An internet intrusion detection method and device based on an optimized correlation vector machine

Abstract

The application discloses an internet intrusion detection method and device based on an optimized related vector machine, and the method comprises the following steps: acquiring an NSL-KDD data set, including a training set and a test set; performing non-numerical one-hot encoding and numerical normalization processing on the NSL-KDD data set to obtain the preprocessed training set and test set; inputting the preprocessed training set into a related vector machine model which is pre-constructed and optimized based on an improved crow search algorithm to perform training, and obtaining the optimized and trained related vector machine model; inputting the preprocessed test set into the optimized and trained related vector machine model to perform testing, and obtaining a classification detection result. The application has better convergence, and can improve the classification accuracy of the intrusion detection data set and reduce the false positive rate.

Description

Technical Field

[0001] This invention relates to an Internet intrusion detection method and apparatus based on an optimized correlation vector machine, belonging to the field of Internet network security technology. Background Technology

[0002] With the development of the internet and the increasing complexity of the network environment, network security protection faces enormous challenges. Intrusion detection technology, as an important security mechanism, has become a research hotspot. As a proactive defense technology, it can identify attack behaviors or abnormal access behaviors occurring within a system, enabling timely security measures to be taken.

[0003] Currently, researchers are widely exploring the application of machine learning and deep learning in intrusion detection. Machine learning in intrusion detection relies on learning features from intrusion detection datasets to classify normal and attacking data. Relevance Vector Machines (RVMs) are sparse probabilistic models similar to Support Vector Machines, offering stronger sparsity and generalization capabilities. They are not constrained by the Messi theorem in kernel function selection and do not require a penalty factor, making them suitable for large-scale datasets like those used in intrusion detection. However, RVMs are prone to getting trapped in local optima and are highly dependent on initial parameters. Therefore, the appropriate values ​​of kernel parameters and hyperparameters are key factors limiting their performance. Summary of the Invention

[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide an Internet intrusion detection method and device based on optimized correlation vector machine, which has better convergence and can also improve the classification accuracy of intrusion detection datasets and reduce false alarm rate.

[0005] To achieve the above objectives, the present invention is implemented using the following technical solution:

[0006] In a first aspect, the present invention provides an Internet intrusion detection method based on an optimized correlation vector machine, comprising:

[0007] Obtain the NSL-KDD dataset, including the training and test sets;

[0008] The NSL-KDD dataset is subjected to non-numerical one-hot encoding and numerical normalization to obtain preprocessed training and test sets.

[0009] The preprocessed training set is input into a pre-built relevance vector machine model optimized based on the improved crow search algorithm for training, to obtain the optimized and trained relevance vector machine model;

[0010] The preprocessed test set is input into the optimized and trained correlation vector machine model for testing to obtain the classification and detection results.

[0011] Furthermore, the step of performing non-numerical one-hot encoding and numerical normalization on the NSL-KDD dataset to obtain preprocessed training and test sets includes:

[0012] One-hot encoding is used to convert the 3D character-type features of the NSL-KDD dataset into numerical features. Then, in the remaining 38 numerical features, min-max normalization is used to map the original data to the range [0,1]. The formula is as follows:

[0013]

[0014] Where x max It is the maximum value, x min is the minimum value, x is the original data in the dataset, and x' is the mapped data;

[0015] Invalid features and data augmentations are removed to obtain preprocessed training and test sets.

[0016] Furthermore, the preprocessed training set is oversampled using ADASYN to increase the number of samples in smaller datasets. The steps for generating new samples using ADASYN are as follows:

[0017] 1) Calculate the class imbalance using the following formula:

[0018]

[0019] Where m s It is the number of minority class samples in the training set, m l It is the number of samples in the majority class, d <d th , where d th It is the preset maximum class imbalance;

[0020] 2) Calculate the amount of sample data to be synthesized, using the following formula:

[0021] G=(m l -m s )×β (3)

[0022] Where β∈(0,1] specifies the equilibrium state required after the synthetic data is generated;

[0023] 3) Calculate the ratio u, using the following formula:

[0024]

[0025] Where Δ is the number of minority class samples among their K nearest neighbors, calculated using Euclidean distance, that belong to the majority class.

[0026] 4) Normalize u using the following formula:

[0027]

[0028] 5) Calculate the amount of sample data to be generated for each minority sample, using the following formula:

[0029]

[0030] 6) Synthesize new samples, for each minority sample x to be synthesized. i Select a minority class sample x from its K nearest neighbors. zi The formula for synthesizing new samples is as follows:

[0031] s i =x i +(x zi -x i )×λ (7)

[0032] Where λ is a random number ∈ [0,1];

[0033] 7) Repeat the synthesis until the required amount of data in step 6) is met.

[0034] Furthermore, the improved crow search algorithm is improved as follows:

[0035] The inverse solution for the initial crow flock generated using the inverse learning strategy is as follows:

[0036] Suppose a crow z is randomly generated in D-dimensional space. j The initial position is z j =(z j,1 ,z j,2 ,z j,3 ,…,z j,D ), z j,i Its corresponding reverse position The formula is as follows:

[0037]

[0038] Where z j,i Let represent the i-th dimension of the j-th crow, j∈[1,N], where N is the population size of crows, ub and lb represent the upper and lower bounds of the solution space, respectively, and D represents the dimension of the search.

[0039] The random variable r for updating the crow's position i If we change it to a chaotic variable, the position update formula for crow i is as follows:

[0040]

[0041] in It is the new position of crow i in the (t+1)th iteration, r i ,r j∈(0,1) is a uniformly distributed random value, fl is the flight length, Let $C$ be the memory of crow $j$ at the $t$-th iteration, $j \in [1, N]$, and $AP$ be the probability that crow $j$ discovers it is being followed, where $C$ is the probability of crow $j$ being followed. i ∈(0,1) is a chaotic variable, representing the i-th value of the chaotic sequence, i∈[1,N], where the chosen chaotic sequence is CircleMap, and the mapping formula is as follows:

[0042]

[0043] Where c and H are the nonlinear intensity and the externally applied frequency, respectively.

[0044] Furthermore, the step of inputting the preprocessed training set into a pre-constructed relevance vector machine model optimized based on an improved crow search algorithm for training, to obtain an optimized and trained relevance vector machine model, includes:

[0045] (1) Initialize parameters: crow population size N, maximum number of iterations t max Flight length fl and perception probability AP;

[0046] (2) The reverse learning strategy initializes the crow's position and memory. The parameters to be optimized are the kernel parameter d and hyperparameter α of the relevance vector machine. It is a 2-dimensional search space, where (d, α) is the crow's position and memory. The formula is as follows:

[0047]

[0048]

[0049] (3) Train the relevant vector machine model using the preprocessed training set data, and calculate the initial position fitness value of the crow in step (2). The fitness function is the classification accuracy, and the formula is as follows:

[0050]

[0051] Where M acc It is the number of correctly classified samples, and M is the total number of samples;

[0052] (4) Use formula (9) to generate a new position;

[0053] (5) The feasibility of the new location determines whether to change the crow's location. If the new location is feasible, that is, if the new location is within the search space, the crow flies to the new location; otherwise, the crow stays in the original location.

[0054] (6) Formula (13) calculates the fitness value of the new position and updates the memory. If the fitness value of the new position is better than the fitness value of the original memory, then the memory matrix is ​​updated; otherwise, the memory matrix is ​​not updated. The formula for updating the memory matrix of crow i is as follows:

[0055]

[0056] Where f(·) is the fitness value;

[0057] (7) Repeat (3) to (6) until the maximum number of iterations t is reached. max ;

[0058] The kernel parameter d and hyperparameter α obtained through optimization are used as the optimal parameters of the correlation vector machine model to obtain the optimized correlation vector machine model.

[0059] The training set oversampled by ADASYN is input into the optimized correlation vector machine model to obtain the optimized and trained correlation vector machine model.

[0060] In a second aspect, the present invention provides an Internet intrusion detection device, comprising:

[0061] The acquisition module is used to acquire the NSL-KDD dataset, including the training set and the test set;

[0062] The preprocessing module is used to perform non-numerical one-hot encoding and numerical normalization on the NSL-KDD dataset to obtain the preprocessed training and test sets.

[0063] The training module is used to input the preprocessed training set into a pre-built relevance vector machine model optimized based on the improved crow search algorithm for training, so as to obtain the optimized and trained relevance vector machine model.

[0064] The testing module is used to input the preprocessed test set into the optimized and trained correlation vector machine model for testing, and obtain the classification and detection results.

[0065] Thirdly, the present invention provides an electronic device, characterized in that it includes a processor and a storage medium;

[0066] The storage medium is used to store instructions;

[0067] The processor is configured to operate according to the instructions to perform the steps of the method according to any of the preceding claims.

[0068] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the preceding methods.

[0069] Compared with the prior art, the beneficial effects achieved by the present invention are as follows:

[0070] This invention provides an internet intrusion detection method and apparatus based on an optimized relevance vector machine. It proposes an improved crow search algorithm to optimize the network model of the relevance vector machine for classification. First, in the data preprocessing stage, adaptive synthetic sampling is selected to handle small oversampling of the training set to balance the training data. Then, a back-learning strategy and chaotic sequences are introduced to improve its search capability. Finally, the improved crow search algorithm is used to optimize the parameters of the relevance vector machine, obtaining reasonable kernel parameters and hyperparameters to complete the classification and identification. This method not only has better convergence but also improves the classification accuracy of the intrusion detection dataset and reduces the false positive rate. Attached Figure Description

[0071] Figure 1 This is a flowchart of an Internet intrusion detection method based on an optimized correlation vector machine, provided by an embodiment of the present invention. Detailed Implementation

[0072] The present invention will be further described below with reference to the accompanying drawings. The following embodiments are only used to more clearly illustrate the technical solution of the present invention, and should not be used to limit the scope of protection of the present invention.

[0073] Example 1

[0074] This embodiment introduces an Internet intrusion detection method based on an optimized correlation vector machine, including:

[0075] Obtain the NSL-KDD dataset, including the training and test sets;

[0076] The NSL-KDD dataset is subjected to non-numerical one-hot encoding and numerical normalization to obtain preprocessed training and test sets.

[0077] The preprocessed training set is input into a pre-built relevance vector machine model optimized based on the improved crow search algorithm for training, to obtain the optimized and trained relevance vector machine model;

[0078] The preprocessed test set is input into the optimized and trained correlation vector machine model for testing to obtain the classification and detection results.

[0079] like Figure 1 As shown in the figure, the Internet intrusion detection method based on optimized correlation vector machine provided in this embodiment involves the following steps in its application process:

[0080] Step 1: Dataset Acquisition;

[0081] Datasets can be self-built or utilize publicly available datasets. For example, the NSL_KDD public dataset has 42 feature dimensions, one of which is the classification label, and the other dimensions are feature labels. It is categorized into normal and attack types, with attack types divided into four main categories: DoS, Probe, R2L, and U2R. The training set KDDTrain+ has 22 attack categories under these four categories, while the test set KDDTest+ has 39 attack categories under these four categories. The data distribution of each type in the NSL-KDD dataset is shown in Table 1.

[0082] Table 1

[0083]

[0084]

[0085] Step 2: Data preprocessing;

[0086] (1) One-hot encoding and normalization. One-hot encoding is used to convert the 3-dimensional character features of the NSL-KDD dataset, namely protocol_type, service, and flag, into numerical values. For example, protocol_type (TCP, UDP, ICMP) is encoded as 100, 010, 001. In the remaining 38-dimensional numerical features, min-max normalization is used to map the original data to the range [0,1], as shown in the following formula:

[0087]

[0088] Where x max It is the maximum value, x min is the minimum value, x is the original data in the dataset, and x' is the mapped data.

[0089] (2) Remove invalid features and data augmentation. The `num_file_creations` feature is 0 in both the training and test sets, and is useless for model learning, so it is removed. After normalizing the training set, ADASYN oversampling is performed to increase the number of small samples. The three character-type features in the NSL-KDD dataset are one-hot encoded and converted to 3, 70, and 11 dimensions respectively, which are then combined with numerical features to obtain a 121-dimensional feature vector. The steps of ADASYN to generate new samples are as follows:

[0090] 1) Calculate the class imbalance using the following formula:

[0091]

[0092] Where m s It is the number of minority class samples in the training set, m l It is the number of samples in the majority class, d <dth (where d) th (This is the preset maximum class imbalance);

[0093] 2) Calculate the amount of sample data to be synthesized, using the following formula:

[0094] G=(m l -m s )×β (3)

[0095] Where β∈(0,1] specifies the equilibrium state required after the synthetic data is generated;

[0096] 3) Calculate the ratio u, using the following formula:

[0097]

[0098] Where Δ is the number of minority class samples among their K nearest neighbors, calculated using Euclidean distance, that belong to the majority class.

[0099] 4) Normalize u using the following formula:

[0100]

[0101] 5) Calculate the amount of sample data to be generated for each minority sample, using the following formula:

[0102]

[0103] 6) Synthesize new samples, for each minority sample x to be synthesized. i Select a minority class sample x from its K nearest neighbors. zi The formula for synthesizing new samples is as follows:

[0104] s i =x i +(x zi -x i )×λ (7)

[0105] Where λ is a random number ∈ [0,1];

[0106] 7) Repeat the synthesis until the required amount of data in step 6) is met.

[0107] Step 3: Improved crow search algorithm;

[0108] (1) Crow population initialization using the reverse learning strategy. The reverse solution for the initial crow population generated by the reverse learning strategy is as follows:

[0109] Suppose a crow z is randomly generated in D-dimensional space. j The initial position is z j =(z j,1 ,z j,2,z j,3 ,…,z j,D ), z j,i Its corresponding reverse position The formula is as follows:

[0110]

[0111] Where z j,i Let represent the i-th dimension of the j-th crow, j∈[1,N], where N is the population size of crows, ub and lb represent the upper and lower bounds of the solution space, respectively, and D represents the dimension of the search.

[0112] (2) Chaotic sequence crow position change. The random variable r that updates the crow position. i If we change it to a chaotic variable, the position update formula for crow i is as follows:

[0113]

[0114] in It is the new position of crow i in the (t+1)th iteration, r i ,r j ∈(0,1) is a uniformly distributed random value, fl is the flight length, Let $C$ be the memory of crow $j$ at the $t$-th iteration, $j \in [1, N]$, and $AP$ be the probability that crow $j$ discovers it is being followed, where $C$ is the probability of crow $j$ being followed. i ∈(0,1) is a chaotic variable, representing the i-th value of the chaotic sequence, where i∈[1,N]. The chaotic sequence chosen in this invention is CircleMap, and the mapping formula is as follows:

[0115]

[0116] Where c and H are the nonlinear intensity and the externally applied frequency, respectively. In this paper, they are set to fixed values ​​of c = 0.2 and D = 0.5.

[0117] Step 4: Construct an improved relevance vector machine network;

[0118] (1) Initialize parameters: crow population size N, maximum number of iterations t max Flight length fl and perception probability AP;

[0119] (2) The reverse learning strategy initializes the crow's position and memory. The parameters to be optimized are the kernel parameter d and hyperparameter α of the relevance vector machine. It is a 2-dimensional search space, where (d, α) is the crow's position and memory. The formula is as follows:

[0120]

[0121]

[0122] (3) Train the relevant vector machine model using the preprocessed KDDTrain+ training set data, and calculate the initial position fitness value of the crow in step (2). The fitness function is the classification accuracy, and the formula is as follows:

[0123]

[0124] Where M acc It is the number of correctly classified samples, and M is the total number of samples;

[0125] (4) Use formula (9) to generate a new position;

[0126] (5) The feasibility of the new location determines whether to change the crow's location. If the new location is feasible, that is, if the new location is within the search space, the crow flies to the new location; otherwise, the crow stays in the original location.

[0127] (6) Formula (13) calculates the fitness value of the new position and updates the memory. If the fitness value of the new position is better than the fitness value of the original memory, then the memory matrix is ​​updated; otherwise, the memory matrix is ​​not updated. The formula for updating the memory matrix for crow i is as follows:

[0128]

[0129] Where f(·) is the fitness value.

[0130] (7) Repeat (3) to (6) until the maximum number of iterations t is reached. max .

[0131] Step 5: Train the improved Relevance Vector Machine network;

[0132] The optimal memory obtained in step 4 is used as the optimal parameters (d, α) of the correlation vector machine. The improved correlation vector machine network is then used on the KDDTrain+ training set after ADASYN oversampling in step 2 to generate the improved correlation vector machine network model after training.

[0133] Step 6: Classify the intrusion detection dataset.

[0134] The improved correlation vector machine model trained in step (5) is used to classify and identify the KDDTest+ test set data.

[0135] To evaluate the performance of this method, it was compared with RVM, CSA_RVM, GA_RVM, and PSO_RVM. The performance comparison of different models on the intrusion detection test set is shown in Table 2. As can be seen from the table, the method of this invention achieved the highest accuracy (95.53%), precision (94.96%), F1-score (93.25%), and the lowest false positive rate (1.05%). Its recall rate was second only to RVM and similar. Therefore, the overall performance of the ICSA_RVM model is superior to the other models.

[0136] Table 2

[0137]

[0138]

[0139] This invention provides an Internet intrusion detection method based on an optimized relevance vector machine. It proposes an improved crow search algorithm to optimize the network model of the relevance vector machine for classification. First, in the data preprocessing stage, adaptive synthetic sampling is selected to handle small oversampling of the training set to balance the training data. Then, a reverse learning strategy and chaotic sequences are introduced into the crow search algorithm to improve its search ability. Finally, the improved crow search algorithm is used to optimize the parameters of the relevance vector machine, obtaining reasonable kernel parameters and hyperparameters to complete the classification and identification. This method not only has better convergence but also improves the classification accuracy of the intrusion detection dataset and reduces the false positive rate.

[0140] Example 2

[0141] This embodiment provides an Internet intrusion detection device, including:

[0142] The acquisition module is used to acquire the NSL-KDD dataset, including the training set and the test set;

[0143] The preprocessing module is used to perform non-numerical one-hot encoding and numerical normalization on the NSL-KDD dataset to obtain the preprocessed training and test sets.

[0144] The training module is used to input the preprocessed training set into a pre-built relevance vector machine model optimized based on the improved crow search algorithm for training, so as to obtain the optimized and trained relevance vector machine model.

[0145] The testing module is used to input the preprocessed test set into the optimized and trained correlation vector machine model for testing, and obtain the classification and detection results.

[0146] Example 3

[0147] This embodiment provides an electronic device, characterized in that it includes a processor and a storage medium;

[0148] The storage medium is used to store instructions;

[0149] The processor is configured to operate according to the instructions to perform the steps of the method according to any one of Embodiment 1.

[0150] Example 4

[0151] This embodiment provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the methods described in Embodiment 1.

[0152] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the technical principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. An Internet intrusion detection method based on optimized correlation vector machine, characterized in that, include: Obtain the NSL-KDD dataset, including the training and test sets; The NSL-KDD dataset is subjected to non-numerical one-hot encoding and numerical normalization to obtain preprocessed training and test sets. The preprocessed training set is input into a pre-built relevance vector machine model optimized based on the improved crow search algorithm for training, to obtain the optimized and trained relevance vector machine model; The preprocessed test set is input into the optimized and trained Relevance Vector Machine model for testing to obtain the classification and detection results. The preprocessed training set is oversampled using ADASYN to increase the number of samples in smaller datasets. The steps for generating new samples using ADASYN are as follows: 1) Calculate the class imbalance using the following formula: (2) in It is the number of minority class samples in the training set. It is the number of samples in the majority class. ; It is the preset maximum class imbalance; 2) Calculate the amount of sample data to be synthesized, using the following formula: (3) in This specifies the balance required after the synthetic data is generated; 3) Calculate the ratio u, using the following formula: ，i=1,..., (4) in It is the number of minority class samples among their K nearest neighbors that belong to the majority class, calculated using Euclidean distance; 4) Normalize u using the following formula: (5) 5) Calculate the amount of sample data to be generated for each minority sample, using the following formula: (6) 6) Synthesize new samples from each of the few samples to be synthesized. Select a minority class sample from its K nearest neighbors. The formula for synthesizing new samples is as follows: (7) in Random numbers; 7) Repeat the synthesis until the required amount of data in step 6) is met; The improved crow search algorithm is improved as follows: The inverse solution for the initial crow flock generated using the inverse learning strategy is as follows: Suppose a crow is randomly generated in D-dimensional space. The initial position is , Its corresponding reverse position The formula is as follows: (8) in Let the i-th dimension of the j-th crow be... N is the population size of crows, ub and lb represent the upper and lower bounds of the solution space, respectively, and D represents the dimension of the search. Random variable for crow position update If we change it to a chaotic variable, the position update formula for crow i is as follows: (9) in It is the new position of crow i in the (t+1)th iteration. It is a uniformly distributed random value. It is the flight length. It is the memory of crow j at the t-th iteration. AP is the probability that crow j detects that it is being followed, where It is a chaotic variable, representing the i-th value in the chaotic sequence. The chaotic sequence chosen is a Circle Map, and the mapping formula is as follows: (10) Where c and H are the nonlinear intensity and the externally applied frequency, respectively.

2. The Internet intrusion detection method based on optimized correlation vector machine according to claim 1, characterized in that, The process of performing non-numerical one-hot encoding and numerical normalization on the NSL-KDD dataset to obtain preprocessed training and test sets includes: One-hot encoding is used to convert the 3D character-type features of the NSL-KDD dataset into numerical features. Then, in the remaining 38 numerical features, min-max normalization is used to map the original data to the range [0, 1], as shown in the following formula: (1) in It is the maximum value. is the minimum value, x is the original data in the dataset, and x' is the mapped data; Invalid features and data augmentations are removed to obtain preprocessed training and test sets.

3. The Internet intrusion detection method based on optimized correlation vector machine according to claim 1, characterized in that, The step of inputting the preprocessed training set into a pre-constructed relevance vector machine model optimized based on an improved crow search algorithm for training, to obtain an optimized and trained relevance vector machine model, includes: (1) Initialize the parameters of the improved crow search algorithm described in step 4, including the crow population size N and the maximum number of iterations. Flight length fl and perception probability AP; (2) The reverse learning strategy initializes the crow's position and memory, and the parameters that need to be optimized are the kernel parameters of the relevance vector machine. and hyperparameters It is a 2D search space. It involves the crow's location and memory, and the formula is as follows: (11) (12) (3) Train the relevant vector machine model using the preprocessed KDDTrain+ training set data, and calculate the initial position fitness value of the crow in step (2). The fitness function is the classification accuracy, and the formula is as follows: (13) in This is the number of correctly classified samples. It is the total number of samples; (4) Use formula (9) to generate a new position; (5) The feasibility of the new location determines whether to change the crow's location. If the new location is feasible, that is, the new location is within the search space, the crow flies to the new location; otherwise, the crow stays in the original location. (6) Formula (13) calculates the fitness value of the new position and updates the memory. If the fitness value of the new position is better than the fitness value of the original memory, then the memory matrix is ​​updated; otherwise, the memory matrix is ​​not updated. The formula for updating the memory matrix of crow i is as follows: (14) in, It is the fitness value; (7) Repeat (3) to (6) until the maximum number of iterations is reached. ; The kernel parameters obtained through optimization and hyperparameters The optimal parameters for the correlation vector machine model are used to obtain the optimized correlation vector machine model. The training set oversampled by ADASYN is input into the optimized correlation vector machine model to obtain the optimized and trained correlation vector machine model.

4. An internet intrusion detection device, used to implement the internet intrusion detection method according to any one of claims 1-3, characterized in that, include: The acquisition module is used to acquire the NSL-KDD dataset, including the training set and the test set; The preprocessing module is used to perform non-numerical one-hot encoding and numerical normalization on the NSL-KDD dataset to obtain the preprocessed training and test sets. The training module is used to input the preprocessed training set into a pre-built relevance vector machine model optimized based on the improved crow search algorithm for training, so as to obtain the optimized and trained relevance vector machine model. The testing module is used to input the preprocessed test set into the optimized and trained correlation vector machine model for testing, and obtain the classification and detection results.

5. An electronic device, characterized in that: Including processor and storage media; The storage medium is used to store instructions; The processor is configured to operate according to the instructions to perform the steps of the method according to any one of claims 1 to 3.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that: When executed by a processor, the program implements the steps of the method according to any one of claims 1 to 3.

Images