low, but σ i Points with relatively high density are marked as noise points; the remaining sample points are then assigned to the cluster containing its nearest neighbor sample point with a higher density, thereby dividing the traffic data sample into N traffic data sample subsets (clusters).

[0092] After obtaining N traffic data sample subsets, each traffic data sample subset can be input into the corresponding initial DBN model for training, resulting in N trained target DBN models.

[0093] Specifically, the parameters of the DBN model are first initialized through unsupervised pre-training, and then supervised training is performed on the N initial DBN models from back to front based on the N traffic data sample subsets that have been clustered.

[0094] It should be noted that the DBN model is composed of multiple Boltzmann machines stacked on top of each other, with the last layer being a classifier. Each DBN model contains three hidden layers, which learn abstract features from the training data and automatically extract high-level features, achieving automatic feature selection and dimensionality reduction.

[0095] Optionally, in practical applications, the traffic data to be classified is input into the first model group to obtain the initial classification results output by the first model group, which is specifically achieved through the following steps a-d:

[0096] Step a: Divide the traffic data to be classified into N subsets using the density peak clustering algorithm; each subset of traffic data to be classified corresponds to a target deep belief network model; N is a positive integer.

[0097] Step b: Input each subset of traffic data to be classified into the corresponding target deep belief network model to obtain N first classification results output by the target deep belief network model.

[0098] Step c: Based on the traffic data to be classified, determine the membership coefficient of the traffic data to be classified for each subset of traffic data to be classified; each membership coefficient is used to characterize the degree of association between the traffic data to be classified and each subset of traffic data to be classified.

[0099] Step d: Determine the initial classification result based on the N membership coefficients and the N first classification results.

[0100] In this embodiment, the density peak clustering algorithm (DPCA) is first used to divide the traffic data to be classified into N subsets of traffic data to be classified. It should be noted that the method of dividing the traffic data to be classified here is similar to the method of dividing the traffic data samples mentioned above, and will not be repeated here.

[0101] After obtaining N subsets of traffic data to be classified, each subset needs to be input into the corresponding target DBN model to obtain N first classification results output by the N target DBN models.

[0102] For example, for traffic data x1 in the subset 1 of traffic data to be classified, the first classification result output by the first target DBN model is: x1 belongs to intrusion type A; the first classification result output by the second target DBN model is: x1 belongs to intrusion type A; the first classification result output by the third target DBN model is: x1 belongs to intrusion type B.

[0103] At the same time, it is also necessary to determine the membership coefficient of the traffic data to be classified for each subset of traffic data based on the traffic data to be classified, which is specifically calculated by the following formulas (5) and (6):

[0104]

[0105]

[0106] Where, μ i K(c) represents the membership coefficient of the i-th subset of traffic data to be classified; N represents the number of subsets of traffic data to be classified; i (x) represents the Gaussian kernel function; d i c i The nuclear distance between x and the projection of x onto the nuclear space.

[0107] Using the above formulas (5) and (5), we can obtain the membership matrix of each subset of traffic data to be classified: U = {μ i |i=1,2,...,N}.

[0108] After obtaining the membership matrix U and N first classification results, the first classification results of the N target DBN models are fused based on the membership matrix U to obtain the initial classification results output by the first model group, which is specifically represented by the following formula (7):

[0109]

[0110] Where Z represents the initial classification result output by the first model group; DBN i (x) represents the first classification result of the i-th target DBN model.

[0111] The following is combined Figure 2 The process of outputting the initial classification results for the first model group is further explained; Figure 2 This is a schematic diagram illustrating the process of the first model group providing the present invention outputting the initial classification results.

[0112] Step 1: Divide the network intrusion data (i.e., the traffic data to be classified mentioned above) based on the DPCA algorithm to obtain N cluster data (i.e., the N subsets of traffic data to be classified mentioned above).

[0113] Step 2: Input the N clustering data into the N DBN models respectively, and obtain the first classification result output by the N DBN models.

[0114] Step 3: Based on the intrusion data, determine the membership matrix U of the intrusion data for each cluster data.

[0115] Step 4: Based on the first classification results and the subordinate matrix U, perform decision fusion to obtain the initial classification results of the first model group.

[0116] In the above implementation, to address the problem of excessively large volume and dimensionality of network intrusion data, a combination of density peak clustering algorithm and target deep belief network is used to perform feature dimensionality reduction and classification of traffic data to be classified. This enables multi-dimensional feature representation of the traffic data to be classified. When the traffic data to be classified has high dimensionality or a large number of features, the false negative rate and false positive rate of the traffic data to be classified are reduced, thereby avoiding the problem of feature imbalance and improving the accuracy of network intrusion data classification.

[0117] Optionally, the second model group is trained in the following manner, specifically including steps [1]-[3]:

[0118] Step [1]: Input the first flow data sample into the initial conditional variational autoencoder for training to obtain the target conditional variational autoencoder;

[0119] Step [2]: Input the label of the target traffic data sample into the target conditional variational autoencoder to obtain the target traffic data sample;

[0120] Step [3]: Input the first traffic data sample and the target traffic data sample into the initial deep neural network model for training to obtain the target deep neural network model.

[0121] In this embodiment, in order to solve the problem of imbalanced traffic data sample categories, the first traffic data sample needs to be input into the initial CVAE for training until the loss function corresponding to the CVAE is minimized, and the trained target CVAE is obtained; wherein, the first traffic data sample includes network intrusion data samples of at least one category.

[0122] The loss function corresponding to CVAE is expressed by the following formula (8):

[0123]

[0124] in, This represents the loss function corresponding to CVAE; -KL(q) φ (z|x,y)||pθ(x|z,y)) represents the KL distance, used to quantize and optimize the difference in distribution between the input vector qφ(z|x,y) and the decoder output vector of the CVAE; E qφ(z|x,y [logpθ(y|x,z)] represents the logarithmic reconstruction likelihood; logpθ(y|x) represents the conditional likelihood function.

[0125] After training to obtain the target CVAE, the labels of the target traffic data samples need to be input into the target CVAE to obtain the target traffic data samples; it should be noted that the target traffic data samples are the data samples that are expected to be generated.

[0126] Specifically, select the labels for the target traffic data samples to be generated. Input a pre-trained target CVAE and generate a labeled CVAE. Target traffic data sample

[0127] Then generate new target traffic data samples The samples are incorporated into the network intrusion data training set to achieve sample class balance, that is, the number of samples in each class is equal.

[0128] Finally, the first traffic data sample and the target traffic data sample are input into the initial DNN model for training to obtain the target DNN model.

[0129] In the above implementation, to address the problem of imbalanced traffic data sample classes, a trained conditional variational autoencoder (CDAE) is used to specify the intrusion class, generating target traffic data samples of a designated minority class. This balances the dataset, avoids misjudgments of few-shot attacks, and increases sample diversity. Furthermore, as a supervised learning method, the CDAE incorporates the labels of the target traffic data samples into the training data for concatenation, serving as the input vector for the target CDAE. The concatenation of labels and latent variables can be used as input data for the decoder to generate class-specific data, thereby achieving efficient classification of few-shot intrusions.

[0130] Optionally, the target stacked sparse autoencoder network model is trained in the following manner, specifically including steps [a]-[b]:

[0131] Step [a]: Input the traffic data sample into the initial stacked sparse autoencoder network model to obtain the parameter set corresponding to the initial stacked sparse autoencoder network model;

[0132] Step [b]: Train the initial stacked sparse autoencoder network model based on the parameter set until the loss function reaches a preset threshold to obtain the target stacked sparse autoencoder network model.

[0133] In this embodiment, the traffic data samples are first input into the initial SSAE model for parameter pre-training to obtain the parameter set corresponding to the initial SSAE model; wherein, the initial SSAE model includes a softmax layer, which is used to classify the output of the initial SSAE model.

[0134] Specifically, each autoencoder in the initial SSAE model is pre-trained unsupervised. Traffic data samples are used as input to train the parameters of the first autoencoder in the initial SSAE model. The loss function is fitted to obtain the initial parameters θ1={W1,b1} of the first autoencoder. The loss function is the cross-entropy function, which is specifically expressed by the following formula (9):

[0135]

[0136] Where L(x,y) represents the cross-entropy loss function; m represents the number of elements in each traffic data sample; x i y i These represent the i-th element of the input and output traffic data samples, respectively.

[0137] The input to the next autoencoder is the output of the hidden layer of the previous autoencoder. The autoencoders are trained layer by layer to obtain the parameter set θ = {W, b} corresponding to the initial SSAE model. The output of the initial SSAE model is the output of the hidden layer of the last autoencoder.

[0138] Then, the initial SSAE model is trained based on the parameter set θ={W,b} until the loss function reaches a preset threshold to obtain the target SSAE; whereby the loss function is expressed by the following formula (10):

[0139]

[0140] Where β represents the sparse penalty weight factor; k represents the number of neurons in the hidden layer; and ρ represents the sparse parameter. ρ represents the average activation of hidden node j; KL distance between This can be expressed by the following formula (11):

[0141]

[0142] To penalize high activation, ρ is taken as a constant close to 0. When ρ and When the difference is large, that is, when the average activation level is large, Larger, of which This can be expressed by the following formula (12):

[0143]

[0144] Where m is the number of input layer nodes, ρ j,r For vector x i The activation level of the j-th node in the r-th layer.

[0145] After obtaining the target SSAE model, in practical applications, the traffic data to be classified needs to be input into the target SSAE model for detection and classification to obtain the classification results based on the target SSAE and the softmax layer output.

[0146] In the above implementation, for traffic data to be classified with unknown intrusion types, an unsupervised sparse stacked autoencoder model is used to perform multi-level feature attribute representation and learning on the traffic data to be classified, efficiently extracting various nonlinear intrusion data features, and classifying them based on a softmax classifier, thereby achieving intrusion detection that does not depend on known intrusion categories. It should be noted that, in order to avoid feature redundancy and overfitting, sparsity constraints are added to the sparse stacked autoencoder model, which aims to suppress the activity of some hidden layer neurons, so that the sparse stacked autoencoder model can express data features more efficiently.

[0147] Optionally, the process of fusing the initial classification results to obtain the target classification result is specifically achieved through the following steps [1]-[4]:

[0148] Step [1]: Obtain the classification accuracy and classification recall corresponding to each of the classification detection models; the classification accuracy and the classification recall are obtained during the training of the classification detection models;

[0149] Step [2]: For each of the classification detection models, determine the weight value corresponding to the classification detection model based on the classification accuracy and the classification recall; the weight value is used to characterize the classification effect of the classification detection model;

[0150] Step [3]: Based on the traffic data to be classified, determine the focus vector of the traffic data to be classified for each of the classification detection models; the focus vector is used to characterize the degree of correlation between the traffic data to be classified and each of the classification detection models;

[0151] Step [4]: ​​The initial classification result, the weight value and the focus vector of each classification detection model are fused to obtain the target classification result.

[0152] In this embodiment, the weights w of each classification detection model are first initialized. i =0, i∈{1,2,3}.

[0153] Then, during the training of each classification detection model, the classification accuracy and recall of each model are obtained; based on the classification accuracy and recall, the weights w are adjusted. i The decision weights are updated iteratively to learn and determine the weight values ​​corresponding to the classification detection model. Specifically, the weights are calculated using the following formula (13). The Fbeta-measure index is used to measure the classification performance of each classification detection model.

[0154]

[0155] Among them, w i β represents the weight value corresponding to the i-th classification detection model; R represents the classification recall; P represents the classification accuracy; since intrusion detection tends to reduce intrusion false negatives, the parameter β is set to 2.

[0156] After determining the weight values ​​corresponding to each classification detection model, it is also necessary to normalize the weight values ​​corresponding to each classification detection model, which is expressed by the following formula (14):

[0157]

[0158] While normalizing the weight values ​​corresponding to each classification detection model, it is also necessary to determine the focus vector of the traffic data to be classified for each classification detection model based on the traffic data to be classified, which is specifically expressed by the following formulas (15)-(17):

[0159]

[0160]

[0161]

[0162] Wherein, γ1, γ2, and γ3 represent the focus vectors of the traffic data to be classified for the first model group, the second model group, and the target stacked sparse autoencoder network model, respectively; represents the baseline for the number of samples in the network traffic data sample set and the number of samples in each category, respectively; d and n represent the number of traffic data dimensions to be classified and the number of samples predicted by the second model group, respectively; α is the unknown coefficient for the category, and w max For w i The maximum value in.

[0163] Finally, the initial classification results, weight values, and focus vectors of each classification detection model are fused to obtain the target classification result, which is specifically calculated using the following formula (18):

[0164]

[0165] Where y represents the target classification result; γ i w represents the i-th focus vector; i P represents the weight value corresponding to the i-th classification and detection model; ij (x) represents the initial classification result output by the classification detection model.

[0166] In the above implementation, the initial classification results output by each classification detection model in the classification detection model pool are fused, and weights are allocated according to the data characteristics of the traffic data to be classified. The decisions of each classification detection model are efficiently fused, and differentiated decisions are made for traffic data of different feature types to be classified, maximizing the decision tendency of the corresponding feature type, thereby further improving the accuracy of network intrusion data classification.

[0167] To more clearly understand the network intrusion data classification method provided by this invention, the following will be combined with... Figure 3 Let's take the classification of collected traffic data as an example for further explanation; Figure 3 This is a schematic diagram of the process of classifying traffic data provided by the present invention, including steps 1-6:

[0168] Step 1: Collect network traffic data.

[0169] Step 2: Preprocess the collected traffic data to obtain traffic data to be classified.

[0170] Step 3: Input the traffic data to be classified into the classification detection model pool to obtain the prediction result 1 output by the first model group, the prediction result 2 output by the second model group, and the prediction result 3 output by the SSAE model.

[0171] It should be noted that the first model group includes N DBN models; the second model group includes CVAE and DNN; and the SSAE model includes a softmax layer.

[0172] Step 4: For each classification detection model in the classification detection model pool, perform weight learning based on classification accuracy and classification recall to determine the corresponding weight value for each classification detection model.

[0173] Step 5: Based on the traffic data to be classified, determine the focus vector of the traffic data to be classified for each classification detection model.

[0174] Step 6: Fuse the prediction results, weight values, and focus vectors of each classification detection model (i.e., cluster decision fusion) to obtain the target classification result.

[0175] The network intrusion data classification device provided by the present invention is described below. The network intrusion data classification device described below can be referred to in correspondence with the network intrusion data classification method described above. Figure 4 This is a schematic diagram of the network intrusion data classification device provided by the present invention, as shown below. Figure 4 As shown, the network intrusion data classification device 400 includes: a preprocessing module 401, a first input module 402, and a fusion module 403, wherein:

[0176] The preprocessing module 401 is used to preprocess the collected traffic data to obtain traffic data to be classified.

[0177] The first input module 402 is used to input the traffic data to be classified into the classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer;

[0178] The fusion module 403 is used to fuse the initial classification results to obtain the target classification result.

[0179] The network intrusion data classification device provided by this invention, because the first model group in the classification detection model pool includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model; therefore, by inputting the traffic data to be classified into the N target deep belief network models, the traffic data to be classified can be expressed in multiple dimensions. When the traffic data to be classified has high dimensionality or a large number of features, the false negative rate and false positive rate of the traffic data to be classified are reduced, thereby avoiding the problem of feature imbalance. Inputting the traffic data to be classified into the target conditional variational autoencoder in the second model group can expand the number of traffic data samples for a specified category, based on the expanded number of traffic samples... The target deep neural network model trained on the samples achieves higher classification accuracy, thus avoiding the problem of class imbalance and improving the accuracy of classifying traffic data. The traffic to be classified is input into the target stacked sparse autoencoder network model. For traffic data of unknown types, the target stacked sparse autoencoder network model performs multi-level feature attribute representation and learning on the traffic data to be classified, efficiently extracting features of various traffic data to be classified, and realizing the identification of traffic data of unknown types, thereby avoiding the problem of intrusion detection of unknown categories. The initial classification results output by each classification detection model in the classification detection model pool are fused to further improve the accuracy of network intrusion data classification.

[0180] Optionally, the fusion module 403 is further configured to:

[0181] Obtain the classification accuracy and classification recall for each of the classification detection models; the classification accuracy and classification recall are obtained during the training process of the classification detection models.

[0182] For each of the classification detection models, a weight value is determined based on the classification accuracy and the classification recall; the weight value is used to characterize the classification performance of the classification detection model.

[0183] Based on the traffic data to be classified, a focus vector for each of the classification detection models is determined; the focus vector is used to characterize the degree of correlation between the traffic data to be classified and each of the classification detection models.

[0184] The initial classification result, the weight value, and the focus vector of each classification detection model are fused to obtain the target classification result.

[0185] Optionally, the device further includes:

[0186] The first partitioning module is used to partition the traffic data samples using the density peak clustering algorithm to obtain N traffic data sample subsets; each of the traffic data sample subsets corresponds to an initial deep belief network model;

[0187] The first training module is used to input each subset of traffic data samples into the corresponding initial deep belief network model for training, thereby obtaining N target deep belief network models.

[0188] Optionally, the device further includes:

[0189] The second partitioning module is used to partition the traffic data to be classified using the density peak clustering algorithm to obtain N subsets of traffic data to be classified; each subset of traffic data to be classified corresponds to a target deep belief network model; N is a positive integer;

[0190] The second input module is used to input each subset of traffic data to be classified into the corresponding target deep belief network model to obtain N first classification results output by the target deep belief network model.

[0191] The first determining module is used to determine, based on the traffic data to be classified, the membership coefficient of the traffic data to be classified for each subset of traffic data to be classified; each membership coefficient is used to characterize the degree of association between the traffic data to be classified and each subset of traffic data to be classified;

[0192] The second determining module is used to determine the initial classification result based on the N membership coefficients and the N first classification results.

[0193] Optionally, the device further includes:

[0194] The second training module is used to input the first traffic data sample into the initial conditional variational autoencoder for training, and obtain the target conditional variational autoencoder.

[0195] The third input module is used to input the label of the target traffic data sample into the target conditional variational autoencoder to obtain the target traffic data sample;

[0196] The third training module is used to input the first traffic data sample and the target traffic data sample into the initial deep neural network model for training, so as to obtain the target deep neural network model.

[0197] Optionally, the device further includes:

[0198] The fourth input module is used to input traffic data samples into the initial stacked sparse autoencoder network model to obtain the parameter set corresponding to the initial stacked sparse autoencoder network model.

[0199] The fourth training module is used to train the initial stacked sparse autoencoder network model based on the parameter set until the loss function reaches a preset threshold, thereby obtaining the target stacked sparse autoencoder network model.

[0200] Figure 5 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 5 As shown, the electronic device may include: a processor 510, a communication interface 520, a memory 530, and a communication bus 540, wherein the processor 510, the communication interface 520, and the memory 530 communicate with each other through the communication bus 540. The processor 510 can call logical instructions in the memory 530 to execute a network intrusion data classification method. The method includes: preprocessing the collected traffic data to obtain traffic data to be classified; inputting the traffic data to be classified into a classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group, and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer; and fusing the initial classification results to obtain the target classification result.

[0201] Furthermore, the logical instructions in the aforementioned memory 530 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0202] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the network intrusion data classification method provided by the above methods. The method includes: preprocessing the collected traffic data to obtain traffic data to be classified; inputting the traffic data to be classified into a classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group, and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer; and fusing the initial classification results to obtain the target classification result.

[0203] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements a network intrusion data classification method provided by the above methods. The method includes: preprocessing collected traffic data to obtain traffic data to be classified; inputting the traffic data to be classified into a classification detection model pool to obtain initial classification results output by each classification detection model in the classification detection model pool; the classification detection model includes a first model group, a second model group, and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer; and fusing the initial classification results to obtain a target classification result.

[0204] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0205] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0206] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for classifying network intrusion data, characterized in that, include: The collected traffic data is preprocessed to obtain traffic data to be classified; The traffic data to be classified is input into the classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; The classification and detection model includes a first model group, a second model group, and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer. Obtain the classification accuracy and classification recall for each of the classification detection models; the classification accuracy and classification recall are obtained during the training process of the classification detection models. For each of the classification detection models, a weight value corresponding to the classification detection model is determined based on the classification accuracy and the classification recall. The weight values ​​are used to characterize the classification performance of the classification detection model; Based on the traffic data to be classified, a focus vector is determined for each of the classification detection models. The focus vector is used to characterize the degree of correlation between the traffic data to be classified and each of the classification detection models. The focus vector of the first model group is determined based on the logarithm of the ratio of the dimension of the traffic data to be classified to the dimension of the network traffic data sample set. The focus vector of the second model group is determined based on the logarithm of the ratio of the number of predicted category samples to the baseline number of category samples in the second model group. The focus vector of the target stacked sparse autoencoder network model is determined based on the logarithm of the ratio of the maximum weight value corresponding to the classification detection model to the sum of the weight values ​​corresponding to all classification detection models. The initial classification result, the weight value, and the focus vector of each classification detection model are fused to obtain the target classification result.

2. The network intrusion data classification method according to claim 1, characterized in that, The first model group was trained in the following way: The traffic data samples are divided using the density peak clustering algorithm to obtain N traffic data sample subsets; each of the traffic data sample subsets corresponds to an initial deep belief network model; Each subset of traffic data samples is input into the corresponding initial deep belief network model for training, resulting in N target deep belief network models.

3. The network intrusion data classification method according to claim 1, characterized in that, The initial classification results output by the first model group are obtained in the following way: The traffic data to be classified is divided using the density peak clustering algorithm to obtain N subsets of traffic data to be classified; Each subset of traffic data to be classified corresponds to one target deep belief network model; N is a positive integer; Each subset of traffic data to be classified is input into the corresponding target deep belief network model to obtain N first classification results output by the target deep belief network model; Based on the traffic data to be classified, determine the membership coefficient of the traffic data to be classified for each subset of the traffic data to be classified; Each of the aforementioned membership coefficients is used to characterize the degree of association between the traffic data to be classified and each of the aforementioned subsets of traffic data to be classified; The initial classification result is determined based on the N membership coefficients and the N first classification results.

4. The network intrusion data classification method according to claim 1, characterized in that, The second model group was trained in the following way: The first traffic data sample is input into the initial conditional variational autoencoder for training to obtain the target conditional variational autoencoder; The labels of the target traffic data samples are input into the target conditional variational autoencoder to obtain the target traffic data samples; The first traffic data sample and the target traffic data sample are input into the initial deep neural network model for training to obtain the target deep neural network model.

5. The network intrusion data classification method according to claim 1, characterized in that, The target stacked sparse autoencoder network model is trained in the following way: Input traffic data samples into the initial stacked sparse autoencoder network model to obtain the parameter set corresponding to the initial stacked sparse autoencoder network model; The initial stacked sparse autoencoder network model is trained based on the parameter set until the loss function reaches a preset threshold, thereby obtaining the target stacked sparse autoencoder network model.

6. A network intrusion data classification device, characterized in that, include: The preprocessing module is used to preprocess the collected traffic data to obtain traffic data to be classified. The first input module is used to input the traffic data to be classified into the classification detection model pool to obtain the initial classification results output by each classification detection model in the classification detection model pool; The classification and detection model includes a first model group, a second model group, and a target stacked sparse autoencoder network model; the first model group includes N target deep belief network models, and the second model group includes a target conditional variational autoencoder and a target deep neural network model, where N is a positive integer. The fusion module is used to obtain the classification accuracy and classification recall corresponding to each of the classification detection models; the classification accuracy and the classification recall are obtained during the training process of the classification detection models; for each of the classification detection models, a weight value corresponding to the classification detection model is determined based on the classification accuracy and the classification recall; the weight value is used to characterize the classification performance of the classification detection model; Based on the traffic data to be classified, a focus vector is determined for each of the classification detection models. The focus vector is used to characterize the degree of correlation between the traffic data to be classified and each of the classification detection models. The focus vector of the first model group is determined based on the logarithm of the ratio of the dimension of the traffic data to be classified to the dimension of the network traffic data sample set. The focus vector of the second model group is determined based on the logarithm of the ratio of the number of predicted category samples to the baseline number of category samples in the second model group. The focus vector of the target stacked sparse autoencoder network model is determined based on the logarithm of the ratio of the maximum weight value corresponding to the classification detection model to the sum of the weight values ​​corresponding to all classification detection models. The initial classification result, the weight value, and the focus vector of each classification detection model are fused to obtain the target classification result.

7. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the network intrusion data classification method as described in any one of claims 1 to 5.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the network intrusion data classification method as described in any one of claims 1 to 5.

9. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the network intrusion data classification method as described in any one of claims 1 to 5.

Images