Fine-grained network intrusion detection model training method and network intrusion detection method

Abstract

The embodiment of the present application provides a kind of training method and network intrusion detection method of fine-grained network intrusion detection model, the method comprises: obtaining network traffic sample;Network traffic sample includes labeled traffic sample and unlabeled traffic sample;According to the label corresponding to labeled traffic sample and labeled traffic sample, first initial fine-grained network intrusion detection model is trained, and second initial fine-grained network intrusion detection model is obtained;Unlabeled traffic sample is input into second initial fine-grained network intrusion detection model, and the pseudo label corresponding to unlabeled traffic sample is obtained;According to labeled traffic sample, the label corresponding to labeled traffic sample, unlabeled traffic sample, the pseudo label corresponding to unlabeled traffic sample, second initial fine-grained network intrusion detection model is trained, and the fine-grained network intrusion detection model after training is obtained.The method of the embodiment of the present application realizes the accurate detection and classification of attack type corresponding to network traffic.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security detection, and particularly relates to a training method of a fine-grained network intrusion detection model and a network intrusion detection method. BACKGROUND

[0002] The development of the Internet is accompanied by a sharp increase in network traffic size, and various malicious traffic threats may be hidden in frequent data exchange between network entities. Especially in scenarios such as smart medical care, smart city, and Internet of Vehicles, which are closely related to human life, fine-grained classification of attack types and targeted response measures can significantly reduce the risk of critical data loss and device paralysis, and help experts take targeted measures to cope with the impact of network attacks. Therefore, how to construct and train a high-performance fine-grained network intrusion detection model to achieve fine-grained attack classification has always been a topic of concern in the field of network security.

[0003] In related technologies, in the training process of a high-performance fine-grained network intrusion detection model, in order to obtain accurate network intrusion classification results, it is necessary to rely on large-scale labeled samples to train the model, but in the face of massive traffic data, the cost of sample labeling is high, thereby leading to poor training effect of the fine-grained network intrusion detection model. SUMMARY

[0004] To solve the problems in the prior art, the embodiments of the present application provide a training method of a fine-grained network intrusion detection model and a network intrusion detection method.

[0005] Specifically, the embodiments of the present application provide the following technical solutions:

[0006] In a first aspect, the embodiments of the present application provide a training method of a fine-grained network intrusion detection model, comprising:

[0007] obtaining network traffic samples; the network traffic samples include labeled traffic samples and unlabeled traffic samples;

[0008] training the first initial fine-grained network intrusion detection model according to the labeled traffic samples and the labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model;

[0009] inputting the unlabeled traffic samples into the second initial fine-grained network intrusion detection model, to obtain pseudo labels corresponding to the unlabeled traffic samples;

[0010] training the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic samples, and the pseudo labels corresponding to the unlabeled traffic samples, to obtain a trained fine-grained network intrusion detection model.

[0011] Further, the first initial fine-grained network intrusion detection model comprises:

[0012] a full connection layer; the full connection layer is used to expand the feature information of the network traffic sample;

[0013] a one-dimensional convolutional neural network model; the one-dimensional convolutional neural network model is used to extract the feature information of the expanded network traffic sample.

[0014] Further, the first initial fine-grained network intrusion detection model is trained according to the labeled traffic sample and the label corresponding to the labeled traffic sample, to obtain a second initial fine-grained network intrusion detection model, comprising:

[0015] inputting the labeled traffic sample in the network traffic sample into the first initial fine-grained network intrusion detection model to obtain a fine-grained intrusion classification result corresponding to the labeled traffic sample;

[0016] training the first initial fine-grained network intrusion detection model according to the fine-grained intrusion classification result corresponding to the labeled traffic sample, the label corresponding to the labeled traffic sample and a target loss function to obtain the second initial fine-grained network intrusion detection model; the target loss function comprises a loss function of a supervised contrast loss and a loss function of a multi-weight classification loss; the loss function of the multi-weight classification loss is used to adjust the attention degree of the model to different intrusion categories and misclassification.

[0017] Further, the loss function of the multi-weight classification loss in the target loss function is determined based on the following formula:

[0018]

[0019] wherein, M represents the number of intrusion categories corresponding to the network traffic sample; K represents the number of network traffic samples of each intrusion category; g ic ={0,1} represents a symbol function, which takes a value of 1 when the sample x i is classified into a correct intrusion category c; p ic represents the probability that the sample x i is predicted as the correct intrusion category c; w i represents a category imbalance weight, which is used to adjust the attention degree of the model to different intrusion categories; w pi represents a probability reset weight, which is used to adjust the attention degree of the model to misclassification.

[0020] Further, after inputting the unlabeled traffic sample into the second initial fine-grained network intrusion detection model to obtain a pseudo label corresponding to the unlabeled traffic sample, the method further comprises:

[0021] determine the prediction probability and uncertainty of the pseudo label corresponding to each unlabeled traffic sample;

[0022] determine the confidence of the pseudo label corresponding to each unlabeled traffic sample based on the prediction probability and uncertainty of the pseudo label corresponding to each unlabeled traffic sample.

[0023] Further, according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the unlabeled traffic sample, and the pseudo label corresponding to the unlabeled traffic sample, the second initial fine-grained network intrusion detection model is trained to obtain a trained fine-grained network intrusion detection model, including:

[0024] According to the labeled traffic sample, the label corresponding to the labeled traffic sample, the pseudo label with a confidence greater than a threshold, the unlabeled traffic sample corresponding to the pseudo label with a confidence greater than a threshold, and a target loss function, the second initial fine-grained network intrusion detection model is trained to obtain a trained fine-grained network intrusion detection model.

[0025] In a second aspect, the embodiments of the present application also provide a fine-grained network intrusion detection method, including:

[0026] Obtaining network traffic to be classified;

[0027] Inputting the network traffic to be classified into the trained fine-grained network intrusion detection model to obtain a fine-grained intrusion classification result corresponding to the network traffic, and the fine-grained network intrusion detection model is trained based on the method of the first aspect.

[0028] In a third aspect, the embodiments of the present application also provide a training device of a fine-grained network intrusion detection model, including:

[0029] The obtaining module is configured to obtain network traffic samples, and the network traffic samples include labeled traffic samples and unlabeled traffic samples;

[0030] The first training module is configured to train a first initial fine-grained network intrusion detection model according to the labeled traffic samples and the labels corresponding to the labeled traffic samples to obtain a second initial fine-grained network intrusion detection model;

[0031] The processing module is configured to input the unlabeled traffic samples into the second initial fine-grained network intrusion detection model to obtain pseudo labels corresponding to the unlabeled traffic samples;

[0032] The second training module is configured to train the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic samples, and the pseudo labels corresponding to the unlabeled traffic samples to obtain a trained fine-grained network intrusion detection model.

[0033] In a fourth aspect, an electronic device is provided, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the training method of the fine-grained network intrusion detection model according to the first aspect or the fine-grained network intrusion detection method according to the second aspect when executing the program.

[0034] In a fifth aspect, a non-transitory computer-readable storage medium is provided, which stores a computer program, and the computer program is executable on a processor to implement the training method of the fine-grained network intrusion detection model according to the first aspect or the fine-grained network intrusion detection method according to the second aspect.

[0035] In a sixth aspect, a computer program product is provided, which includes a computer program, and the computer program is executable on a processor to implement the training method of the fine-grained network intrusion detection model according to the first aspect or the fine-grained network intrusion detection method according to the second aspect.

[0036] The training method of the fine-grained network intrusion detection model and the network intrusion detection method provided by the embodiments of the present application can train the first initial fine-grained network intrusion detection model according to the labeled traffic samples and the labels corresponding to the labeled traffic samples, obtain the second initial fine-grained network intrusion detection model, input the unlabeled traffic samples into the second initial fine-grained network intrusion detection model, obtain the classification result of the attack type corresponding to the unlabeled traffic samples output by the second initial fine-grained network intrusion detection model, and further use the classification result of the attack type corresponding to the unlabeled traffic samples as the pseudo label of the unlabeled traffic samples, so as to label the attack type corresponding to the unlabeled traffic samples, solve the high cost problem of labeling massive traffic data, and improve the training efficiency of the fine-grained network intrusion detection model. Then, the second initial fine-grained network intrusion detection model is trained based on a large number of labeled network traffic samples, so that the trained fine-grained network intrusion detection model can more accurately divide the attack type corresponding to the network traffic. BRIEF DESCRIPTION OF DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present application or the prior art, the following will briefly introduce the drawings needed in the embodiments or prior art description. Obviously, the drawings in the following description are some embodiments of the present application, and those skilled in the art can obtain other drawings according to these drawings without creative labor.

[0038] Figure 1 is a flowchart of the training method of the fine-grained network intrusion detection model provided by the embodiments of the present application;

[0039] Figure 2 is a flowchart of a granular network intrusion detection method provided by an embodiment of the present application;

[0040] Figure 3 is a structural schematic diagram of a training device of a fine-grained network intrusion detection model provided by an embodiment of the present application;

[0041] Figure 4 is a structural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0042] To make the objectives, technical solutions, and advantages of the present application clearer, the technical solutions in the present application will be described below in conjunction with the accompanying drawings in the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0043] The method of the embodiment of the present application can be applied to a network security detection scene to achieve accurate detection and classification of attack types corresponding to network traffic.

[0044] In the related art, in the training process of a high-performance fine-grained network intrusion detection model, in order to obtain an accurate network intrusion classification result, a large number of labeled samples are needed to train the model, but in the face of massive traffic data, the cost of sample labeling is high, thereby resulting in poor training effect of the fine-grained network intrusion detection model.

[0045] The training method and network intrusion detection method of the fine-grained network intrusion detection model of the embodiment of the present application train the first initial fine-grained network intrusion detection model according to the labeled traffic sample and the label corresponding to the labeled traffic sample, obtain the second initial fine-grained network intrusion detection model, input the unlabeled traffic sample into the second initial fine-grained network intrusion detection model in the embodiment of the present application, and then the classification result of the attack type corresponding to the unlabeled traffic sample output by the second initial fine-grained network intrusion detection model can be obtained, and the classification result of the attack type corresponding to the unlabeled traffic sample can be used as the pseudo label of the unlabeled traffic sample, thereby realizing labeling of the attack type corresponding to the unlabeled traffic sample, solving the problem of high cost of labeling massive traffic data, and thereby improving the training efficiency of the fine-grained network intrusion detection model; and then the second initial fine-grained network intrusion detection model is trained based on a large number of labeled network traffic samples, so that the trained fine-grained network intrusion detection model can more accurately divide the attack types corresponding to the network traffic.

[0046] The technical solutions of the present application are described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes may not be described in some examples. Figures 1-4 The technical solutions of the present application are described in detail below with specific examples. The following specific examples can be combined with each other, and the same or similar concepts or processes may not be described in some examples.

[0047] Figure 1 is a flowchart of an embodiment of a training method of a fine-grained network intrusion detection model provided by the present application. As shown in Figure 1 The method provided by the present application comprises the following steps:

[0048] Step 101, obtaining network traffic samples; the network traffic samples include labeled traffic samples and unlabeled traffic samples.

[0049] Specifically, in the training process of a high-performance fine-grained network intrusion detection model, in order to obtain accurate network intrusion classification results, it is necessary to rely on large-scale labeled samples to train the model, but in the face of massive traffic data, the cost of sample labeling is high, resulting in poor training effect of the fine-grained network intrusion detection model.

[0050] To solve the above problems, in the present application, network traffic samples are first obtained; the network traffic samples include labeled traffic samples and unlabeled traffic samples; that is, the training set corresponding to the fine-grained network intrusion detection model contains a part of labeled traffic samples and a large number of unlabeled traffic samples. In the present application, only a small amount of network traffic samples need to be labeled in the training process of the fine-grained network intrusion detection model; optionally, the small amount of labeled traffic samples correspond to network traffic samples of multiple attack types.

[0051] Step 102, training the first initial fine-grained network intrusion detection model according to the labeled traffic samples and the labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model.

[0052] Specifically, after obtaining the labeled traffic samples and a large number of unlabeled traffic samples in the network traffic samples, the first initial fine-grained network intrusion detection model is trained according to the labeled traffic samples and the labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model. Optionally, the fine-grained network intrusion model is used for classifying the network traffic samples and dividing the attack types corresponding to each network traffic sample. Optionally, the network traffic sample can also be normal network traffic, that is, network traffic without network attack, and the label corresponding thereto is a normal sample. Optionally, the convolutional neural network (CNN) model is suitable for extracting feature association to generate a good representation, which helps to more accurately aggregate intra-class features. Therefore, the first initial fine-grained network intrusion detection model in the embodiment of the present application can be constructed based on a one-dimensional convolutional neural network model for image reconstruction. The first initial fine-grained network intrusion detection model and the second initial fine-grained network intrusion detection model are the same network model structure.

[0053] Step 103, inputting the unlabeled traffic sample into the second initial fine-grained network intrusion detection model to obtain a pseudo label corresponding to the unlabeled traffic sample.

[0054] Specifically, after obtaining the labeled traffic samples and a large number of unlabeled traffic samples in the network traffic samples, the first initial fine-grained network intrusion detection model is trained according to the labeled traffic samples and the labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model. Optionally, the fine-grained network intrusion model is used for classifying the network traffic samples and dividing the attack types corresponding to each network traffic sample. Optionally, the network traffic sample can also be normal network traffic, that is, network traffic without network attack, and the label corresponding thereto is a normal sample. Optionally, the convolutional neural network (CNN) model is suitable for extracting feature association to generate a good representation, which helps to more accurately aggregate intra-class features. Therefore, the first initial fine-grained network intrusion detection model in the embodiment of the present application can be constructed based on a one-dimensional convolutional neural network model for image reconstruction. The first initial fine-grained network intrusion detection model and the second initial fine-grained network intrusion detection model are the same network model structure.

[0055] Step 104, training the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic sample, and the pseudo label corresponding to the unlabeled traffic sample, to obtain a trained fine-grained network intrusion detection model; the fine-grained network intrusion detection model is used for dividing the attack types corresponding to the network traffic.

[0056] Specifically, after the unlabeled traffic sample is input into the second initial fine-grained network intrusion detection model to obtain the pseudo label corresponding to the unlabeled traffic sample, that is, the labeling of the attack type corresponding to the unlabeled traffic sample is realized, the second initial fine-grained network intrusion detection model can be trained according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the unlabeled traffic sample and the pseudo label corresponding to the unlabeled traffic sample, and the supervised training of the fine-grained network intrusion detection model is realized. That is, the known limited labeled sample is used to first train the teacher model (the first initial fine-grained network intrusion detection model), and then the teacher model is used to predict the label of the unlabeled sample as a pseudo label, so that the supervised training of the fine-grained network intrusion detection model can be realized based on the known limited labeled sample and the pseudo label of the predicted unlabeled sample, and the high cost problem of labeling massive traffic data is solved, so that the training efficiency of the fine-grained network intrusion detection model can be improved.

[0057] The method of the above embodiment trains the first initial fine-grained network intrusion detection model according to the labeled traffic sample and the label corresponding to the labeled traffic sample, obtains the second initial fine-grained network intrusion detection model, and then inputs the unlabeled traffic sample into the second initial fine-grained network intrusion detection model in the embodiment of the present application, so that the classification result of the attack type corresponding to the unlabeled traffic sample output by the second initial fine-grained network intrusion detection model can be obtained, and then the classification result of the attack type corresponding to the unlabeled traffic sample can be used as the pseudo label corresponding to the unlabeled traffic sample, so that the labeling of the attack type corresponding to the unlabeled traffic sample is realized, the high cost problem of labeling massive traffic data is solved, and the training efficiency of the fine-grained network intrusion detection model is improved; and then the second initial fine-grained network intrusion detection model is trained based on a large number of labeled network traffic samples, so that the trained fine-grained network intrusion detection model can more accurately divide the attack type corresponding to the network traffic.

[0058] In an embodiment, the first initial fine-grained network intrusion detection model comprises:

[0059] a fully connected layer; the fully connected layer is used to expand the feature information of the network traffic sample;

[0060] a one-dimensional convolutional neural network model; the one-dimensional convolutional neural network model is used to extract the feature information of the expanded network traffic sample.

[0061] Specifically, the convolutional neural network (CNN) model is suitable for extracting feature correlation to generate a good representation, which helps to more accurately aggregate intra-class features. Therefore, the embodiment of the present application constructs a first initial fine-grained network intrusion detection model based on a one-dimensional convolutional neural network. Optionally, the first initial fine-grained network intrusion detection model in the embodiment of the present application adds a fully connected (FC) layer before the traditional one-dimensional convolutional neural network (1DCNN) based on image reconstruction, wherein the fully connected layer is used to expand the feature information of the network traffic sample, achieving the purpose of expanding the input characteristics, thereby providing sufficient virtual pixels for subsequent operations. Optionally, during model training, the back propagation process allows the FC layer to learn the correct feature ordering, thereby giving the image a specific meaning. The expanded features are then reshaped into a multi-channel image, and multiple (such as 5) stacked convolutional layers are used to extract fine feature correlations. That is, by adding a fully connected (FC) layer before the traditional one-dimensional convolutional neural network (1DCNN) based on image reconstruction, the embodiment of the present application can expand and reorganize the input network traffic sample into a multi-channel image format through neurons, thereby fully utilizing the feature extraction capability of the convolutional network. It can more accurately extract the feature information of the network traffic sample, and then based on the more accurate feature information of the network traffic sample, it can more effectively train the fine-grained network intrusion detection model, and it can detect and classify the attack type based on the more accurate feature information of the network traffic sample.

[0062] Optionally, in order to jointly learn the feature extractor and the classifier, the first initial fine-grained network intrusion detection model has a projection head Proj(·) and a classification head Clf(·); wherein the projection head is a relatively narrow hidden layer that maps the sample representation r to a low-dimensional vector D p For the size of the feature embedding, the l2 norm is then used for the vector z, so that the inner product of the vector can represent the distance between samples, and the classification head is used to output the gradient of the model training to evaluate the multi-weight classification loss.

[0063] For example, the first initial fine-grained network intrusion detection model in the embodiment of the application adds a fully connected (FC) layer before the traditional image reconstruction-based one-dimensional convolutional neural network (1DCNN), which can expand the neurons through the fully connected layer to obtain correct feature ranking, provide sufficient virtual pixels for subsequent operations, and recombine into the form of an image after expansion. That is, the one-dimensional convolutional neural network is more suitable for extracting image feature information, but the effect is not very good in the task of extracting network traffic feature information. In the embodiment of the application, the task of extracting network traffic feature information is changed to the task of extracting image feature information by adding a fully connected (FC) layer before the traditional image reconstruction-based one-dimensional convolutional neural network (1DCNN), so that the network traffic feature information can be more accurately extracted, and the extracted network traffic corresponding feature information is more accurate. For example, after the one-dimensional matrix (1*70 dimensions) corresponding to the input network traffic sample in the first initial fine-grained network intrusion detection model is expanded through the fully connected layer in the first initial fine-grained network intrusion detection model, it is expanded to 1*4096, and then converted into a three-dimensional multi-layer image of 1*256*8 dimensions, which is more suitable for the one-dimensional convolutional neural network to extract the feature information corresponding to the traffic sample.

[0064] The method of the above embodiment, the first initial fine-grained network intrusion detection model adds a fully connected (FC) layer before the traditional image reconstruction-based one-dimensional convolutional neural network (1DCNN), which can expand and recombine the input network traffic sample into a multi-channel image format, realize the expansion of the feature information of the network traffic sample, achieve the purpose of expanding the input characteristics, so as to change the task of extracting network traffic feature information into the task of extracting image feature information, so that the feature extraction capability of the one-dimensional convolutional network can be fully utilized, the extracted network traffic corresponding feature information is more accurate, and then the fine-grained network intrusion detection model can be more effectively trained based on the more accurate feature information of the network traffic sample, and the attack type detection and classification can be performed based on the more accurate feature information of the network traffic sample.

[0065] In an embodiment, the first initial fine-grained network intrusion detection model is trained according to the labeled traffic sample and the label corresponding to the labeled traffic sample to obtain a second initial fine-grained network intrusion detection model, including:

[0066] The labeled traffic sample in the network traffic sample is input into the first initial fine-grained network intrusion detection model to obtain a fine-grained intrusion classification result corresponding to the labeled traffic sample;

[0067] The first initial fine-grained network intrusion detection model is trained according to the fine-grained intrusion classification result corresponding to the labeled traffic sample, the label corresponding to the labeled traffic sample and a target loss function, and a second initial fine-grained network intrusion detection model is obtained; the target loss function includes a loss function of a supervised contrast loss and a loss function of a multi-weight classification loss; the loss function of the multi-weight classification loss is used for adjusting the attention degree of the model to different intrusion categories and error classification.

[0068] Specifically, after obtaining the labeled traffic sample and a large number of unlabeled traffic samples in the network traffic sample, the labeled traffic sample in the network traffic sample is input into the first initial fine-grained network intrusion detection model in the embodiment of the application, and the fine-grained intrusion classification result corresponding to the labeled traffic sample is obtained, and then the first initial fine-grained network intrusion detection model is trained according to the fine-grained intrusion classification result corresponding to the labeled traffic sample, the label corresponding to the labeled traffic sample and the target loss function, and the second initial fine-grained network intrusion detection model is obtained; that is, the target loss function is used as the optimization target of the model in the embodiment of the application, and the target loss function is realized by combining the supervised contrast loss and the multi-weight classification loss, so as to solve the problem that the intrusion detection performance is limited due to the unbalanced category distribution in the network traffic sample.

[0069] Optionally, for a sample x i , the feature vector of the sample is z i , and the feature vector of the sample x i with the same label is regarded as a positive pair, and is defined as Therefore , the feature vector set of the positive pair is represented, and the supervised contrast loss can be represented as:

[0070]

[0071]

[0072] , wherein N b represents the batch size during model training. τ + represents a temperature coefficient, which is used for adjusting the attention of the model to the distance between samples, the supervised contrast loss L SCl calculates the weighted average value of the similarity between x i and all positive pairs thereof, and the calculation of the loss function flexibly contains any number of positive samples and is used for optimizing the consistency between them. Optionally, the supervised contrast loss shortens the distance between samples of the same category, and the greater the loss, the more the model will pay attention to it, that is, the model will shorten the distance between samples of the same category as the target of the model attention, so that the same samples can be shortened through the supervised contrast loss.

[0073] Optionally, the loss function of the multi-weight classification loss in the target loss function is determined based on the following formula:

[0074]

[0075] wherein M represents the number of intrusion categories corresponding to the network traffic sample; K represents the number of network traffic samples of each intrusion category; g ic ={0,1} represents a sign function, which takes a value of 1 when the sample x i is classified into the correct intrusion category c; p ic represents the probability that the sample x i is predicted to be the correct intrusion category c; w i represents a category imbalance weight, which is used to adjust the attention degree of the model to different intrusion categories; w pi represents a probability reset weight, which is used to adjust the attention degree of the model to misclassification.

[0076] Specifically, the class imbalance of the fine-grained traffic causes the dataset input into the model to have a low-frequency class with a very small number of samples, and directly using the proportion of the number of samples of the class as the weight of the classification loss may cause overfitting and destroy the learned feature representation. Therefore, in the embodiment of the present application, the category imbalance weight w i is used to adjust the attention degree of the model to different categories.

[0077]

[0078] wherein N min represents the number of samples of the smallest category, and N i represents the number of samples contained in each category i. The constant n is used to prevent overcorrection of the weight, and the logarithmic calculation is used to smooth the distribution of the weight w i . Optionally, the smaller the number of samples corresponding to the attack type, the larger the category imbalance weight w i , and the higher the attention degree of the model to the prediction result of the category.

[0079] Another problem that needs attention is the misclassification of attack samples and normal samples. To solve this problem, in the embodiment of the present application, the probability reset weight w p is used to directly adjust the prediction probability of the model, so as to change the attention degree of the model to different misclassifications; optionally, all attack types are regarded as the same category, and at this time, the fine-grained classification problem can be regarded as a binary classification problem.

[0080]

[0081] wherein y represents the predicted label, and y iFor real labels, when the model confuses normal samples and abnormal samples, the parameter a is activated to adjust the attention of the model to this misclassification. N represents that the normal samples are not confused, and A represents that the normal samples and abnormal samples are confused. Optionally, if the model misclassifies normal traffic samples and abnormal traffic samples, it will be punished and the distance between different categories will be pulled apart, so that the model will not misclassify the attack type corresponding to the samples.

[0082] That is, the performance of the fine-grained intrusion detection scheme in the case of class imbalance is affected by two key factors: 1) the class imbalance problem causes the feature distribution learned from the typical cross-entropy to be highly skewed; 2) some difficult-to-classify attack samples often exhibit similar patterns to normal attack samples, making their feature distributions very close, and the model has difficulty obtaining clear classification boundaries. In the embodiment of the present application, the target loss function is taken as the optimization target of the model, and through the supervised contrast loss loss function and the multi-weight classification loss loss function in the target loss function, the classification boundary between unbalanced classes can be made clearer and the intra-class sample distribution of the same class can be made more compact, so that the fine-grained network intrusion detection model trained based on the target loss function can also accurately detect and classify the attack type corresponding to the smaller number of samples in the network traffic samples, effectively solving the problem of limited intrusion detection performance caused by the class distribution imbalance in the network traffic samples.

[0083] Optionally, the target loss function L HY is expressed as a linear combination of supervised contrast loss and multi-weight classification loss:

[0084]

[0085] In order to make the fine-grained network intrusion detection model obtain good feature representation in the early training stage and improve the classification performance in the later training stage, the parameter β in the embodiment of the present application is used to adjust the weight of different losses in inverse proportion to the growth of training epoch, so as to better perform feature learning and help simplify the training of the classifier.

[0086] The method of the above embodiment is used to solve the class imbalance problem of network traffic samples. The target loss function in the embodiment of the present application combines supervised contrast learning and multi-weight classification cross-entropy loss to ensure good feature extraction to guide the unbiased classifier, so that the classification boundary between unbalanced classes is clearer and the intra-class sample distribution of the same class is more compact, so that the fine-grained network intrusion detection model trained based on the target loss function can also accurately detect and classify the attack type corresponding to the smaller number of samples in the network traffic samples, effectively solving the problem of limited intrusion detection performance caused by the class distribution imbalance in the network traffic samples.

[0087] In an embodiment, after the unlabeled traffic sample is input into the second initial fine-grained network intrusion detection model to obtain the pseudo label corresponding to the unlabeled traffic sample, the method further comprises:

[0088] determining the prediction probability and uncertainty of the pseudo label corresponding to each unlabeled traffic sample;

[0089] determining the confidence of the pseudo label corresponding to each unlabeled traffic sample based on the prediction probability and uncertainty of the pseudo label corresponding to each unlabeled traffic sample.

[0090] Specifically, in the embodiment of the present application, the unlabeled traffic sample is input into the second initial fine-grained network intrusion detection model, so that the classification result of the attack type corresponding to the unlabeled traffic sample output by the second initial fine-grained network intrusion detection model can be obtained, and then the classification result of the attack type corresponding to the unlabeled traffic sample can be used as the pseudo label corresponding to the unlabeled traffic sample, so that the labeling of the attack type corresponding to the unlabeled traffic sample is realized, the high cost problem of labeling massive traffic data is solved, and the training efficiency of the fine-grained network intrusion detection model is improved.

[0091] Optionally, the pseudo label noise problem affects the performance of self-training, so in order to improve the training effect of the model, the confidence of the pseudo label corresponding to each unlabeled traffic sample needs to be determined, so that the pseudo label is screened based on the confidence of the pseudo label, and then the network traffic sample corresponding to the high-confidence pseudo label after screening is used for training of the model, which can effectively reduce the pseudo label noise problem and improve the training effect of the model.

[0092] Optionally, in the embodiment of the present application, the label filtering method based on uncertainty reduces the pseudo label noise problem. Specifically, in the embodiment of the present application, when predicting the pseudo label of the unlabeled sample, the uncertainty of the predicted label is evaluated by opening the model Dropout layer, and the prediction probability is used as a reference for the confidence of the pseudo label; wherein each dropout layer closes the neurons with a certain probability when evaluating, and the pseudo label of each sample is predicted T times, which conforms to the Bernoulli distribution. Therefore, the prediction probability of the pseudo label is represented as:

[0093]

[0094] wherein represents the model parameters at each evaluation, x i is the input sample, and f(·) represents the model. Optionally, the label uncertainty can be represented as:

[0095]

[0096] In the embodiment of the application, the pseudo label of each network traffic sample is predicted T times, and the label uncertainty represents the variance of the probability of each prediction in the T times; in the process of each prediction, the neurons in the one-dimensional convolutional neural network model are randomly turned off, so the result of each prediction may be different. Alternatively, if the certainty of the prediction result is high, that is, the prediction result has a low uncertainty, even if the neurons are randomly turned off in the process of each prediction, the network traffic sample in the T times of prediction process will be classified into a certain type of attack; if the certainty of the prediction result is low, that is, the prediction result has a high uncertainty, the T times of prediction results of the network traffic sample will change greatly when the neurons are randomly turned off in the process of each prediction; that is, the uncertainty of the pseudo label corresponding to the network traffic sample can fully and accurately reflect the reliability of the model in classifying the attack type corresponding to the network traffic sample.

[0097] Alternatively, the reliable high-confidence pseudo label has a high prediction probability and a low uncertainty. The pseudo label screening criterion is represented as:

[0098]

[0099] wherein, represents a pseudo label filter, k p and τ p respectively represent the threshold values of the uncertainty and the prediction probability. It is worth noting that not all pseudo labels are put back into the original training set, because this may cause an increase in class imbalance and ignore the samples that are difficult to classify. Therefore, the Borderline-SMOTE method can be used to resample the predicted pseudo labels, and some samples are generated near the classification boundary to correct the pseudo label imbalance problem. In order to not destroy the feature representation learned under the unbalanced condition, the resampling is performed according to the distribution close to the marked sample, so as to control the class imbalance degree (the ratio of the number of the most sample class to the least sample class in the sample) within a certain threshold.

[0100] The method of the above embodiment realizes accurate and effective evaluation of the confidence of the pseudo label corresponding to each unlabeled traffic sample through the two dimensions of the class prediction probability and the uncertainty of the sample, and then uses the network traffic sample corresponding to the pseudo label with a confidence higher than the threshold after screening to train the model, which can effectively reduce the pseudo label noise problem and improve the training effect of the model.

[0101] In an embodiment, the second initial fine-grained network intrusion detection model is trained according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the unlabeled traffic sample, and the pseudo label corresponding to the unlabeled traffic sample, to obtain a trained fine-grained network intrusion detection model, including:

[0102] According to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the pseudo labels with the confidence greater than the threshold, the unlabeled traffic samples corresponding to the pseudo labels with the confidence greater than the threshold, and the target loss function, the second initial fine-grained network intrusion detection model is trained to obtain a trained fine-grained network intrusion detection model.

[0103] Specifically, after the unlabeled traffic samples are input into the second initial fine-grained network intrusion detection model to obtain the pseudo labels corresponding to the unlabeled traffic samples, and the network traffic samples corresponding to the pseudo labels with the confidence higher than the threshold are accurately and effectively screened based on the two dimensions of the prediction probability and the uncertainty of the pseudo labels corresponding to each unlabeled traffic sample, the second initial fine-grained network intrusion detection model can be trained according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the pseudo labels with the confidence greater than the threshold, the unlabeled traffic samples corresponding to the pseudo labels with the confidence greater than the threshold, and the target loss function to obtain a trained fine-grained network intrusion detection model. That is, the known limited labeled samples are used to first train a teacher model (the first initial fine-grained network intrusion detection model), and then the teacher model is used to predict the labels of the unlabeled samples as pseudo labels, and then the unlabeled network traffic samples corresponding to the pseudo labels with high confidence and the original labeled network traffic samples can be combined to train a student model (the second initial fine-grained network intrusion detection model). In the embodiment of the application, based on the known limited labeled samples and the unlabeled samples corresponding to the pseudo labels with high confidence, the supervised training of the fine-grained network intrusion detection model can be realized, the high cost problem of labeling the massive traffic data and the pseudo label noise problem are solved, and thus the training efficiency and accuracy of the fine-grained network intrusion detection model can be improved.

[0104] The method of the above embodiment combines the unlabeled network traffic samples corresponding to the pseudo labels with high confidence and the original labeled network traffic samples to train the second initial fine-grained network intrusion detection model, so that the supervised training of the fine-grained network intrusion detection model can be realized, the high cost problem of labeling the massive traffic data and the pseudo label noise problem are solved, and thus the training efficiency and accuracy of the fine-grained network intrusion detection model can be improved.

[0105] In an embodiment, a fine-grained network intrusion detection method comprises:

[0106] Obtaining network traffic to be classified;

[0107] Inputting the network traffic to be classified into the trained fine-grained network intrusion detection model to obtain a fine-grained intrusion classification result corresponding to the network traffic, wherein the fine-grained network intrusion detection model is trained by any of the above methods.

[0108] Specifically, after training a second initial fine-grained network intrusion detection model by merging unlabeled network traffic samples corresponding to high-confidence pseudo-labels with the original labeled network traffic samples, the trained fine-grained network intrusion detection model can be used to detect and classify the network traffic to be classified. Optionally, the network traffic to be classified is first obtained, and then the network traffic to be classified is input into the trained fine-grained network intrusion detection model to obtain the fine-grained intrusion classification result corresponding to the network traffic, thus achieving accurate classification of the attack type corresponding to the network traffic to be classified.

[0109] For example, such as Figure 2 The flowchart shown is a diagram of a fine-grained network intrusion detection method. First, labeled network traffic samples D are processed. L Input the first initial fine-grained network intrusion detection model for training, with its label y l The network traffic samples are labeled with their corresponding attack types. Circles represent normal network traffic samples, squares represent network traffic samples of attack type 1, and triangles represent network traffic samples of attack type 2. Optionally, the number of normal network traffic samples is greater than the number of network traffic samples of attack type 2 and the number of network traffic samples of attack type 1. The first initial fine-grained network intrusion detection model is trained using the network traffic samples and their corresponding labels to obtain a second initial fine-grained network intrusion detection model. Optionally, the fine-grained network intrusion detection model includes fully connected layers and a one-dimensional convolutional neural network model, wherein the fully connected layers are used to extend... The feature information of network traffic samples is extracted using a one-dimensional convolutional neural network model. This involves expanding the input network traffic sample to 1*2048 through a fully connected layer, then converting it to 1*16*128, essentially transforming it into 16 iterations of 128-dimensional data. This reconstructs a multi-channel image, transforming the input network traffic sample into a 16-dimensional image. This transforms the task of extracting network traffic features into extracting image features, fully leveraging the feature extraction capabilities of the one-dimensional convolutional network to ensure more accurate extraction of network traffic features. Optionally, after obtaining the second initial fine-grained network intrusion detection model, the unlabeled network traffic sample D... U By inputting the second initial fine-grained network intrusion detection model, we can obtain unlabeled network traffic samples D. UThe corresponding pseudo label, and based on the prediction probability and uncertainty of the pseudo label corresponding to each unlabeled traffic sample, the confidence of the pseudo label corresponding to each unlabeled traffic sample is determined, the pseudo label with high confidence is screened out, and then the network traffic sample corresponding to the pseudo label with confidence higher than the threshold after screening is used for training of the model, so that the pseudo label noise problem can be effectively reduced, and the training effect of the model is improved. Optionally, after screening out the pseudo label with high confidence, the second initial fine-grained network intrusion detection model can be trained according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the pseudo label with confidence greater than the threshold, the unlabeled traffic sample corresponding to the pseudo label with confidence greater than the threshold and the target loss function, to obtain the trained fine-grained network intrusion detection model; wherein the target loss function includes a loss function of a supervised contrast loss and a loss function of a multi-weight classification loss; the loss function of the multi-weight classification loss is used to adjust the attention degree of the model to different intrusion categories and incorrect classification, so that the classification boundary between unbalanced categories is clearer and the intra-class sample distribution of the same category is more compact, so that the fine-grained network intrusion detection model trained based on the target loss function can also accurately detect and classify the attack type corresponding to the smaller number of samples in the network traffic sample, effectively solving the problem of limited intrusion detection performance caused by unbalanced category distribution in the network traffic sample.

[0110] Optionally, the fine-grained network intrusion detection model in the fine-grained network intrusion detection method of the embodiment of the application can be trained based on the following steps:

[0111] Step one: using the proposed backbone model to perform supervised learning on the labeled samples in the limited training set to obtain a teacher model

[0112] Step two: using the backbone model trained in step one to evaluate the unlabeled samples in the training set to generate pseudo labels of the unlabeled samples

[0113] Step three: screening the pseudo labels according to the confidence to obtain samples with pseudo labels

[0114] Step four: merging the screened samples and the original labeled samples to retrain the backbone model

[0115] Step five: using the model trained in step four to evaluate the test set

[0116] Step six: repeating steps one to five until the optimal performance of the model on the test set is obtained.

[0117] The fine-grained network intrusion detection method of the embodiment of the application considers the problems of insufficient labeled samples and limited intrusion detection performance caused by class distribution imbalance, realizes attack classification in the case of insufficient labeled samples and class imbalance, realizes high-performance fine-grained attack classification in the case of insufficient labeled samples and extremely unbalanced class distribution, solves two challenge problems in the prior art, the first challenge is the lack of labeled samples. In the face of massive traffic data, the cost of sample labeling is high, and professional knowledge is needed, which makes it difficult for the model to obtain the optimal classification effect. The second challenge is that the real fine-grained traffic often shows a long-tail distribution with serious class imbalance, which will cause the generation of "label bias" in the training process, and the decision boundary is driven by the head class with more quantity. In the embodiment of the application, the classification result of the attack type corresponding to the unlabeled traffic sample is used as the pseudo label of the unlabeled traffic sample, so as to realize the labeling of the attack type corresponding to the unlabeled traffic sample, solve the high cost problem of labeling massive traffic data, and thus improve the training efficiency of the fine-grained network intrusion detection model; through the two dimensions of the sample class prediction probability and the uncertainty of the model, the confidence of the pseudo label corresponding to each unlabeled traffic sample is accurately and effectively evaluated, and then the network traffic sample corresponding to the pseudo label with a confidence higher than a threshold is used for model training, which can effectively reduce the pseudo label noise problem and improve the training effect of the model; the target loss function combines supervised contrast learning and multi-weight classification cross-entropy loss to ensure good feature extraction to guide the unbiased classifier, so that the classification boundary between unbalanced classes is clearer and the intra-class sample distribution of the same class is more compact, so that the fine-grained network intrusion detection model trained based on the target loss function can also accurately detect and classify the attack type corresponding to the smaller number of network traffic samples, effectively solving the problem of limited intrusion detection performance caused by class distribution imbalance in network traffic samples.

[0118] For example, in order to verify the effect of the training method of the fine-grained network intrusion detection model proposed in the application, two classic data sets NSL-KDD and CICIDS2017 are used for verification.

[0119] The NSL-KDD data set contains 41 features. Among them, there are 77,054 normal traffic and 71,463 abnormal traffic. In the performance verification experiment of the scheme, 80% of the data set is used for training, and the remaining 20% is used as the test set. 1% of the training samples are labeled. After the data set is divided, some classes contain too few labeled samples, so we merge these samples and use "ATTACK" as the unified class label.

[0120] The CICIDS2017 dataset contains 2,830,743 traffic samples, each with 78 attributes. Similarly, 80% of the data is used as the training set, with 1% of the samples labeled, and we merge the classes with similar attacks after dividing the labeled samples. Finally, the above two datasets have 11 classes (10 attack classes + 1 normal class) participating in training. Table 1 shows the number of samples and class names participating in training.

[0121] Table 1 Dataset Description

[0122]

[0123] where "Train" represents the number of labeled samples in the training set.

[0124] The evaluation indicators of the scheme include accuracy, precision, recall, and F1-score. In the unbalanced classification task, more attention needs to be paid to precision and F1-score. We use Marco-F1 instead of the default Micro-F1, because this indicator can equally focus on each class with an imbalance relationship, and more objectively reflect the classification performance.

[0125] In addition to some classic supervised models, we also selected the well-performing semi-supervised model FixMatch and the state-of-the-art semi-supervised intrusion detection model Semi-WCT as the baseline model for comparison. Tables 2 and 3 show the fine-grained intrusion detection performance of the proposed model SF-IDS on the NSL-KDD and CICIDS2017 datasets, respectively.

[0126] Table 2 Comparison Experiment Results on 1% Labeled NSL-KDD Dataset

[0127]

[0128] According to Table 2, the proposed SF-IDS achieves the best results on four performance evaluation indicators of the 1% labeled NSL-KDD dataset, and achieves the highest precision in 7 of the 11 fine-grained attack categories. Compared with the optimal contrast model, the precision is improved by 2.84%, and Marco-F1 is improved by 3.00%. This is because SF-IDS fully utilizes the value of unlabeled data through self-training, and combines the proposed hybrid loss function to obtain more compact class features and clearer classification boundaries. In contrast, some traditional machine learning and supervised models are limited by the amount of labeled samples, making feature learning difficult. The advantage of the FixMatch method depends on data augmentation, but this may not be suitable for traffic data. Semi-WTC resamples the data before training, which makes it difficult for the model to adapt to the extremely unbalanced class distribution.

[0129] Table 3 Comparative experimental results of 1% labeled CICIDS2017 dataset

[0130]

[0131] Table 3 verifies the fine-grained classification performance of the proposed SF-IDS on the CICIDS2017 dataset. SF-IDS achieves the best overall indicators, with a precision improvement of 3.08% and a Marco-F1 improvement of 2.71%. It also has the most SOTA results in fine-grained classification.

[0132] The training device of the fine-grained network intrusion detection model provided by the application is described below. The training device of the fine-grained network intrusion detection model described below can be mutually corresponding to the training method of the fine-grained network intrusion detection model described above.

[0133] Figure 3 is a structural schematic diagram of the training device of the fine-grained network intrusion detection model provided by the application. The training device of the fine-grained network intrusion detection model provided in this embodiment comprises:

[0134] The acquisition module 710 is configured to acquire network traffic samples. The network traffic samples include labeled traffic samples and unlabeled traffic samples.

[0135] The first training module 720 is configured to train the first initial fine-grained network intrusion detection model according to the labels corresponding to the labeled traffic samples and the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model.

[0136] The processing module 730 is configured to input the unlabeled traffic samples into the second initial fine-grained network intrusion detection model to obtain pseudo labels corresponding to the unlabeled traffic samples.

[0137] The second training module 740 is configured to train the second initial fine-grained network intrusion detection model according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the unlabeled traffic sample, and the pseudo label corresponding to the unlabeled traffic sample, to obtain the trained fine-grained network intrusion detection model.

[0138] Optionally, the first initial fine-grained network intrusion detection model comprises:

[0139] a full connection layer, the full connection layer being configured to expand feature information of the network traffic sample;

[0140] a one-dimensional convolutional neural network model, the one-dimensional convolutional neural network model being configured to extract the expanded feature information of the network traffic sample.

[0141] Optionally, the first training module 720 is specifically configured to input the labeled traffic sample in the network traffic sample into the first initial fine-grained network intrusion detection model, to obtain a fine-grained intrusion classification result corresponding to the labeled traffic sample.

[0142] The first initial fine-grained network intrusion detection model is trained according to the fine-grained intrusion classification result corresponding to the labeled traffic sample, the label corresponding to the labeled traffic sample, and a target loss function, to obtain the second initial fine-grained network intrusion detection model; the target loss function comprises a loss function of a supervised contrast loss and a loss function of a multi-weight classification loss; the loss function of the multi-weight classification loss is configured to adjust the attention degree of the model to different intrusion categories and misclassification.

[0143] Optionally, the loss function of the multi-weight classification loss in the target loss function is determined based on the following formula:

[0144]

[0145] wherein M represents the number of intrusion categories corresponding to the network traffic sample; K represents the number of network traffic samples of each intrusion category; g ic ={0,1} represents a sign function, which takes a value of 1 when the sample x i is classified into a correct intrusion category c; p ic represents a probability that the sample x i is predicted to be the correct intrusion category c; w i represents a category imbalance weight, which is configured to adjust the attention degree of the model to different intrusion categories; w pi represents a probability reset weight, which is configured to adjust the attention degree of the model to misclassification.

[0146] Optionally, the processing module 730 is further configured to determine a prediction probability and an uncertainty degree of the pseudo label corresponding to each unlabeled traffic sample.

[0147] Based on the prediction probability and the uncertainty of the pseudo label corresponding to each unlabeled traffic sample, a confidence of the pseudo label corresponding to each unlabeled traffic sample is determined.

[0148] Optionally, the second training module 740 is specifically configured to: train the second initial fine-grained network intrusion detection model according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the pseudo label with the confidence greater than the threshold, the unlabeled traffic sample corresponding to the pseudo label with the confidence greater than the threshold, and the target loss function, to obtain the trained fine-grained network intrusion detection model.

[0149] The device of the embodiment of the application is used to execute the method in any of the foregoing method embodiments, and has similar implementation principles and technical effects, which will not be described herein again.

[0150] Figure 4 An example of an entity structure diagram of an electronic device is shown, which can include a processor 810, a communications interface 820, a memory 830, and a communications bus 840, wherein the processor 810, the communications interface 820, and the memory 830 complete mutual communication through the communications bus 840. The processor 810 can invoke a logical instruction in the memory 830 to execute a training method of a fine-grained network intrusion detection model, which includes: obtaining network traffic samples; the network traffic samples include labeled traffic samples and unlabeled traffic samples; training a first initial fine-grained network intrusion detection model according to the labeled traffic samples and labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model; inputting the unlabeled traffic samples into the second initial fine-grained network intrusion detection model, to obtain pseudo labels corresponding to the unlabeled traffic samples; and training the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic samples, and the pseudo labels corresponding to the unlabeled traffic samples, to obtain a trained fine-grained network intrusion detection model.

[0151] In addition, the logical instructions in the memory 830 described above can be implemented in the form of a software function unit and sold or used as an independent product, and can be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present application essentially or the part that contributes to the prior art or part of the technical solutions can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a plurality of instructions to make a computer device (which can be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the method described in various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM, Read-Only Memory), a random access memory (RAM, Random Access Memory), a magnetic disk or an optical disk, and various media that can store program codes.

[0152] In another aspect, the present application also provides a computer program product, which comprises a computer program stored on a non-transitory computer readable storage medium, and the computer program comprises program instructions, when the program instructions are executed by a computer, the computer can execute the training method of the fine-grained network intrusion detection model provided by the above-mentioned method, and the method comprises: obtaining network traffic samples; the network traffic samples comprise labeled traffic samples and unlabeled traffic samples; training a first initial fine-grained network intrusion detection model according to the labels corresponding to the labeled traffic samples and the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model; inputting the unlabeled traffic samples into the second initial fine-grained network intrusion detection model to obtain pseudo labels corresponding to the unlabeled traffic samples; training the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic samples and the pseudo labels corresponding to the unlabeled traffic samples, to obtain a trained fine-grained network intrusion detection model.

[0153] In yet another aspect, the present application also provides a non-transitory computer-readable storage medium having stored thereon a computer program, which, when executed by a processor, implements the method for training a fine-grained network intrusion detection model as described above, the method comprising: obtaining network traffic samples; the network traffic samples comprising labeled traffic samples and unlabeled traffic samples; training a first initial fine-grained network intrusion detection model according to labels corresponding to the labeled traffic samples and the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model; inputting the unlabeled traffic samples into the second initial fine-grained network intrusion detection model, to obtain pseudo labels corresponding to the unlabeled traffic samples; and training the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic samples, and the pseudo labels corresponding to the unlabeled traffic samples, to obtain a trained fine-grained network intrusion detection model.

[0154] The device embodiments described above are merely illustrative, wherein the units described as separate components can or can not be physically separated, and the components displayed as units can or can not be physical units, i.e., can be located in one place or distributed on multiple network units. Part or all of the modules can be selected to achieve the purpose of the embodiment according to actual needs. Those skilled in the art can understand and implement without creative labor.

[0155] From the above description of the embodiments, those skilled in the art can clearly understand that the embodiments can be implemented by means of software and the necessary general hardware platform, and of course, can also be implemented by hardware. Based on such understanding, the above technical solutions can be embodied in the form of a software product, which can be stored in a computer readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes a number of instructions to make a computer device (which can be a personal computer, server, or network device, etc.) execute the methods described in each embodiment or some parts of the embodiments.

[0156] Finally, it should be noted that: the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that: it can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacement to some technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for training a fine-grained network intrusion detection model, characterized in that, The method comprises the following steps: acquiring network traffic samples; the network traffic samples comprise labeled traffic samples and unlabeled traffic samples; training a first initial fine-grained network intrusion detection model according to the labeled traffic samples and labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model; inputting the unlabeled traffic samples into the second initial fine-grained network intrusion detection model, to obtain pseudo labels corresponding to the unlabeled traffic samples; training the second initial fine-grained network intrusion detection model according to the labeled traffic samples, labels corresponding to the labeled traffic samples, the unlabeled traffic samples and the pseudo labels corresponding to the unlabeled traffic samples, to obtain a trained fine-grained network intrusion detection model; the fine-grained network intrusion detection model is used for dividing the attack types corresponding to network traffic; the first initial fine-grained network intrusion detection model comprises: a fully connected layer; the fully connected layer is used for expanding feature information of the network traffic samples; a one-dimensional convolutional neural network model; the one-dimensional convolutional neural network model is used for extracting the expanded feature information of the network traffic samples; the training of the first initial fine-grained network intrusion detection model according to the labeled traffic samples and labels corresponding to the labeled traffic samples, to obtain the second initial fine-grained network intrusion detection model, comprises the following steps: inputting the labeled traffic samples in the network traffic samples into the first initial fine-grained network intrusion detection model, to obtain fine-grained intrusion classification results corresponding to the labeled traffic samples; training the first initial fine-grained network intrusion detection model according to the fine-grained intrusion classification results corresponding to the labeled traffic samples, labels corresponding to the labeled traffic samples and a target loss function, to obtain the second initial fine-grained network intrusion detection model; the target loss function comprises a loss function of a supervised contrast loss and a loss function of a multi-weight classification loss; the loss function of the multi-weight classification loss is used for adjusting the attention degree of the model to different intrusion categories and error classifications; the loss function of the multi-weight classification loss in the target loss function is determined based on the following formula: ； where M represents the number of intrusion categories corresponding to the network traffic sample; K represents the number of network traffic samples of each intrusion category; is an indicator function that takes the value 1 when the sample is classified into the correct intrusion category ; is the probability of the sample ; is a class imbalance weight used to adjust the degree of attention of the model to different intrusion categories; is a probability reset weight used to adjust the degree of attention of the model to misclassification. 2.The method of claim 1, wherein, after the inputting of the unlabeled traffic samples into the second initial fine-grained network intrusion detection model, to obtain the pseudo labels corresponding to the unlabeled traffic samples, the method further comprises the following steps: determining prediction probabilities and uncertainties of the pseudo labels corresponding to each unlabeled traffic sample; determining confidence degrees of the pseudo labels corresponding to each unlabeled traffic sample based on the prediction probabilities and the uncertainties of the pseudo labels corresponding to each unlabeled traffic sample. 3.The method of claim 2, wherein, the training of the second initial fine-grained network intrusion detection model according to the labeled traffic samples, labels corresponding to the labeled traffic samples, the unlabeled traffic samples and the pseudo labels corresponding to the unlabeled traffic samples, to obtain the trained fine-grained network intrusion detection model, comprises the following steps: The second initial fine-grained network intrusion detection model is trained according to the labeled traffic sample, the label corresponding to the labeled traffic sample, the pseudo label with a confidence greater than a threshold, the unlabeled traffic sample corresponding to the pseudo label with a confidence greater than a threshold, and a target loss function, to obtain the fine-grained network intrusion detection model after training.

4. A network intrusion detection method characterized by, The method comprises the steps of: Obtaining network traffic to be classified; The network traffic to be classified is input into the fine-grained network intrusion detection model after training to obtain a fine-grained intrusion classification result corresponding to the network traffic, wherein the fine-grained network intrusion detection model is trained based on the method in any one of claims 1-3.

5. A training device for a fine-grained network intrusion detection model, characterized in that, The method comprises the steps of: An obtaining module is configured to obtain network traffic samples. The network traffic samples comprise labeled traffic samples and unlabeled traffic samples. A first training module is configured to train a first initial fine-grained network intrusion detection model according to the labeled traffic samples and labels corresponding to the labeled traffic samples, to obtain a second initial fine-grained network intrusion detection model; the first initial fine-grained network intrusion detection model comprises a full connection layer, a one-dimensional convolutional neural network model, and the full connection layer is configured to expand feature information of the network traffic samples, and the one-dimensional convolutional neural network model is configured to extract the expanded feature information of the network traffic samples. The training of the first initial fine-grained network intrusion detection model according to the labeled traffic samples and the labels corresponding to the labeled traffic samples to obtain the second initial fine-grained network intrusion detection model comprises the steps of: The labeled traffic samples in the network traffic samples are input into the first initial fine-grained network intrusion detection model to obtain fine-grained intrusion classification results corresponding to the labeled traffic samples; the first initial fine-grained network intrusion detection model is trained according to the fine-grained intrusion classification results corresponding to the labeled traffic samples, the labels corresponding to the labeled traffic samples, and a target loss function to obtain the second initial fine-grained network intrusion detection model; the target loss function comprises a loss function of a supervised contrast loss and a loss function of a multi-weight classification loss; the loss function of the multi-weight classification loss is configured to adjust the attention degree of the model to different intrusion categories and incorrect classifications; The loss function of the multi-weight classification loss in the target loss function is determined based on the following formula: ； where M represents the number of intrusion categories corresponding to the network traffic sample; K represents the number of network traffic samples of each intrusion category; is an indicator function that takes the value 1 when the sample is classified into the correct intrusion category; is the probability of the sample is the class imbalance weight, which is used to adjust the attention degree of the model to different intrusion categories; is the probability reset weight, which is used to adjust the attention degree of the model to the wrong classification.​​ A processing module is configured to input the unlabeled traffic samples into the second initial fine-grained network intrusion detection model to obtain pseudo labels corresponding to the unlabeled traffic samples; A second training module is configured to train the second initial fine-grained network intrusion detection model according to the labeled traffic samples, the labels corresponding to the labeled traffic samples, the unlabeled traffic samples, and the pseudo labels corresponding to the unlabeled traffic samples, to obtain a fine-grained network intrusion detection model after training; the fine-grained network intrusion detection model is configured to divide attack types corresponding to network traffic.

6. An electronic device comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, The processor implements the training method of the fine-grained network intrusion detection model or the network intrusion detection method when the program is executed.

Images