Intrusion detection method based on neural network with symmetric uncertainty and hyperparameter optimization

Abstract

The invention discloses an intrusion detection method based on joint symmetric uncertainty and hyperparameter optimization neural network, belonging to the field of network security and intrusion detection technology. First, non-numerical features are uniquely encoded, converted into numerical features, and the numerical values ​​are normalized; based on symmetric uncertainty and Markov blanket under loose conditions, joint symmetric uncertainty is used to perform feature selection, obtain the optimal feature subset, and reduce the dimension of the original data; a CNN-LSTM fusion neural network classification model is constructed based on CNN and LSTM, and the improved PSO algorithm is used to automatically optimize the hyperparameters of the model to improve the generalization ability of the algorithm. The invention has better feature selection performance and better intrusion detection traffic classification performance. Thus, better performance is shown in multi-dimensional evaluation indicators such as accuracy, precision, and recall.

Description

Technical Field

[0001] The present invention belongs to the field of network security and intrusion detection technology, and particularly relates to a network traffic anomaly detection method, namely, an intrusion detection method combining symmetric uncertainty and hyperparameter optimization neural network. Background Art

[0002] The high-dimensional features of intrusion detection data contain a large number of irrelevant and redundant features. The learning of irrelevant features can easily lead to model overfitting, and redundant features will increase the learning cost of the classification model. Using feature selection technology to select the smallest feature subset according to the evaluation criteria can reduce the training time of the original data and improve the performance of the classification model. The correlation of features can be divided into feature-class correlation (C-correlation) and feature-feature correlation (F-correlation). The Relief algorithm proposed by Kira et al. in The Feature Selection Problem: Traditional Methods and a New Algorithm measures C-correlation through random sampling, but ignores F-correlation, which leads to the existence of redundant features in the selected feature subset. Zhang et al. proposed a cumulative conditional mutual information minimization criterion method in Feature Subset Selection with Cumulate Conditional Mutual Information Minimization to find a subset equivalent to the original subset and delete redundant features, but the evaluation conditions of this method are too strict and will remove features that have a strong correlation with the category label. Peng et al. proposed a maximum relevance and minimum redundancy feature selection algorithm based on information theory in the article Feature Selection based on Mutual Information Criteria of Max-Dependency, Max-Relevance, and Min-Redundancy, which takes into account both C-correlation and F-correlation. However, this method requires artificial setting of the number of selected features, which may result in excessive deletion of strongly correlated features or retention of excessive redundant features.

[0003] Traditional machine learning algorithms are prone to overfitting and have low classification accuracy. Therefore, deep learning has been widely used in the field of intrusion detection. Gao et al. proposed the incremental neural network model I-ELM in the article Research on Network Intrusion Detectionbased on Incremental Extreme Learning Machine and Adaptive PrincipalComponent Analysis. Compared with traditional machine learning models, it has faster detection efficiency, but its false alarm rate is higher. This is because the shallow architecture of the neural network model makes the model's abstraction and learning ability for network data features poor, and the application scenarios of intrusion detection models are often massive high-dimensional data. Common deep learning algorithms such as CNN, LSTM, etc. have deep neural network architectures and therefore have stronger learning capabilities. Kim et al. proposed a CNN-based intrusion detection algorithm in the article CNN-based Network Intrusion Detection Against Denial-of-Service Attacks, but the overall model focused more on the identification of DoS attacks and had poor recognition performance for other attack categories with fewer samples. Clausen et al. used a bidirectional LSTM algorithm in the article Better Anomaly Detection for Access Attacks Using Deep Bidirectional LSTMs to effectively learn short-term sequence patterns in network flows as conditional event probabilities to identify network temporal correlation anomalies.

[0004] Deep learning models have certain advantages in intrusion detection analysis, which involves the setting of hyperparameters. The optimization of hyperparameters can improve the performance of the model and is also a basic factor in producing excellent performance results. Bekri et al. used the particle swarm optimization algorithm for automatic hyperparameter optimization in the article PSO Based Intrusion Detection: A Pre-Implementation Discussion. Compared with manual adjustment, the time spent on parameter optimization and the performance of the optimized model have been improved to a certain extent; Torres et al. used the random search hyperparameter optimization algorithm to optimize the hyperparameters of the artificial network model in the article Random Hyper-parameter Search-Based Deep Neural Network for Power Consumption Forecasting, revealing that the use of random search technology in neural network models can reduce the error probability of the model and reduce the running time of the model, which can improve the speed of hyperparameter adjustment.

[0005] At present, there are some problems in the feature selection algorithms in the field of intrusion detection. The existing feature selection methods either fail to take into account the redundancy between features and the correlation between feature categories, or fail to consider the combined effect of features, or fail to obtain the optimal feature subset because the number of features is set artificially or the evaluation conditions are too strict. A single deep learning algorithm is superior to traditional machine learning algorithms and shallow neural networks in the scenario of massive high-dimensional data, but it still has limitations in its ability to learn data features, which leads to poor classification performance. Manual adjustment of deep learning model hyperparameters is time-consuming and may miss the global optimal point, resulting in poor classification effect and algorithm portability of deep learning models. Summary of the invention

[0006] The present invention proposes an intrusion detection method for joint symmetric uncertainty and hyperparameter optimization neural network. The method performs feature selection based on joint symmetric uncertainty and uses an improved particle swarm optimization algorithm (PSO) to optimize the convolutional neural network-long-memory neural network (CNN-LSTM) classification model to classify network traffic.

[0007] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0008] The study uses symmetric uncertainty to calculate the correlation between features and categories, and the approximate Markov blanket under loose conditions to calculate the redundant relationship between features. The symmetric uncertainty is combined with the approximate Markov blanket under loose conditions, with special attention paid to the combination effect between features. The correlation between the combined feature set and the category is used as the basis for selecting the optimal feature subset.

[0009] A single deep neural network model cannot take into account both local features and long-term dependent features, and often cannot learn features comprehensively. Research on an intrusion detection model based on the fusion of convolutional neural networks and recurrent neural networks, where the convolutional neural network extracts local features through convolutional layers, and the recurrent neural network extracts temporal features by controlling the memory and forgetting of historical data through gate functions;

[0010] The automatic hyperparameter optimization method based on particle swarm is studied. In order to solve the problems of particle swarm premature convergence and falling into local optimality, the local optimization ability of individual particle cognition and the global optimization ability of social group communication are adjusted through adaptive dynamic inertia weight to ensure that the particle swarm converges to the optimal position to obtain the optimal hyperparameters.

[0011] An intrusion detection method combining symmetric uncertainty and hyperparameter optimization neural network, comprising the following steps:

[0012] S1. Data preprocessing: perform one-hot encoding on non-numerical features, convert them into numerical features, and normalize the numerical values;

[0013] S2, feature selection, using symmetric uncertainty to calculate the correlation between features and categories, using the approximate Markov blanket under loose conditions to calculate the redundant relationship between features, combining symmetric uncertainty with the approximate Markov blanket under loose conditions to form a joint uncertainty feature selection method to select the optimal feature subset;

[0014] S3, using convolutional neural network and memory neural network to build CNN-LSTM classification model, using CNN to learn the spatial features of data, and using LSTM to learn the temporal features of data;

[0015] S4. Use the improved PSO algorithm to automatically optimize the convolution kernel size filter, number of hidden neurons units, learning rate learning rate and pooling layer parameter dropout in the CNN-LSTM model, and finally determine the optimized CNN-LSTM model;

[0016] S5. Algorithm evaluation. The intrusion detection performance of the proposed algorithm is verified on the KDD99 and UNSW-NB15 datasets. It is compared with other algorithms in terms of accuracy, precision, recall, F1 score, Matthews correlation coefficient and Kappa correlation coefficient. This proves the superiority of the algorithm and the effectiveness of hyperparameter optimization of the algorithm on different datasets.

[0017] A further improvement of the technical solution of the present invention is that in step S1, the non-numerical features are encoded with one-hot encoding, and the formula of the maximum and minimum normalization method is as follows:

[0018]

[0019] A further improvement of the technical solution of the present invention is that in step S2, the formula of the approximate Markov blanket under loose conditions is as follows:

[0020] SU(x i ,x j )-SU(x j ,C)≥δ

[0021] Among them, x i and x j represents the feature, C represents the category label, δ is the loose factor, and its value range is [0,1];

[0022] The approximate Markov blanket based on loose conditions is used for clustering redundant features. If the feature x i There is a Markov blanket MB i , then, feature x i and MB i will be classified into the same cluster. If it does not exist, then add a cluster containing only x. i The number of new clusters does not need to be specified in advance. After clustering is completed, according to SU(x i ,C) values ​​are used to rank the features in each cluster. The feature ranked first in the cluster is called the dominant feature, and then the dominant features of each cluster are used to rank the clusters.

[0023] A further improvement of the technical solution of the present invention is that: the feature selection method of the joint uncertainty fully considers the joint effect formed by the combination of features under the premise of following the cluster sorting and the feature sorting within the cluster.

[0024] The definition of the joint mutual information of feature X and feature Y with the category label C is as follows:

[0025] I(X,Y;C)=H(X,Y)+H(C)-H((X,Y),C)

[0026] Where H(X,Y) and H((X,Y),C) are defined as follows:

[0027] H(X,Y)=-∑ j ∑ i P(x i ,y j )log 2 P(x i ,y j )

[0028] H(C) is defined as follows:

[0029] H(X)=-∑i P(x i )log 2 P(x i )

[0030] By normalizing the above joint mutual information using symmetric uncertainty, we can obtain the joint uncertainty SU(X,Y;C) of the feature X and feature Y combined with the category label C, as shown below:

[0031]

[0032] Among them, P(x i ) indicates variable X = x i The probability of a random variable Y = {y 1 ,y 2 ,…,y j}, P(x i ,y j ) is the joint probability of X and Y, and H(X,Y) is the joint entropy of the two random variables X and Y.

[0033] A further improvement of the technical solution of the present invention is that the process of feature selection based on joint uncertainty is as follows:

[0034] Step 1: Select the dominant feature in the first-ranked cluster to initialize the optimal feature subset and discard other features in its cluster;

[0035] Step 2: Sort the features in the cluster by their ranking order and within the cluster, starting from the dominant feature in the cluster, calculate the joint uncertainty value of the dominant feature and each feature in the optimal feature subset and sum them up, until all features in the cluster are traversed, take the feature with the largest sum of joint uncertainty values, and add it to the optimal feature subset;

[0036] Step 3: Repeat step 2 until all clusters are traversed and the optimal feature subset is finally obtained.

[0037] The further improvement of the technical solution of the present invention is that the specific method of improving the PSO algorithm in step S4 is as follows:

[0038] In the velocity update equation of the particle swarm algorithm, the inertia weight ω dynamically adjusted by the cosine function is introduced. iter , which is used to control the influence of historical speed on the current moving speed of the particle, and improve the speed formula as follows:

[0039]

[0040]

[0041] Among them, iter represents the current number of iterations, iter maxIndicates the maximum number of iterations, the inertia weight ω in this algorithm iter The value range is [0.1,1.1], so take ω min =0.1,ω max =1.1;

[0042] C 1 and c 2 The calculation method is improved as follows:

[0043]

[0044]

[0045] Among them, c 1,start 、c 1,end and c 2,start 、c 2,end The value range of is [0.5, 2.5]. At the time of initialization, in order to make the divergence stronger in the early stage of iteration and the convergence stronger in the later stage of iteration, c is set 1,start =2.5, c 1,end =0.5, c 2,start =0.5, c 2,end =0.5.

[0046] A further improvement of the technical solution of the present invention is that the CNN-LSTM classification model is optimized in step S4 as follows:

[0047] The improved PSO algorithm is used to find the optimal parameters of the CNN-LSTM model, including the overall learning-rate and dropout of the model, as well as the filter in CNN and the units in LSTM. A total of four hyperparameters are optimized to improve the classification performance of the CNN-LSTM model.

[0048] In the improved PSO algorithm, the optimal hyperparameter combination is found by minimizing the value of Loss. The calculation method of Loss is as follows:

[0049] Loss = 1-Accuracy

[0050] Among them, Accuracy represents the accuracy of model classification.

[0051] A further improvement of the technical solution of the present invention is that the algorithm evaluation in step S4 is:

[0052] Firstly, on the KDD99 dataset, the effectiveness of the joint uncertainty feature selection method, the improved PSO algorithm and the CNN-LSTM classification model is verified, mainly including the comparison of similar feature selection methods, the comparison of the improved PSO algorithm with the unimproved PSO algorithm, the comparison of the CNN-LSTM classification model with other classification models, and the ablation experiment comparison of the algorithms.

[0053] Secondly, verify the overall performance of the algorithm, including the comparison of the algorithm with other similar algorithms in various indicators;

[0054] Finally, the algorithm is applied to the UNSW-NB15 dataset to demonstrate the effectiveness of the algorithm in optimizing hyperparameters according to different data.

[0055] Due to the adoption of the above technical solution, the technical progress achieved by the present invention is:

[0056] The present invention is based on the Markov blanket condition under loose conditions, uses joint symmetric uncertainty for feature selection, builds a CNN-LSTM fusion neural network classification model based on a convolutional neural network (CNN) and a memory neural network (LSTM), and uses an improved PSO algorithm to automatically optimize the hyperparameters of the model. First, based on the Markov blanket condition under loose conditions, it is possible to avoid losing features that are strongly correlated with category features, and then use a joint symmetric uncertainty feature selection algorithm to obtain the optimal feature subset, reducing the dimension of the original data; secondly, based on the ability of CNN to extract spatial features and the ability of LSTM to extract temporal features, a fusion neural network is constructed to extract the spatiotemporal features of network traffic data and learn; finally, an improved PSO algorithm is used to optimize the hyperparameters of the deep learning model and improve the generalization ability of the algorithm. Compared with the above-mentioned other inventions, the present invention has better feature selection performance and also better intrusion detection traffic classification performance. Thus, it shows better performance in multi-dimensional evaluation indicators such as accuracy, precision, and recall.

[0057] The present invention fully considers the correlation between features and category labels, the correlation between features, and the correlation between feature combinations and category labels, and obtains a feature subset with optimal classification performance while reducing the dimension of original data.

[0058] The present invention applies fusion neural network to the field of intrusion detection, fully utilizes the ability of convolutional neural network to extract spatial features of network traffic data, and the ability of long-term memory neural network (LSTM) to extract temporal features of network traffic data, to obtain a better classifier, and shows good performance in multi-dimensional evaluation indicators such as accuracy, precision, recall, F1 score, Matthews correlation coefficient (MCC), and Kappa correlation coefficient (Kappa).

[0059] The present invention uses an improved particle swarm optimization algorithm (PSO) to automatically optimize the hyperparameters in the deep learning model, avoiding the time-consuming manual adjustment and the problem that the hyperparameters are only applicable to the current data set, so that the classification model has generalization ability and portability for different data sets. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 It is a flow chart of the algorithm of the present invention;

[0061] Figure 2 It is the CNN network structure diagram;

[0062] Figure 3 This is the LSTM structure diagram;

[0063] Figure 4 is the hyperparameter optimization graph;

[0064] Figure 5 It is the confusion matrix of the classification results of the KDD99 dataset;

[0065] Figure 6 It is the confusion matrix of the classification results of the UNSW-15B dataset. DETAILED DESCRIPTION

[0066] The present invention is further described in detail below in conjunction with embodiments:

[0067] The present invention is aimed at intrusion detection and is mainly divided into five parts: data preprocessing, feature selection, spatiotemporal feature fusion neural network, hyperparameter optimization and algorithm evaluation. The detailed algorithm framework and flow chart are as follows Figure 1 As shown:

[0068] 1. Data preprocessing

[0069] In the data preprocessing stage, one-hot encoding is performed for non-numerical features, such as the three character features 'protoco_type', 'service', and 'flag' in the KDD99 dataset; the maximum and minimum normalization method is used for the distribution of data to avoid the influence of the data range of different features on feature selection and classification effect. The formula of the maximum and minimum normalization method is as follows:

[0070]

[0071] X max and X min are the maximum and minimum values ​​of feature X respectively.

[0072] 2. Feature Selection

[0073] 2.1 Symmetric uncertainty

[0074] In information entropy theory, entropy is used to describe the uncertainty of random variables, that is, random variable X = {x 1 ,x 2 ,…,x i The information entropy of} is H(X), and the formula is as follows:

[0075] H(X)=-∑ i P(x i )log 2 P(x i ) (2)

[0076] Among them, P(x i ) indicates variable X = x i probability.

[0077] Random variable Y = {y 1 ,y 2 ...,y j}, the joint entropy of two random variables X and Y is H(X,Y), and the formula is as follows:

[0078] H(X,Y)=-∑ j ∑ i P(x i ,y j )log 2 P(x i ,y j ) (3)

[0079] Among them, P(x i ,y j ) is the joint probability of X and Y. The strip entropy of random variable X under a given random variable Y is H(X|Y), and the formula is as follows:

[0080] H(X|Y)=-∑ j P(y j )∑ i P(x i ∣y j )log 2 P(x i ∣y j ) (4)

[0081] Among them, P(x i ∣y j ) means that when variable Y=y j Condition variable X = x i The posterior probability of .

[0082] Information gain can be used to describe the amount of information a feature brings. The formula is as follows:

[0083] IG(X|Y)=H(X)-H(X|Y) (5)

[0084] Here X and Y are two random variables. The larger the information gain value IG(X|Y), the greater the degree of reduction in information uncertainty, and the stronger the correlation between the two random variables. However, calculating the correlation between two random variables in this way will be affected by the units and values ​​of the two random variables, and further homogenization is required. In order to eliminate these effects, the normalized information gain, that is, the symmetric uncertainty SU(X,Y), can be used. The formula is as follows:

[0085]

[0086] SU is a nonlinear correlation information measure based on information entropy. The value range of SU(X,Y) is [0,1]. The value of SU(X,Y) is positively correlated with the correlation between X and Y. When SU(X,Y) is 1, it means that X and Y are two completely correlated variables. When SU(X,Y) is 0, it means that X and Y are independent of each other.

[0087] Symmetric uncertainty is used to determine the correlation between features and categories, that is, the C-relationship. The larger the value of SU, the stronger the correlation between the current feature and category C.

[0088] 2.2 Markov blanket under loose conditions

[0089] Features i is feature x j An approximate Markov blanket of , where i≠j, if and only if the following two conditions hold.

[0090] SU(x i ,C)>SU(x j ,C) Condition (1)

[0091] SU(x i ,x j )≥SU(x j ,C) Condition (2)

[0092] Among them, x i and x j represents the feature, and C represents the category label.

[0093] Here condition (1) means that the feature x i Than feature x j Contains more class label information, condition (2) means that feature x i and feature x j There is a strong correlation between them. If feature x i is feature x j The approximate Markov blanket ofj It is judged to be a redundant feature.

[0094] However, the redundancy judgment condition of the approximate Markov blanket idea is relatively strict. Among the features judged as redundant by the approximate Markov blanket, there may be features that are strongly correlated with the category label. Therefore, this application proposes an approximate Markov blanket under loose conditions to retain as many features that are strongly correlated with the category label as possible, and improves condition (2), as shown in condition (3).

[0095] SU(x i ,x j )-SU(x j ,C)≥δ Condition (3)

[0096] Among them, δ is the loose factor, and its value range is [0,1].

[0097] The approximate Markov blanket based on loose conditions is used for clustering redundant features. If the feature x i There is a Markov blanket MB i , then, feature x i and MB i will be classified into the same cluster. If it does not exist, then add a cluster containing only x. i The advantage of this clustering method is that it does not require the number of clusters to be specified in advance. After clustering is completed, according to SU(x i ,C) values ​​are used to rank the features in each cluster. The feature ranked first in the cluster is called the dominant feature, and then the dominant features of each cluster are used to rank the clusters.

[0098] 2.3 Joint Symmetric Uncertainty

[0099] If, after clustering, the dominant features in each cluster are directly selected to form a feature subset, although the correlation between the features selected from each cluster and the category label is maximized, the joint effect between the features is ignored, and the correlation between this joint effect and the classification label is a key factor in determining the classification performance. The contribution of some dominant features may not be as good as that of non-dominant features. Therefore, this application proposes a feature selection method with joint symmetric uncertainty, that is, under the premise of following the cluster sorting and the feature sorting within the cluster, the joint effect formed by the combination of features is fully considered.

[0100] Mutual information is a measure of the mutual dependence between two random variables, expressed as I(X;Y). The formula is as follows:

[0101] I(X;Y)=H(X,Y)-H(X|Y)-H(Y|X) (7)

[0102] Wherein, H(X,Y) is as shown in formula (3), H(X|Y) and H(Y|X) are as shown in formula (4)

[0103] Joint mutual information can be used to measure the mutual dependence of two random variables after they are combined with a third random variable, and can be used to measure the correlation between two features after they are combined with a category label. The definition formula of the joint mutual information of feature X and feature Y combined with category label C is as follows:

[0104] I(X,Y;C)=H(X,Y)+H(C)-H((X,Y),C) (8)

[0105] Wherein H(X,Y), H((X,Y),C) are as shown in formula (3), and H(C) is as shown in formula (2).

[0106] By normalizing the above joint mutual information using symmetric uncertainty, we can obtain the joint uncertainty SU(X,Y;C) of the feature X and feature Y combined with the category label C. The formula is as follows:

[0107]

[0108] The process of feature selection based on joint uncertainty is as follows:

[0109] Step 1: Select the dominant feature in the first-ranked cluster to initialize the optimal feature subset and discard other features in its cluster;

[0110] Step 2: Sort the features in the cluster by their ranking order and within the cluster, starting from the dominant feature in the cluster, calculate the joint uncertainty value of the dominant feature and each feature in the optimal feature subset and sum them up, until all features in the cluster are traversed, take the feature with the largest sum of joint uncertainty values, and add it to the optimal feature subset;

[0111] Step 3: Repeat step 2 until all clusters are traversed and the optimal feature subset is finally obtained.

[0112] 3. Spatiotemporal fusion neural network

[0113] 3.1 CNN

[0114] Convolutional neural network is one of the representative algorithms of deep learning. It consists of three parts: input layer, hidden layer and output layer. The hidden layer includes convolution layer, pooling layer and fully connected layer. Its network structure is as follows: Figure 2 shown.

[0115] The convolution layer extracts local features of the sample by controlling the size of the convolution kernel, and integrates the local features extracted by the convolution layer in the subsequent fully connected layer. Therefore, CNN can obtain the spatial features of the input data. Relu is used as its activation function in this application. The pooling layer is the process of downsampling in CNN, which is mainly to reduce the feature dimension, accelerate network convergence, and prevent network overfitting to a certain extent. This application adopts the maximum pooling method in the pooling layer. The fully connected layer means that each node is connected to all the nodes in the previous layer, synthesizing the features extracted by the previous layer, and integrating the global local features through the fully connected layer to form an overall feature.

[0116] 3.2LSTM

[0117] Long short-term memory (LSTM) is a variation of recurrent neural network, which is composed of 1 memory unit and 3 gate units. By introducing memory units and gate mechanisms, the gradient vanishing and gradient exploding problems that occur during the training of recurrent neural networks are effectively overcome. Moreover, based on memory units and gate mechanisms, LSTM can handle problems with time series characteristics, can better connect the context, and thus obtain time features. Its network model structure is as follows: Figure 3 The calculation is shown in formula (10-15):

[0118] f t =σ(w xf x t +w hf h t-1 +b f )(10)

[0119] i t =σ(w xi x t +w hi h t-1 +b i )(11)

[0120]

[0121]

[0122] o t =σ(w xo x t +w ho h t-1 +b o )(14)

[0123] h t =o t ·tanh(c t )(15)

[0124] Among them, at time t, c t is the memory unit, f t For the forget gate, i t is the input gate, o t is the output gate, x t represents the input data, h t represents the hidden layer. w and b represent the weight and bias respectively. σ represents the Sigmoid activation function.

[0125] 3.3CNN-LSTM Classifier

[0126] Network traffic data has obvious characteristics such as randomness, nonlinearity, uneven distribution and periodicity over a long period of time. It contains spatial features, such as IP addresses, port numbers and other information. At the same time, the sequence of network traffic contains time information. Therefore, there is a contextual temporal association between network traffic data. These temporal and spatial features play a vital role in intrusion detection systems. CNN extracts local features through convolutional layers, and then integrates local features at higher levels to obtain global features. Therefore, it has the ability to extract spatial features of data, but CNN lacks the extraction and analysis of temporal associations in network traffic. Network attack events are strongly correlated in time. LSTM controls the memory and forgetting of historical data through gate functions, and has the ability to extract temporal features of data. Therefore, this application proposes a fusion neural network of CNN-LSTM for learning spatiotemporal features, so as to achieve better intrusion detection classification effects.

[0127] 4. Hyperparameter Optimization

[0128] Deep learning models have good classification performance, but it depends to a large extent on the setting of hyperparameters. The setting of hyperparameters has a direct impact on the performance of the model. Improper selection of hyperparameters may lead to poor model performance or overfitting problems. The CNN-LSTM classification model used in this application contains many hyperparameter settings, such as learning rate, pooling layer parameters (dropout), convolution kernel size (filter), number of hidden layer neurons (units), etc. Most existing algorithms manually select the best hyperparameter values ​​through multiple experiments, but this method is time-consuming and difficult to achieve the optimal hyperparameter selection. At the same time, the parameter setting needs to change according to the data set, and the parameter adjustment work needs to be repeated on different data sets. The hyperparameter optimization process is as follows: Figure 4 shown.

[0129] 4.1 Basic PSO Algorithm

[0130] Particle Swarm Optimization (PSO) is a heuristic algorithm. Its advantage is that it can find the optimal solution through information interaction between particles in the group even in the case of sparse data. Particles will quickly converge to the vicinity of individual extreme points in the early iteration. In the later stage of the algorithm iteration, each particle will perform a more fine-grained optimization to find the global optimal solution.

[0131] The principle of the particle swarm algorithm is as follows: In a d-dimensional search space, there is a group of N particles, each of which flies at a certain speed. For the i-th particle in the particle swarm, its position in space at time t is Speed ​​is All particles have positions and velocities constrained: X min ≤X i ≤X max ,V min ≤V i ≤V max ), X max and X min is the upper and lower limits of the particle position, V max and V min are the upper and lower limits of particle speed. The optimal position that particle i passes at time t is called the individual optimal position, denoted by All particles The best position in becomes the global best position, denoted as gbest d After finding the individual optimal position and the global optimal position, the particle searches for the optimal position according to formulas (16) and (17).

[0132]

[0133]

[0134] in, represents the velocity of particle i in the d-dimensional space at time t; represents the coordinates of particle i in the d-dimensional space at time t. 1 represents cognitive factor, c 2 represents the social factor. The two are collectively called the acceleration constant, which are used to adjust the role of individual experience and social experience of particles in flight, indicating that each particle tends to and gbest d The weight of the acceleration ability of the position. 1 If the value is too small, the particles will lack the ability to learn themselves and will easily fall into the local optimum during information exchange. 2 If the value is too small, the particles will lose their ability to share socially, and PSO will become a random search of multiple initial value points and fail to converge.1 and c 2 The value range is [0,4], usually c 1 =c 2 =2. 1 and r 2 It is a random number between [0,1], which is used to add randomness to the search process and can help the algorithm converge as quickly as possible.

[0135] The specific steps of the particle swarm optimization algorithm are as follows:

[0136] Step 1: Initialize the PSO parameters, including population size (N), spatial dimension (d), and initial position of randomized particles. and speed Maximum number of iterations Max (loop end condition), acceleration constant c 1 and c 2 .

[0137] Step 2: Substitute the particle's position and velocity information into the fitness function and obtain the fitness value as And calculate

[0138] Step 3: Update the particle's velocity and position, and follow the principle of boundary restrictions: when V i >V max When V max , V i <V min When V min ; When X i >X max When X max , X i <X min When X min .

[0139] Step 4: Update and Substitute the particle into the fitness function to find the fitness value and the individual optimal value of particle i Compare, if the fitness value is better than If yes, update, otherwise do not update. Then compare and gbest d ,if Better than gbest d , then update gbest d .

[0140] Step 5: Determine whether the convergence accuracy is met or the number of iterations reaches Max. If the conditions are not met, return to step 2 to continue the next iteration; if the conditions are met, complete the iteration and output the current gbest d .

[0141] 4.2 Improved PSO algorithm

[0142] In the basic PSO algorithm, all particles use the same learning strategy to update their positions. If a local particle deviates from the optimal solution, the entire particle swarm will converge prematurely and fall into a local optimum. In order to solve the problem of premature convergence in the basic PSO algorithm, this application introduces an adaptive particle swarm optimization algorithm that adjusts the local and global optimization capabilities of particles through dynamic inertia weights to ensure that the particle swarm converges to a suitable position. First, the inertia weight ω dynamically adjusted by the cosine function is introduced into the velocity update equation of the particle swarm algorithm. iter , used to control the influence of historical speed on the current moving speed of the particle. iter It can keep the particles inertia and have the tendency to expand the search space, which is an important parameter to balance the individual and global search capabilities of the algorithm. Therefore, the speed formula is improved as follows.

[0143]

[0144]

[0145] Among them, iter represents the current number of iterations, iter max Indicates the maximum number of iterations, the inertia weight ω in this algorithm iter The value range is [0.1,1.1], so take ω min =0.1,ω max =1.1.

[0146] From the above formula, we can find that when the particle reaches the individual optimal vicinity, the speed update is mainly determined by the first term. iter It can enhance the global search capability of PSO, and the smaller ω iter It can enhance the local search ability of PSO

[46] The dynamic inertia weight of the present application can ensure good global optimization capability in the early stage of iteration, and can better perform refined search for the optimal position in the later stage of iteration.

[0147] At the same time, in the PSO algorithm, the learning factor c 1 and c 2 Represents the self factor and social factor respectively, c 1 Used to learn about the best situation for itself, c 2 Used to learn from the global optimal situation. In the early stage of optimization, more attention should be paid to individual cognition, and as the number of iterations increases, more attention should be paid to the ability of individuals to obtain social information. Therefore, this application 1 and c 2The calculation method of is improved, as shown in formula (20) and formula (21).

[0148]

[0149]

[0150] where c 1,start 、c 1,end and c 2,start 、c 2,end The value range of is [0.5, 2.5]. At the time of initialization, in order to make the divergence stronger in the early stage of iteration and the convergence stronger in the later stage of iteration, c is set 1,start =2.5, c 1,end =0.5, c 2,start =0.5, c 2,end =2.5.

[0151] Updating the learning factor in this way can make the algorithm have a larger c in the early stage of iteration. 1 and smaller c 2 , so that the particle population diverges as much as possible into the search space, that is, emphasizes individual consciousness and is less affected by other particles in the population; in the later stage of algorithm iteration, there is a large c 2 and smaller c 1 , which strengthens the convergence ability of later particles to the global optimal point.

[0152] 4.3 Optimizing the CNN-LSTM Classification Model

[0153] The improved PSO algorithm is used to find the optimal parameters of the CNN-LSTM model, including the overall learning-rate and dropout of the model, as well as the filter in CNN and the units in LSTM. A total of four hyperparameters are optimized to improve the classification performance of the CNN-LSTM model.

[0154] In the improved PSO algorithm, the optimal hyperparameter combination is found by minimizing the value of Loss. The calculation method of Loss is shown in formula (22).

[0155] Loss = 1 - Accuracy (22)

[0156] Among them, Accuracy represents the accuracy of model classification.

[0157] 5. Algorithm Evaluation

[0158] In order to verify the effectiveness of the algorithm proposed in this application. First, on the KDD99 dataset, the effectiveness of the joint uncertainty feature selection method, the improved PSO algorithm and the CNN-LSTM classification model proposed in this application is verified, mainly including the comparison of similar feature selection methods, the comparison of the improved PSO algorithm and the unimproved PSO algorithm, the comparison of the CNN-LSTM classification model and other classification models, and the ablation experiment comparison of the algorithm. Then, the overall performance of the algorithm is verified, including the comparison of the algorithm with other similar algorithms in various indicators. Finally, the algorithm is applied to the UNSW-NB15 dataset. Since the attributes and classification labels of the datasets are different, the superiority of the algorithm proposed in this application on the UNSW-NB15 dataset can prove that the algorithm proposed in this application has good generalization ability and portability when using the improved PSO to optimize the algorithm parameters.

[0159] Example 1

[0160] The experimental environment for this application is a 64-bit Windows 12 operating system, an Intel i7 processor, and a computer with 8GB of memory. This experiment uses the Python machine learning library Scikit learn.

[0161] This application uses the public data sets KDD99 and UNSW-NB15 commonly used in the field of intrusion detection. The KDD99 data set contains 5 categories and 41 features. The 5 categories include 4 attack types and 1 normal class. The attack types are DoS (Denial of Service), R2U (Remote to User), U2R (User to Root) and Probing, and the normal type is Normal. The specific category sample quantity distribution and feature names are shown in Table 1 and Table 2. The UNSW-NB15 data set includes 10 categories and 49 features. The 10 attack classes include 9 attack classes and 1 normal class. The attack types are Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode and Worms, and the distribution is shown in Table 3.

[0162] Table 1 Class sample distribution of KDD99 dataset

[0163] ID Class Size Distribution(%) 1 Normal 157,871 19.61 2 Probe 8,273 1.02 3 DoS 621,311 77.17 4 U2R 280 0.03 5 R2L 17,315 2.15 Totals 805,050 100

[0164] Table 2 41 feature names of KDD99

[0165]

[0166]

[0167] Table 3 Class sample distribution of UNSW-NB15 dataset

[0168] ID Class Size Distribution(%) 1 Normal 56,000 31.94 2 Generic 40,000 22.81 3 Exploits 33,393 19.04 4 Fuzzers 18,184 10.37 5 DoS 12,264 6.99 6 Reconnaissance 10,491 5.98 7 Analysis 2,000 1.14 8 Backdoor 1,746 1 9 Shellcode 1,133 0.65 10 Worms 130 0.07 Totals 175,341 100

[0169] Data preprocessing

[0170] In the data preprocessing stage, one-hot encoding is performed on non-numerical features, such as the three character features 'protoco_type', 'service', and 'flag' in the KDD99 dataset; the maximum and minimum normalization method is used to normalize the data to avoid the influence of the data range of different features on feature selection and classification effect. The maximum and minimum normalization method is shown in formula (1).

[0171]

[0172] Evaluation indicators

[0173] This application uses evaluation indicators based on confusion matrix to verify the effectiveness of the proposed algorithm, including accuracy, precision rate (PR), recall rate (Recall), F1 value (F1-measure), false positive rate (FPR), false negative rate (FNR), Matthews correlation coefficient (MCC) and Kappa coefficient (Kappa), among which MCC and Kappa focus more on the evaluation of the overall classification performance of the model. The confusion matrix is ​​shown in Table 4. The calculation of each indicator is shown in formulas (23)-(34).

[0174] Table 4 Confusion matrix

[0175]

[0176]

[0177] Among them, TN (True Negative) indicates that the data is normal and predicted to be normal data, TP (True Positive) indicates that the data is of attack type and predicted to be attack type data, FN (False Negative) indicates that the data is of attack type but predicted to be normal data, and FP (False Positive) indicates that the data is of normal type but predicted to be attack type data.

[0178]

[0179]

[0180]

[0181]

[0182]

[0183]

[0184]

[0185]

[0186] Obsolute=Accuracy (31)

[0187]

[0188]

[0189]

[0190] The accuracy, precision, recall, F1 value, false alarm rate, and false negative rate are all greater than 0. The larger the accuracy, precision, recall, and F1 value, the better. The smaller the false alarm rate and false negative rate, the better. The value of the Matthews correlation coefficient (MCC) is between -1 and 1. When it is 1, it means a perfect prediction of the subject. When it is 0, it means that the predicted result is not as good as the random prediction result. -1 means that the predicted classification is completely inconsistent with the actual classification. The Kappa coefficient is between -1 and 1. In classification problems, since the number of samples in each category is often unbalanced, if it is not adjusted on such an unbalanced data set, the model is likely to favor large categories and abandon small categories. Therefore, even if the overall accuracy is high, the effect of some minority classes is poor. Therefore, the Kappa coefficient can be used to punish the bias of the model. Using the Kappa coefficient can score the model more objectively. The values ​​of the Matthews correlation coefficient (MCC) and Kappa coefficient are also the larger the better.

[0191] The algorithm of this application is compared with similar algorithms such as CFS-ANN algorithm, ELM-PT algorithm, RGB-GS-CNN algorithm, Rmsprop-LSTM algorithm, Conv-LSTM algorithm, HAST-IDS algorithm, and OCNN-HMLSTM algorithm in terms of multiple indicators. The experimental results are shown in Tables 5 and 6.

[0192] Table 5 Overall performance comparison of different algorithms on the KDD99 dataset

[0193]

[0194] It can be seen from Table 5 that the algorithm of the present application performs best in all indicators. Among them, the MCC and Kappa coefficients are much better than other models, reaching 0.9846 and 0.9786. The MCC coefficient can illustrate the superiority of the present application in category prediction, while the Kappa coefficient can better reflect the superiority of the classification performance of the model for unbalanced data sets.

[0195] Table 6 Overall performance comparison of different algorithms on the UNSW-NB15 dataset

[0196]

[0197] As can be seen from Table 6, except for PR and F1-measure, the other indicators of the algorithm of the present application are better than the comparison algorithm. Accuracy reached 96.69% as the highest, and FPR was the lowest compared with other algorithms, reaching 0.37%. PR is 96.82%, which has reached a relatively high value, with a small acceptable gap compared to 100%. F1-measure is the harmonic mean of PR and Recall. Therefore, although it is greatly affected by PR when the Recall value is the highest, its value has also dropped slightly, only 0.432% lower than the highest value. In addition, the MCC and Kappa coefficients of the algorithm of the present application are much higher than other classification models. Therefore, it can be explained that the algorithm of the present application has a superior classification performance compared with other models, and it also shows that the algorithm of the present application has good generalization ability and portability through automatic tuning of hyperparameters.

[0198] In order to prove the classification performance of this application algorithm on small categories, Figure 5 The confusion matrix of the algorithm of this application in each category is shown, and Table 7 is the indicator value of the algorithm in each category of the KDD99 data set. It can be seen that the accuracy of the Normal class reaches 99.6%, and the accuracy of the Dos and Probe classes also reaches 99% and 96.8%. For the R2L and U2R classes, the number of samples they contain is relatively small. In the training set of KDD99, the number of U2R samples is only 52, which causes a great class imbalance, and class imbalance is one of the important factors affecting the classification effect. In this case, the algorithm of this application can still maintain the accuracy of R2L and U2R of 0.732 and 0.714 respectively, indicating that the algorithm of this application also has certain advantages in the classification performance of small categories.

[0199] Table 7 Index values ​​of the proposed algorithm in each category of the KDD99 dataset

[0200]

[0201] Figure 6The classification confusion matrix of the algorithm in this application on the UNSW-NB15 dataset is further demonstrated.

[0202] Table 8 shows the index values ​​of the algorithm in this application on each category of the UNSW-NB15 dataset. Compared with the KDD99 dataset, the features and categories of UNSW-NB15 and KDD99 are different, but both are unbalanced datasets. Among them, the accuracy of Backdoor, Dos, Generic, Normal and Worms is relatively high, all higher than 98%, and except for the two categories of Reconnaisance and Shellcode with a small number of samples, the classification accuracy of other categories is above 90%, showing good classification performance.

[0203] Table 8 Index values ​​of the proposed algorithm in each category of the UNSW-NB15 dataset

[0204]

Claims

1. An intrusion detection method combining symmetric uncertainty and hyperparameter optimization neural network, characterized in that The following steps are involved: S1. Data preprocessing: perform one-hot encoding on non-numerical features, convert them into numerical features, and normalize the numerical values; S2, feature selection, using symmetric uncertainty to calculate the correlation between features and categories, using the approximate Markov blanket under loose conditions to calculate the redundant relationship between features, combining symmetric uncertainty with the approximate Markov blanket under loose conditions to form a joint uncertainty feature selection method to select the optimal feature subset; S3, using convolutional neural network and memory neural network to build CNN-LSTM classification model, using CNN to learn the spatial features of data, and using LSTM to learn the temporal features of data; S4. Use the improved PSO algorithm to automatically optimize the convolution kernel size filter, number of hidden neurons units, learning rate learning rate and pooling layer parameter dropout in the CNN-LSTM model, and finally determine the optimized CNN-LSTM model; Use the improved PSO algorithm to find the optimal parameters of the CNN-LSTM model, including the overall learning-rate and dropout of the model, as well as the filter in CNN and the units in LSTM, a total of four hyperparameters are optimized, thereby improving the classification performance of the CNN-LSTM model; S5. Algorithm evaluation. The intrusion detection performance of the proposed algorithm is verified on the KDD99 and UNSW-NB15 datasets. The algorithm is compared with other algorithms in terms of accuracy, precision, recall, F1 score, Matthews correlation coefficient, and Kappa correlation coefficient. This proves the superiority of the algorithm and the effectiveness of hyperparameter optimization on different datasets. In step S2, the formula for the approximate Markov blanket under loose conditions is as follows: SU(x i ,x j )-SU(x j ,C)≥δ Among them, x i and x j represents the feature, C represents the category label, δ is the loose factor, and its value range is [0,1]; The approximate Markov blanket based on loose conditions is used for clustering redundant features. If the feature x i There is a Markov blanket MB i , then, feature x i and MB i will be classified into the same cluster. If it does not exist, then add a cluster containing only x. i The number of new clusters does not need to be specified in advance. After clustering is completed, according to SU(x i ,C) values ​​are used to rank the features in each cluster. The feature ranked first in the cluster is called the dominant feature. Then the dominant features of each cluster are used to rank the clusters. The joint uncertainty feature selection method is to fully consider the joint effect formed by the combination of features under the premise of following the cluster sorting and the feature sorting within the cluster. The definition of the joint mutual information of the feature X and feature Y combined with the category label C is as follows: I(X,Y;C)=H(X,Y)+H(C)-H((X,Y),C) Among them, H(H,Y), H((X,Y),C) are defined as follows: H(C) is defined as follows: By normalizing the above joint mutual information using symmetric uncertainty, we can obtain the joint uncertainty SU(X,Y;C) of the feature X and feature Y combined with the category label C, as shown below: Among them, P(x i ) indicates variable X = x i The probability of a random variable Y = {y1,y2,…,y j }, P(x i ,y j ) is the joint probability of X and Y, H(X,Y) is the joint entropy of the two random variables X and Y; The process of feature selection based on joint uncertainty is as follows: Step 1: Select the dominant feature in the first-ranked cluster to initialize the optimal feature subset and discard other features in its cluster; Step 2: Sort the features in the cluster by their ranking order and within the cluster, starting from the dominant feature in the cluster, calculate the joint uncertainty value of the dominant feature and each feature in the optimal feature subset and sum them up, until all features in the cluster are traversed, take the feature with the largest sum of joint uncertainty values, and add it to the optimal feature subset; Step 3: Repeat step 2 until all clusters are traversed and the optimal feature subset is finally obtained; The specific method of improving the PSO algorithm in step S4 is as follows: In the velocity update equation of the particle swarm algorithm, the inertia weight ω dynamically adjusted by the cosine function is introduced. iter , which is used to control the influence of historical speed on the current moving speed of the particle, and improve the speed formula as follows: in, represents the velocity of particle i in the d-dimensional space at time t; represents the coordinate of particle i in the d-dimensional space at time t; c1 represents the cognitive factor, and c2 represents the social factor, which are collectively called the acceleration constant. The optimal position that particle i passes at time t is called the individual optimal position, gbest d For all particles The optimal position in becomes the global optimal position, iter represents the current number of iterations, iter max Indicates the maximum number of iterations, the inertia weight ω in this algorithm iter The value range is [0.1,1.1], so take ω min =0.1,ω max =1.1; r1 and r2 are random numbers between [0,1]; The calculation method of c1 and c2 is improved as follows: Among them, c 1,start 、c 1,end and c 2,start 、c 2,end The value range of is [0.5, 2.5]. At the time of initialization, in order to make the divergence stronger in the early stage of iteration and the convergence stronger in the later stage of iteration, c is set 1,start =2.5, c 1,end =0.5, c 2,start =0.5, c 2,end =0.

5.

2. The intrusion detection method of the joint symmetric uncertainty and hyperparameter optimization neural network according to claim 1 is characterized by: In step S1, the non-numerical features are encoded with one-hot encoding, and the formula of the maximum and minimum normalization method is as follows: X max and X min are the maximum and minimum values ​​of feature X respectively.

3. The intrusion detection method of the joint symmetric uncertainty and hyperparameter optimization neural network according to claim 1 is characterized by: The optimized CNN-LSTM classification model in step S4 is as follows: In the improved PSO algorithm, the optimal hyperparameter combination is found by minimizing the value of Loss. The calculation method of Loss is as follows: Loss = 1-Accuracy Among them, Accuracy represents the accuracy of model classification.

4. The intrusion detection method of the joint symmetric uncertainty and hyperparameter optimization neural network according to claim 1 is characterized by: Algorithm evaluation in step S4: First, on the KDD99 dataset, the effectiveness of the joint uncertainty feature selection method, the improved PSO algorithm and the CNN-LSTM classification model is verified, including the comparison of similar feature selection methods, the comparison of the improved PSO algorithm with the unimproved PSO algorithm, the comparison of the CNN-LSTM classification model with other classification models, and the ablation experiment comparison of the algorithms. Secondly, verify the overall performance of the algorithm, including the comparison of the algorithm with other similar algorithms in various indicators; Finally, the algorithm is applied to the UNSW-NB15 dataset to demonstrate the effectiveness of the algorithm in optimizing hyperparameters according to different data.

Images