Feature optimization method and device in power data center network intrusion detection environment

Abstract

The application discloses a feature optimization method and device in a power data center network intrusion detection environment, and belongs to the field of signal processing. The feature optimization method comprises the following steps: encoding the features to be detected into feature subsets through a binary coding mode; then calculating the guide factors and variation probabilities of each feature and performing corresponding variation operations on the features on each feature subset; subsequently, performing a reverse operation on the corresponding features that need to jump out of a local optimum based on the guide factors of the features and performing a crossover strategy on each feature subset, and selecting a plurality of feature subsets with the maximum fitness as the feature candidate set for the next iteration; and finally selecting the feature subset with the maximum fitness after the iteration is terminated as the target feature subset after the final optimization. The feature optimization method and device in the power data center network intrusion detection environment can improve the speed and accuracy of network intrusion detection, and are suitable for network intrusion detection of a power data center.

Description

Technical Field

[0001] This application relates to a feature optimization method and apparatus for intrusion detection in a power data center network environment, belonging to the field of signal processing. Background Technology

[0002] Power cloud data centers face threats from network intrusions such as distributed denial-of-service attacks. Network intrusion detection, as a crucial component of network intrusion prevention, is vital for accurately detecting intrusion activities. Performing network intrusion detection typically involves first capturing network state data, and then calculating feature vectors from various feature values ​​within that data.

[0003] However, since there are many features currently used for network intrusion detection, using all features may affect the speed or accuracy of network intrusion detection. This is because, on the one hand, some features may be redundant, and processing these redundant features may affect the detection speed of the network intrusion detection model. On the other hand, some features may even have side effects on the network intrusion detection model. Using such features for network intrusion detection may reduce the accuracy. Therefore, how to select the optimal feature subset from numerous features to perform network intrusion detection is one of the key issues that needs attention. Summary of the Invention

[0004] The purpose of this application is to provide a feature optimization method and apparatus for a power data center network intrusion detection environment. By calculating the feature set used for power data center network intrusion detection, the method reduces the impact of redundant features and features with side effects on the network intrusion detection model, thereby improving the accuracy and speed of network intrusion detection.

[0005] To achieve the above objectives, the first aspect of this application provides a feature optimization method for intrusion detection in a power data center network environment, comprising:

[0006] S100 acquires several features to be detected and encodes each of the above features to be detected to obtain several feature subsets;

[0007] S200 obtains the frequency of occurrence of each feature contained in each feature subset based on the feature distribution in each feature subset, and calculates the guiding factor of each feature.

[0008] S300 calculates the mutation probability of each feature based on the above guiding factor, and performs corresponding mutation operations on each feature based on the above mutation probability.

[0009] S400 determines whether each feature needs to escape the local optimum based on the above guiding factor. If so, the corresponding feature that needs to escape the local optimum is reversed in each feature subset and step 500 is executed. Otherwise, step S500 is executed directly.

[0010] S500 performs a cross-policy on each feature subset and selects several feature subsets with the highest fitness as feature candidate sets for the next iteration.

[0011] S600 determines whether the iteration has terminated. If so, the feature subset with the maximum fitness is taken as the final optimized target feature subset; otherwise, return to step S200.

[0012] In one implementation, step S100 specifically includes the following steps:

[0013] S110 Assume that the above-mentioned features to be detected are {f1, f2, ..., f...} N}, where f i Let i represent the i-th feature. There are N features in total before feature optimization.

[0014] S120 encodes the aforementioned features to be detected using binary encoding.

[0015] X i ={x i,1 ,x i,2 ,...x i,j ,...,x i,N}, i = 1, 2, ..., M

[0016] Among them, X i Let x represent a feature subset. i,j Indicates whether to include feature f j Included in feature subset X i In the diagram, i indicates whether the corresponding feature appears in the feature subset, and x... i =1 indicates that f is selected. i x i =0 means f is not selected. i .

[0017] In one implementation, step S200 specifically includes the following steps:

[0018] S210 calculates the frequency of each feature in all feature subsets, where, for M feature subsets [X1, X2, ..., X...], ... M ], statistically analyze each feature x -,j The number of times it appears is C -,j ;

[0019] S220 for each feature x -,jThe guiding factor w for each of the above features is calculated using the following formula. -,j :

[0020]

[0021] In one implementation, step S300 specifically includes the following steps:

[0022] S310 calculates the mutation probability of each of the above features using the following formula:

[0023]

[0024] in, This represents the maximum value of the mutation probability for each feature. Indicates the feature x in the previous iteration -,j The probability of mutation, Indicates the feature x in the current iteration -,j The probability of mutation;

[0025] S320 generates random numbers between 0 and 1 for each feature, and determines whether the random numbers for each feature are less than 1. If so, then the corresponding feature is mutated; otherwise, the corresponding feature is not mutated.

[0026] In one implementation, step S400 specifically includes the following steps:

[0027] S410 obtains the guiding factor set as {w} based on the guiding factors of the above features. -,1 ,w -,2 ,...,w -,N} Calculate the mean μ and standard deviation σ of the above set of guiding factors;

[0028] S420 when feature x -,j The guiding factor w -,j <μ-3σ or w -,j When the value is greater than μ+3σ, then the above feature x is determined. -,j It is necessary to break out of local optima and from each feature subset [X1,X2,...,X] M Multiple features x are randomly selected from [the data]. i,j Perform a reversal operation;

[0029] S430 when feature x -,j The guiding factor μ-3σ≤w -,j If ≤μ+3σ, then the above feature x is determined. -,j It is not necessary to escape local optima, and the above feature x is not considered. -,j Perform a reversal operation.

[0030] In one implementation, in step S420, the above-mentioned selection from each feature subset [X1,X2,...,X] M Multiple features x are randomly selected from [the data]. i,j Performing a reversal operation includes:

[0031] If any selected feature subset X i Feature x in i,j If x is 0, then x i,j The value is set to 1; if any selected feature subset X i Feature x in i,j If x is 1, then x i,j The value is set to 0.

[0032] In one implementation, step S500, performing the cross-strategy on each feature subset includes:

[0033] Two feature subsets are randomly selected. If the random number generated by the two feature subsets is less than the feature subset crossover probability, then the crossover position with the same feature in the two feature subsets is randomly selected, and all feature values ​​after the crossover position are swapped between the two feature subsets.

[0034] The second aspect of this application provides a feature optimization device for a power data center network intrusion detection environment, comprising:

[0035] The acquisition module is used to acquire several features to be detected and encode each of the above features to be detected to obtain several feature subsets;

[0036] The calculation module is used to obtain the occurrence frequency of each feature contained in each feature subset based on the feature distribution in each feature subset, and to calculate the guiding factor of each feature.

[0037] The mutation module is used to calculate the mutation probability of each feature based on the above guiding factor, and to perform corresponding mutation operations on each feature based on the mutation probability.

[0038] The inversion module is used to determine whether each feature needs to escape the local optimum based on the above guiding factors. If so, the corresponding feature that needs to escape the local optimum is inverted in each feature subset and the selection module is controlled to execute the corresponding steps. Otherwise, the selection module is directly controlled to execute the corresponding steps.

[0039] The selection module is used to perform cross-policy on each feature subset and select the feature subset with the highest fitness as the feature candidate set for the next iteration.

[0040] The judgment module is used to determine whether the iteration has terminated. If so, the feature subset with the maximum fitness is taken as the final optimized target feature subset; otherwise, the calculation module is controlled to execute the corresponding steps.

[0041] A third aspect of this application provides a feature optimization device for a power data center network intrusion detection environment, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the first aspect or any embodiment of the first aspect.

[0042] The fourth aspect of this application provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps of the first aspect or any embodiment of the first aspect.

[0043] As can be seen from the above, this application provides a feature optimization method and apparatus in a power data center network intrusion detection environment. First, the features to be detected are encoded into feature subsets. Second, based on the feature distribution in the feature subsets, the occurrence frequency of each feature is counted, and a guiding factor for each feature is calculated based on the occurrence frequency. The mutation probability of each feature is obtained based on the guiding factor, and then the corresponding mutation operation is performed on the features in each feature subset. Subsequently, based on the guiding factor of each feature, it is determined whether each feature needs to escape the local optimum. If it needs to escape the local optimum, the corresponding feature in each feature subset that needs to escape the local optimum is inverted, and a cross-strategy is performed on each feature subset. Several feature subsets with the maximum fitness are selected as feature candidate sets for the next iteration. Finally, it is determined whether the iteration terminates. If it terminates, the feature subset with the maximum fitness is selected from several feature subsets with the maximum fitness as the final optimized target feature subset. The feature optimization method and apparatus provided in this application for a power data center network intrusion detection environment can remove redundant features and features that have side effects on the network intrusion detection model, reduce the impact of the above features on network intrusion detection, thereby improving the accuracy of network intrusion detection and reducing the harm of network intrusion. It is applicable to network intrusion detection in power data centers. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1A flowchart illustrating a feature optimization method for a power data center network intrusion detection environment, provided in an embodiment of this application;

[0046] Figure 2 This is a schematic diagram of a feature optimization device for a power data center network intrusion detection environment, provided in an embodiment of this application. Detailed Implementation

[0047] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods are omitted so as not to obscure the description of this application with unnecessary detail.

[0048] It should be understood that, when used in this specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or collections thereof.

[0049] It should also be understood that the terminology used in this application specification is for the purpose of describing particular embodiments only and is not intended to limit the application. As used in this application specification and the appended claims, the singular forms “a,” “an,” and “the” are intended to include the plural forms unless the context clearly indicates otherwise.

[0050] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of the embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0051] Many specific details are set forth in the following description in order to provide a full understanding of this application. However, this application may also be implemented in other ways different from those described herein. Those skilled in the art can make similar extensions without departing from the spirit of this application. Therefore, this application is not limited to the specific embodiments disclosed below.

[0052] Example 1

[0053] This application provides a feature optimization method for a power data center network intrusion detection environment, such as... Figure 1 As shown, the feature optimization method includes:

[0054] Step S100: Obtain several features to be detected, and encode each of the above features to be detected to obtain several feature subsets;

[0055] Among them, the features to be detected are those that need to be detected when performing network intrusion detection in the power data center network intrusion detection environment.

[0056] Optionally, step S100 specifically includes the following steps:

[0057] S110 Assume that the above-mentioned features to be detected are {f1, f2, ..., f...} N}, where f i Let i represent the i-th feature to be detected. There are N features to be detected before feature optimization.

[0058] S120 encodes the aforementioned features to be detected using binary encoding, encoding the aforementioned features to be detected as follows:

[0059]

[0060] Among them, X i If a feature subset, also known as an individual, is represented, then a set containing several individuals can be called a population; x i,j Indicates whether to include the feature f to be detected. j Included in feature subset X i In this context, 'i' represents whether the corresponding feature appears in the feature subset, specifically 'x'. i =1 indicates that the feature to be detected, f, is selected. i Enter the feature subset, through x i =0 indicates that the feature to be detected, f, is not selected. i When a feature is selected and enters a feature subset, it can also be called a gene in that feature subset.

[0061] Step S200: Based on the feature distribution in each feature subset, obtain the frequency of occurrence of each feature contained in each feature subset, and calculate the guiding factor of each feature.

[0062] Optionally, step S200 specifically includes the following steps:

[0063] S210 calculates the frequency of each feature in all feature subsets, where, for M feature subsets [X1, X2, ..., X...], ... M ], statistically analyze each feature x -,j The number of times it appears is C -,j ;

[0064] S220 for each feature x -,jThe guiding factor w for each of the above features is calculated using the following formula. -,j :

[0065]

[0066] Step S300: Calculate the mutation probability of each feature based on the above guiding factor, and perform corresponding mutation operations on each feature based on the above mutation probability; wherein, performing corresponding mutation operations on each feature includes mutating the corresponding feature and not mutating the corresponding feature.

[0067] Optionally, random numbers are generated for each feature, and then the relationship between the mutation probability of each feature and the generated random numbers can be used to determine whether the corresponding feature needs to be mutated. Specifically, step S300 includes the following steps:

[0068] Based on the calculated guiding factor, the mutation probability used in the previous iteration, and the feature subset in which each feature belongs, S310 calculates the mutation probability of each feature using the following formula:

[0069]

[0070] in, This represents the maximum value of the mutation probability for each feature. Indicates the feature x in the previous iteration -,j The probability of mutation, Indicates the feature x in the current iteration -,j The probability of mutation;

[0071] S320 generates random numbers between 0 and 1 for each feature, and determines whether the random numbers for each feature are less than the mutation probability of each feature. If so, then the corresponding feature is mutated; otherwise, the corresponding feature is not mutated.

[0072] Step S400: After performing the corresponding mutation operation on each feature, determine whether each feature needs to escape the local optimum based on the above guiding factor. If so, perform the inversion operation on the corresponding feature that needs to escape the local optimum in each feature subset and execute step 500. Otherwise, there is no need to execute the escape strategy on the feature subset, and directly execute step S500.

[0073] Optionally, it can be determined whether each feature needs to escape from the local optimum by judging whether the guiding factor of each feature is within the decision interval. Specifically, step S400 includes the following steps:

[0074] S410 obtains the guiding factor set as {w} based on the guiding factors of the above features. -,1 ,w -,2 ,...,w-,N} Calculate the mean μ and standard deviation σ of the above-mentioned guiding factor set, and determine the above-mentioned judgment interval through the mean μ and standard deviation σ;

[0075] S420 when feature x -,j When the guiding factor is not within the decision interval, i.e., the guiding factor w -,j <μ-3σ or w -,j When the value is greater than μ+3σ, then the above feature x is determined. -,j It is necessary to break out of local optima and from each feature subset [X1,X2,...,X] M Multiple features x are randomly selected from [the data]. i,j Perform a reversal operation;

[0076] S430 when feature x -,j When the guiding factor is within the decision interval, i.e., the guiding factor μ-3σ≤w -,j When ≤μ+3σ, then the above feature x is determined. -,j It is not necessary to escape local optima, and the above feature x is not considered. -,j Perform a reversal operation.

[0077] Optionally, in step S420, the above-mentioned features are derived from each subset [X1,X2,...,X...]. M Multiple features x are randomly selected from [the data]. i,j Performing a reversal operation includes:

[0078] If any selected feature subset X i Feature x in i,j If x is 0, then x i,j The value is set to 1; if any selected feature subset X i Feature x in i,j If x is 1, then x i,j The value is set to 0.

[0079] Step S500: Perform a cross-policy on each feature subset and select several feature subsets with the highest fitness as feature candidate sets for the next iteration. Specifically, selecting several feature subsets with the highest fitness may include: selecting the top K feature subsets with the highest fitness from all feature subsets.

[0080] Optionally, in step S500, the above-mentioned cross-strategy for each feature subset includes:

[0081] Two feature subsets are randomly selected and random numbers are generated. If the random numbers generated by the two feature subsets are less than the feature subset crossover probability, then the crossover position with the same feature in the two feature subsets is randomly selected, and all feature values ​​after the crossover position are swapped between the two feature subsets.

[0082] Step S600: Determine whether the iteration has terminated. If so, take the feature subset with the maximum fitness as the final optimized target feature subset; otherwise, return to step S200.

[0083] Specifically, selecting the feature subset with the highest fitness as the final optimized target feature subset may include: selecting the feature subset with the highest fitness from the top K feature subsets mentioned above as the final optimized target feature subset. This target feature subset is the optimal feature subset to be obtained in the final embodiment of this application. By using this target feature subset, it is possible to ensure both the speed and accuracy of network intrusion detection, thereby reducing the harm of network intrusion to the power data center.

[0084] As can be seen from the above, the embodiments of this application provide a feature optimization method in a power data center network intrusion detection environment. First, the features to be detected are encoded into feature subsets using binary encoding. Second, based on the feature distribution in the feature subsets, the occurrence frequency of each feature is counted, and a guiding factor for each feature is calculated based on the occurrence frequency. The mutation probability of each feature is obtained based on the guiding factor, and then the corresponding mutation operation is performed on the features in each feature subset. Subsequently, based on the guiding factor of each feature, it is determined whether each feature needs to escape the local optimum. If it needs to escape the local optimum, the corresponding feature in each feature subset that needs to escape the local optimum is inverted, and a cross-strategy is performed on each feature subset. Several feature subsets with the maximum fitness are selected as feature candidate sets for the next iteration. Finally, it is determined whether the iteration terminates. If it terminates, the feature subset with the maximum fitness is selected from several feature subsets with the maximum fitness as the final optimized target feature subset. The feature optimization method provided in this application for a power data center network intrusion detection environment can remove redundant features and features that have side effects on the network intrusion detection model, reduce the impact of the above features on network intrusion detection, thereby improving the accuracy of network intrusion detection and reducing the harm of network intrusion. It is applicable to network intrusion detection in power data centers.

[0085] Example 2

[0086] This application provides a feature optimization device for a power data center network intrusion detection environment, such as... Figure 2 As shown, the feature optimization device includes: an acquisition module 21, a calculation module 22, a mutation module 23, a reversal module 24, a selection module 25, and a judgment module 26.

[0087] The acquisition module 21 is used to acquire several features to be detected and to encode each of the features to be detected to obtain several feature subsets.

[0088] The calculation module 22 is used to obtain the occurrence frequency of each feature contained in each feature subset according to the feature distribution of each feature subset, and to calculate the guiding factor of each feature;

[0089] The mutation module 23 is used to calculate the mutation probability of each feature based on the guiding factor, and to perform corresponding mutation operations on each feature based on the mutation probability.

[0090] The inversion module 24 is used to determine whether each feature needs to escape from the local optimum based on the guiding factor. If so, the corresponding feature that needs to escape from the local optimum is inverted in each feature subset and the selection module 25 is controlled to execute the corresponding steps. Otherwise, the selection module 25 is directly controlled to execute the corresponding steps.

[0091] Selection module 25 is used to perform cross-policy on each feature subset and select the feature subset with the maximum fitness as the feature candidate set for the next iteration;

[0092] The judgment module 26 is used to determine whether the iteration has terminated. If so, the feature subset with the maximum fitness is taken as the final optimized target feature subset; otherwise, the calculation module 22 is controlled to execute the corresponding steps.

[0093] As can be seen from the above, this application embodiment provides a feature optimization device for a power data center network intrusion detection environment. First, the acquisition module 21 encodes the features to be detected into feature subsets using binary encoding. Second, the calculation module 22 counts the occurrence frequency of each feature based on the feature distribution in the feature subsets and calculates the guiding factor of each feature based on the occurrence frequency. The mutation module 23 obtains the mutation probability of each feature based on the guiding factor and then performs corresponding mutation operations on the features in each feature subset. Subsequently, the inversion module 24 determines whether each feature needs to escape the local optimum based on the guiding factor of each feature. If it needs to escape the local optimum, the corresponding feature in each feature subset that needs to escape the local optimum is inverted. The control selection module 25 performs a cross-strategy on each feature subset and selects several feature subsets with the maximum fitness as feature candidate sets for the next iteration. Finally, the judgment module 26 determines whether the iteration terminates. If it terminates, the feature subset with the maximum fitness is selected from several feature subsets with the maximum fitness as the final optimized target feature subset. The feature optimization device provided in this application for a power data center network intrusion detection environment can remove redundant features and features that have side effects on the network intrusion detection model, reduce the impact of the above features on network intrusion detection, thereby improving the accuracy of network intrusion detection and reducing the harm of network intrusion. It is suitable for network intrusion detection in power data centers.

[0094] Example 3

[0095] This application provides a feature optimization device for a power data center network intrusion detection environment. The device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. The memory stores software programs and modules, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory and processor are connected via a bus. Specifically, the processor implements any step in Embodiment 1 by running the computer program stored in the memory.

[0096] It should be understood that, in the embodiments of this application, the processor may be a Central Processing Unit (CPU), but it may also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0097] Memory may include read-only memory, flash memory, and random access memory, and provides instructions and data to the processor. Some or all of the memory may also include non-volatile random access memory.

[0098] As can be seen from the above, the embodiments of this application provide a feature optimization device for a power data center network intrusion detection environment. First, the features to be detected are encoded into feature subsets using binary encoding. Second, based on the feature distribution in the feature subsets, the occurrence frequency of each feature is counted, and a guiding factor for each feature is calculated based on the occurrence frequency. The mutation probability of each feature is obtained based on the guiding factor, and then the corresponding mutation operation is performed on the features in each feature subset. Subsequently, based on the guiding factor of each feature, it is determined whether each feature needs to escape the local optimum. If it needs to escape the local optimum, the corresponding feature in each feature subset that needs to escape the local optimum is inverted, and a cross-strategy is performed on each feature subset. Several feature subsets with the maximum fitness are selected as feature candidate sets for the next iteration. Finally, it is determined whether the iteration terminates. If it terminates, the feature subset with the maximum fitness is selected from several feature subsets with the maximum fitness as the final optimized target feature subset. The feature optimization device provided in this application for a power data center network intrusion detection environment can remove redundant features and features that have side effects on the network intrusion detection model, reduce the impact of the above features on network intrusion detection, thereby improving the accuracy of network intrusion detection and reducing the harm of network intrusion. It is suitable for network intrusion detection in power data centers.

[0099] It should be understood that if the integrated modules / units described above are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can also be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include: any entity or device capable of carrying the computer program code, recording media, USB flash drives, portable hard drives, magnetic disks, optical disks, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc. It should be noted that the content included in the computer-readable storage medium can be appropriately increased or decreased according to the requirements of legislation and patent practice in the jurisdiction.

[0100] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0101] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the above device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0102] It should be noted that the methods and detailed examples provided in the above embodiments can be incorporated into the apparatus and devices provided in the embodiments, and can be referred to each other, without further elaboration.

[0103] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0104] In the embodiments provided in this application, it should be understood that the disclosed apparatus / terminal devices and methods can be implemented in other ways. For example, the apparatus / device embodiments described above are merely illustrative. For instance, the division of the modules or units described above is merely a logical functional division, and in actual implementation, it can be divided in other ways. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0105] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A feature optimization method for a power data center network intrusion detection environment, characterized in that, include: S100 acquires several features to be detected and encodes each of the features to be detected to obtain several feature subsets; S200, based on the feature distribution in each feature subset, obtains the frequency of occurrence of each feature contained in each feature subset and calculates the guiding factor of each feature. Step S200 specifically includes the following steps: S210 calculates the frequency of each feature in all feature subsets, where for M feature subsets... Statistical analysis of each characteristic The number of times it appears is ; S220 for each feature The guiding factor for each feature is calculated using the following formula. : ； S300 calculates the mutation probability of each feature based on the guiding factor, and performs corresponding mutation operations on each feature according to the mutation probability. Step S300 specifically includes the following steps: S310 calculates the mutation probability of each feature using the following formula: in, This represents the maximum value of the mutation probability for each feature. Indicates the features in the previous iteration The probability of mutation, Indicates the features in the current iteration The probability of mutation; S320 generates random numbers between 0 and 1 for each feature, and determines whether the random number for each feature is less than 1. If so, then the corresponding feature is mutated; otherwise, the corresponding feature is not mutated. S400 determines whether each feature needs to escape the local optimum based on the guiding factor. If so, the corresponding feature that needs to escape the local optimum is reversed in each feature subset and step 500 is executed. Otherwise, step S500 is executed directly. S500 performs a cross-policy on each feature subset and selects several feature subsets with the highest fitness as feature candidate sets for the next iteration. S600 determines whether the iteration has terminated. If so, the feature subset with the maximum fitness is taken as the final optimized target feature subset; otherwise, return to step S200.

2. The feature optimization method as described in claim 1, characterized in that, Step S100 specifically includes the following steps: S110 assumes that the plurality of features to be detected are ,in, Let i represent the i-th feature. There are N features in total before feature optimization. S120 encodes the plurality of features to be detected using binary encoding. ， in, Represents a feature subset, Indicates whether to include features Included in feature subset In this context, i indicates whether the corresponding feature appears in the feature subset. Indicates selection , Indicates that it is not selected. .

3. The feature optimization method as described in claim 1, characterized in that, Step S400 specifically includes the following steps: S410 obtains a set of guiding factors based on the guiding factors of each feature. Calculate the mean of the set of guiding factors. and standard deviation ; S420 features guiding factor or When, then the feature is determined. It is necessary to break out of local optima and from each feature subset Randomly select multiple features Perform a reversal operation; S430 features guiding factor Then determine the feature It is not necessary to escape local optima, and the features are not... Perform a reversal operation.

4. The feature optimization method as described in claim 3, characterized in that, In step S420, the step of selecting from each feature subset Randomly select multiple features Performing a reversal operation includes: If any feature subset is selected Features If it is 0, then The value is set to 1; if any feature subset is selected Features If it is 1, then... The value is set to 0.

5. The feature optimization method as described in claim 1, characterized in that, In step S500, the execution of the cross-strategy for each feature subset includes: Two feature subsets are randomly selected. If the random number generated by the two feature subsets is less than the feature subset crossover probability, then the crossover position with the same feature in the two feature subsets is randomly selected, and all feature values ​​after the crossover position are swapped between the two feature subsets.

6. A feature optimization device for a power data center network intrusion detection environment, characterized in that, include: The acquisition module is used to acquire several features to be detected and to encode each of the features to be detected to obtain several feature subsets; The calculation module is used to obtain the frequency of occurrence of each feature contained in each feature subset based on the feature distribution of each feature subset, and to calculate the guiding factor of each feature. Specifically, it includes the following modules: Submodule 1 calculates the frequency of each feature in all feature subsets, where for M feature subsets... Statistical analysis of each characteristic The number of times it appears is ; Submodule two, for each feature The guiding factor for each feature is calculated using the following formula. : ； The mutation module is used to calculate the mutation probability of each feature based on the guiding factor, and to perform corresponding mutation operations on each feature according to the mutation probability. Specifically, it includes the following modules: Submodule 3 calculates the mutation probability of each feature using the following formula: in, This represents the maximum value of the mutation probability for each feature. Indicates the features in the previous iteration The probability of mutation, Indicates the features in the current iteration The probability of mutation; Submodule four generates random numbers between 0 and 1 for each feature, and determines whether the random number for each feature is less than 1. If so, then the corresponding feature is mutated; otherwise, the corresponding feature is not mutated. The inversion module is used to determine whether each feature needs to escape the local optimum based on the guiding factor. If so, the corresponding feature that needs to escape the local optimum is inverted in each feature subset and the selection module is controlled to execute the corresponding steps. Otherwise, the selection module is directly controlled to execute the corresponding steps. The selection module is used to perform cross-policy on each feature subset and select the feature subset with the highest fitness as the feature candidate set for the next iteration. The judgment module is used to determine whether the iteration has terminated. If so, the feature subset with the maximum fitness is taken as the final optimized target feature subset; otherwise, the calculation module is controlled to execute the corresponding steps.

7. A feature optimization device for a power data center network intrusion detection environment, comprising: A memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the computer program, implements the steps of the method as claimed in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method as described in any one of claims 1 to 5.

Images