Intrusion detection system against sample defense method using multiple feature manifold vectors

Abstract

The present application relates to an intrusion detection system using multiple feature manifold vectors against sample defense method, belongs to computer and information science field. The present application first extracts multiple features from network traffic samples: uses radial neural network to calculate sample category prediction probability, calculates sample feature weight based on attention mechanism and extracts high weight features, calculates correlation between sample features and proposes random recursive feature elimination algorithm to select high correlation features; secondly, map multiple features to low-dimensional manifold vectors, and calculate similarity with benign and malicious traffic sample manifold vectors respectively; finally, generate reconstructed feature traffic samples by using denoising autoencoder according to manifold similarity, and then distinguish by intrusion detection system. The present application reconstructs sample features based on multiple feature manifold similarity, reduces the influence of anti-detection disturbance in features on detection accuracy, and improves the defense ability of intrusion detection system to adversarial samples.

Description

TECHNICAL FIELD

[0001] The application relates to an intrusion detection system against sample defense method using a plurality of feature manifold vectors and belongs to the field of computer and information science. BACKGROUND

[0002] Intrusion detection is an active defense scheme based on network traffic analysis, which identifies network attack behavior by matching the features of captured data packets. Machine learning and deep learning-based intrusion detection algorithms can achieve automatic modeling and identification of network traffic, improving the efficiency and quality of intrusion detection. However, the introduction of machine learning and deep learning algorithms also brings new challenges. Since Szegedy et al. first proposed the concept of adversarial samples for deep neural networks in 2013, more adversarial sample generation methods have been proposed, such as FGSM, BIM, PGD, C&W, GAN, etc. In the field of intrusion detection, adversarial sample generation methods are used to create malicious traffic adversarial samples, which make machine learning and deep learning-based intrusion detection models misclassify them as benign traffic, thereby achieving the purpose of evading intrusion detection systems and concealing malicious attack behavior, which seriously threatens information system security. Therefore, studying an effective traffic adversarial sample defense method has important theoretical significance and practical value for ensuring the effectiveness of intrusion detection systems and maintaining information system security.

[0003] According to the object of defense, the general adversarial sample defense methods in recent years can be divided into model architecture improvement methods and data enhancement-based methods.

[0004] 1. Model architecture improvement method

[0005] The model architecture improvement method considers from the architecture optimization level. On the basis of the intrusion detection model, an additional adversarial sample classifier is constructed to identify adversarial samples, and an integrated voting method is used to jointly determine the malicious category of the samples to reduce the success rate of adversarial sample deception. This method focuses on improving the classification fault tolerance performance of the model architecture, but it cannot effectively limit the influence of adversarial perturbations on intrusion detection accuracy. This not only produces additional model overhead, but also cannot effectively restrict the generation of effective adversarial samples and their deception of intrusion detection systems.

[0006] 2. Data enhancement-based method

[0007] The method based on data enhancement considers the sample data level. A large number of adversarial samples are generated by using a known adversarial sample generation method to enhance the sample data set, and an intrusion detection model with a smooth decision boundary and strong adversarial perturbation robustness is trained. Such methods focus on enhancing the diversity of data, but do not consider the underlying principles of adversarial samples, lack analysis of the difference between benign samples and malicious samples, and result in a model that cannot resist unknown attacks and has poor performance in high-concealment perturbation identification.

[0008] In summary, in view of the problems that the existing improved model architecture method lacks limitation of adversarial perturbation and the data enhancement method is difficult to effectively mine and amplify the difference between samples, resulting in poor defense effect on adversarial samples, the present application proposes an intrusion detection system adversarial sample defense method using multiple feature manifold vectors. SUMMARY

[0009] The purpose of the present application is to meet the adversarial sample defense needs of the intrusion detection system based on machine learning and deep learning, improve the problem that the existing improved model architecture defense method lacks limitation of adversarial perturbation, and make up for the defect that the data enhancement method is difficult to effectively mine and amplify the difference between benign samples and malicious samples.

[0010] The design principle of the present application is: first, performing feature preprocessing on the input flow sample; second, extracting multiple features from the preprocessed sample; then, mapping the extracted multiple features to a low-dimensional manifold vector, and calculating the manifold similarity with the benign sample and the malicious sample respectively and outputting the current sample similarity category; finally, inputting the preprocessed sample into the corresponding generated model for reconstruction to amplify the feature difference, and outputting it to the intrusion detection system after inverse processing for flow discrimination.

[0011] The technical scheme of the present application is realized by the following steps:

[0012] Step 1, performing feature preprocessing on the input network flow sample.

[0013] Step 1.1, extracting non-functional features in the network flow sample.

[0014] Step 1.2, encoding non-numeric features and normalizing numeric features.

[0015] Step 2, extracting multiple features from the network flow sample preprocessed in step 1.

[0016] Step 2.1, constructing a sample category prediction probability calculation network using a radial neural network, calculating the category prediction probability of the flow sample as a soft label feature.

[0017] Step 2.2, a feature weight calculation network based on attention mechanism is constructed to calculate the weight of each feature on the model decision, and high weight features are selected as high contribution features.

[0018] Step 2.3, the correlation between sample features is calculated, and a representation ability calculation network is constructed by combining the proposed random recursive feature elimination algorithm, and high correlation features are selected as high representation features.

[0019] Step 3, map the extracted multiple features to low-dimensional manifold vectors, and calculate the similarity with benign sample manifold vectors and malicious sample manifold vectors to determine the similar category.

[0020] Step 3.1, use the trained encoder of the denoising autoencoder model to map the extracted multiple features to low-dimensional manifold.

[0021] Step 3.2, according to the average manifold vectors of benign samples and malicious samples, calculate the benign manifold similarity and malicious manifold similarity of the current sample corresponding to the low-dimensional manifold vector of multiple features, and compare the values to determine the similar category.

[0022] Step 4, input the feature preprocessed sample into the similar category corresponding reconstruction model for reconstruction to strengthen the sample data distribution feature, enlarge the sample difference, and perform single clustering on all reconstructed samples, and select the clustering center point as the inverse processing as the optimal reconstructed sample.

[0023] Step 4.1, input the feature sample processed in step 1 into the similar category corresponding benign sample generation model or malicious sample generation model to strengthen the sample data distribution feature, enlarge the sample difference, and reconstruct 50 samples.

[0024] Step 4.2, calculate the difference value between the 50 reconstructed samples and the samples before reconstruction, and combine the difference value with the original feature vector of the sample, and perform single clustering on the combined vector, and select the clustering center point as the final optimal reconstructed sample.

[0025] Step 4.3, output the inverse processing of the optimal reconstructed sample.

[0026] Step 5, the intrusion detection system classifies the optimal reconstructed traffic sample, and outputs the classification result as benign traffic or malicious traffic.

[0027] Advantages

[0028] Compared with the method of improving the model architecture, the application does not rely on additional model overhead to improve the traffic classification fault tolerance of the intrusion detection system, but reduces the escape rate of adversarial samples through multiple feature extraction. Extracting multiple features from traffic samples can effectively eliminate redundant feature interference and make the model focus on features that are easy to add adversarial perturbations, limiting the influence of adversarial perturbations and increasing the difficulty of making traffic adversarial samples that can effectively escape the intrusion detection system, thereby reducing the success rate of traffic adversarial sample attacks.

[0029] Compared with the method based on data enhancement, the application focuses on sample feature difference amplification, and improves the classification accuracy of the intrusion detection system through manifold similarity calculation and feature reconstruction. Manifold similarity calculation on multiple features and reconstruction of benign and malicious sample features can better highlight the feature distribution difference between them, so that the intrusion detection system can better capture the difference between benign samples and malicious samples, effectively improving the defense ability of the intrusion detection system against adversarial samples. BRIEF DESCRIPTION OF DRAWINGS

[0030] Figure 1 The application is an intrusion detection system adversarial sample defense method framework diagram using multiple feature manifold vectors.

[0031] Figure 2 The application is a sample category prediction probability calculation process principle diagram.

[0032] Figure 3 The application is a high weight feature extraction process principle diagram.

[0033] Figure 4 The application is a high correlation feature extraction process principle diagram.

[0034] Figure 5 The application is a feature weight vector calculation principle diagram.

[0035] Figure 6 The application is a low-dimensional manifold mapping principle diagram. DETAILED DESCRIPTION

[0036] In order to better illustrate the purpose and advantages of the application, the embodiments of the method of the application will be further described in detail below in combination with examples.

[0037] The specific process is as follows:

[0038] Step 1, feature preprocessing is performed on the input traffic sample.

[0039] Step 1.1. Step 1, feature screening preprocessing is performed on the input traffic sample to extract non-functional features that do not affect the underlying properties of the traffic. Feature extraction is performed from the following dimensions: packet interval, Ethernet header, IP header, TCP header, UDP header, ICMP packet, and data packet direction. Detailed feature information is shown in Table 1.

[0040] Table 1. Feature extraction for each data preprocessing

[0041]

[0042] Step 1.2. The extracted features are further encoded to convert non-numeric features into an n-dimensional feature vector through one-hot encoding. Then, to avoid the influence of scale differences between different features on the results, the numeric feature values are normalized using standard metrics. The minimum-maximum normalization method is used to compress the numeric feature values within the [0, 1] interval. Let x be the feature value to be normalized, and x' be the normalized feature value:

[0043]

[0044] where x min and x max represent the minimum and maximum values of the corresponding feature in the data set.

[0045] Finally, the preprocessed samples are divided into benign and malicious samples, and each is divided into two equal parts, which are used for subsequent traffic sample manifold similarity calculation and sample generation model training.

[0046] Step 2. Extract multiple features from the network traffic samples preprocessed in Step 1.

[0047] Step 2.1. Use a radial neural network to construct a sample category prediction probability calculation network to calculate the traffic sample category prediction probability and use it as a soft label feature.

[0048] First, for an input feature vector X with n features, calculate the radial distance h j between each feature x and the corresponding hidden layer node c

[0049]

[0050] where r j is the variance of the jth hidden layer node, m is the number of hidden nodes, n i is the dimension of the input feature vector X, and c jk is the kth feature value corresponding to the center point c j .

[0051] Then, combining the output flow of the softmax layer added before the output layer in the radial neural network with the predicted probabilities of each category, we get the sample category prediction probability vector (p0, p1, ..., p) composed of n category probabilities. n The output layer calculation method is as follows:

[0052]

[0053] Where w represents the weight between hidden nodes and output nodes, i represents the number of traffic categories, and q represents the number of output nodes.

[0054] Finally, the predicted probability X of the sample class can be calculated for the input. Soft = (y0, ..., y i , ..., y n ), and use it as a soft label feature, where n represents the number of traffic categories, y i This represents the probability that the current sample belongs to the i-th category.

[0055] Step 2.2: Construct a feature weight calculation network based on the attention mechanism, calculate the weight of each feature on the model decision, and select high-weight features as high-contribution features.

[0056] First, the traffic sample feature vector X = (x1, ..., x2) is generated. i , ..., x n The input is fed into a deep neural network to obtain the hidden layer representation Q = (q1, ..., q2). i , ..., q n ), where n represents the feature dimension of the input traffic sample. The hidden layer uses the ReLU function as the activation function, and the input to the hidden layer is the traffic sample feature vector x. i The weight of the neuron is W. i The offset of the neuron is b i The calculation method is shown in formula (4).

[0057] q i =ReLU(W i x i +b i (4)

[0058] Then, the attention weight distribution vector α is obtained through the scoring function s(·) and the softmax function. i The attention weight of a feature represents the weight of that feature in the classification result. The calculation method is shown in formulas (5), (6), and (7).

[0059] α i =softmax(s(x) i q i(5)

[0060]

[0061] s(x i q i )=x i ×q i (7)

[0062] For all eigenvectors x i Perform a weighted summation and output the feature weight vector S = (s1, s2, ..., s...). n ), s i This represents the weight of the i-th feature. The calculation method is shown in formula (8).

[0063]

[0064] Finally, the 15 features with the highest weights were selected as high-contribution features.

[0065] Step 2.3: Calculate the correlation between sample features, construct a representation ability calculation network by combining the proposed random recursive feature elimination algorithm, and select high correlation features as high representation features.

[0066] For the input traffic sample feature vector X = (x1, ..., x2) i , ..., x j , ..., x n First, calculate the correlation coefficient between features, Person(x). i x j The calculation method is shown in formula (9).

[0067]

[0068] For each feature x i Calculate other features with x i The correlation coefficients were used to sort the features by value, and the top 20 features were selected to obtain a high-correlation feature combination vector. Finally, the combination yields an n×n dimensional matrix R, which is: It is used for training intrusion detection models based on deep neural networks, and the optimal feature combination is selected from the feature combination vector in R using a stochastic recursive feature elimination algorithm.

[0069] Specifically, for each dimension of the feature combination vector in R... Perform the following process: Initialize a random value m in the range of 0 to 20 according to the set random seed, and initialize the optimal accuracy acc in the range of 0 to 0.6. best The corresponding optimal feature combination is r best =null; from Extract the top m highly relevant features to form a new feature subset s m Train a deep neural network and record the accuracy (acc) during the training process. i If acc i >acc best Let acc best =acc i And r best =s m This process is repeated until the optimal subset r is selected. best As the present The optimal high-relevance feature, i.e.

[0070] Furthermore, for R, we can obtain the optimal high-relevance feature subsets corresponding to the i-th feature vector. and optimal accuracy acc i Calculate the number of characterization features, num. i Model accuracy (acc) i The balanced evaluation value serves as an indicator of the representational ability of each feature vector:

[0071]

[0072] Where n represents the number of sample features after preprocessing. Finally, the highly relevant features with the highest representational ability index are selected as the high-representational features for output.

[0073] Step 3: For the features extracted in Step 2, perform low-dimensional manifold mapping using a denoising autoencoder, and calculate the similarity with the manifold vectors of benign and malicious samples to determine the similarity category.

[0074] Step 3.1: The encoder of the trained denoising autoencoder model is used to perform low-dimensional manifold mapping on the extracted features. The various features are input into the denoising autoencoder, which performs lossy processing and dimensionality reduction sampling on the features, successively obtaining low-dimensional manifold vectors for high-contribution features, high-representation features, and soft-label features.

[0075] Step 3.2: Based on the average manifold vectors of multiple features of benign and malicious samples, calculate the benign manifold similarity and malicious manifold similarity for the low-dimensional manifold vectors of multiple features corresponding to the current sample, and compare the two values ​​to determine the similarity category.

[0076] First, the average manifold vectors of various features of malicious and benign samples are calculated. Then, the similarity between the low-dimensional manifolds of various features of the input sample and the average manifold vectors of malicious and benign samples is calculated to determine the similarity category label of the input sample.

[0077] Specifically, the process of calculating the manifold similarity between the current sample and the benign sample is: calculating the manifold similarity between the high-contribution feature low-dimensional manifold vector of the current sample obtained by mapping and the average high-contribution feature low-dimensional manifold vector of the benign sample, and calculating the corresponding high-representation feature low-dimensional manifold similarity and soft label feature low-dimensional manifold similarity in the same way. The manifold similarity is measured by the average mean square error:

[0078]

[0079] MSE represents the average mean square error, X and Y represent two manifold vectors to be calculated, N represents the feature dimension of the manifold vector, and Type corresponds to a certain feature (high-contribution feature or high-representation feature or soft label feature) in multiple features. Then, the three manifold similarity values calculated from the three features are added to obtain the total manifold similarity MSE Ben between the current sample and the benign sample. Att

[0080] Finally, MSE Ben is compared with MSE Att , and the class with the smaller total manifold similarity is selected as the similar class label of the sample, that is, if MSE Ben > MSE Att , the corresponding malicious similar class is output, otherwise the benign similar class is output.

[0081] Step 4, input the feature preprocessed sample into the similar class corresponding generation model for reconstruction, to strengthen the sample data distribution feature, amplify the sample difference, and cluster all reconstructed samples, and take the cluster center point as the inverse processing as the optimal reconstructed sample.

[0082] Step 4.1, input the feature sample processed in step 1 into the similar class corresponding benign sample generation model or malicious sample generation model to strengthen the sample data distribution feature, amplify the sample difference, and reconstruct and output 50 samples. Specifically, if the similar class belongs to the benign sample, it is input into the benign sample denoising autoencoder for reconstruction, otherwise it is input into the malicious sample denoising autoencoder for reconstruction.

[0083] The generation model used for feature reconstruction is a denoising autoencoder trained based on normal traffic (i.e., non-adversarial samples containing benign traffic and malicious traffic) data set. Since the generation model can learn the data distribution and potential representation of the corresponding class sample, inputting the sample into the benign sample generation model or the malicious sample generation model for reconstruction will strengthen the data distribution feature of the corresponding class of the sample and further amplify the data distribution difference between different class samples. ​

[0084] Step 4.2, calculate the difference value between the 50 reconstructed samples and the pre-reconstruction samples, and combine the difference value with the original sample feature vector, and perform sample single clustering according to the combined vector, and select the clustering center point as the final optimal reconstruction sample.

[0085] Specifically, for each reconstruction sample, the difference value between the pre-reconstruction input sample and the reconstruction sample is calculated, and the difference value is calculated by using the average mean square error. Then, the difference value is combined with the original sample feature vector to form an n+1 dimensional vector M, where n is the number of reconstruction sample features. Then, the center point c of the 50 sample points is calculated by using the single clustering method according to M, and the determination of the center point is an iterative minimization process:

[0086]

[0087] where x ij is the i-th sample for the j-th feature, c j is the j-th feature of the currently selected center point.

[0088] Finally, in order to ensure that the enhanced sample data distribution characteristics are not distorted, that is, the reconstruction difference is small, the clustering center c is selected as the optimal reconstruction sample.

[0089] Step 4.3, output the complete traffic sample after performing feature inverse processing on the optimal reconstruction sample. In order to maintain the effectiveness of the traffic sample and facilitate subsequent classification and identification of the intrusion detection system, the sample features need to be restored to their initial size, and the non-numeric features should be obtained according to the mapping relationship. First, the feature values compressed in the interval [0, 1] need to be expanded back to their original scale to obtain the inverse normalized feature values x * :

[0090] x * = x'(x max -x min )+x min (13)

[0091] Then, according to the mapping relationship between the feature attributes and the numbers in the pre-processing, the non-numeric features are mapped back to characters from one-hot encoding. Finally, the functional features not extracted in step 1 are combined with the reconstruction feature vector to obtain the complete feature sample.

[0092] Step 5, the intrusion detection system classifies the optimal reconstruction traffic sample and outputs the classification result as benign traffic or malicious traffic.

[0093] Experiments are designed to verify the effectiveness of the present application. The intrusion detection system is implemented using an intrusion detection deep neural network model. The experimental data uses the NSL-KDD and CICIDS2017 public data sets. Adversarial samples are generated using FGSM, BIM, PGD, C&W, and IDSGAN adversarial sample generation methods to test the performance of the defense framework. Randomly selected normal samples are used to make the number ratio of adversarial samples 1:1. The detailed information of the adversarial sample data set used by the method is shown in Table 2.

[0094] Table 2. Sample number under each data set

[0095]

[0096] The accuracy, recall, precision, and F1 value are used to evaluate the effectiveness of the defense method in the experiment. The specific calculation method is as follows:

[0097] (1) Accuracy. 1500 samples are randomly selected as benign samples in a data set, and 1500 samples are selected for adversarial sample production. N represents the total number of samples and N = 3000. TP is the number of samples correctly classified as malicious traffic and adversarial malicious traffic. TN is the number of samples correctly classified as benign traffic. The proportion of correctly identified classified samples is calculated as follows:

[0098]

[0099] (2) Recall. The sample number ratio is consistent with (1). The proportion of correctly classified malicious traffic and adversarial malicious traffic among all correctly classified samples is calculated as follows:

[0100]

[0101] (3) Precision. The sample number ratio is consistent with (1). FP refers to the number of benign traffic samples incorrectly classified as malicious traffic. The proportion of correctly classified malicious traffic and adversarial malicious traffic samples in all non-benign samples is calculated as follows:

[0102]

[0103] (4) F1 value. The balanced evaluation value between Precision and Recall is calculated as follows:

[0104]

[0105] The experimental design includes a training process and a test process. The training process: training the feature weight calculation network, the sample category prediction probability calculation network and the intrusion detection deep neural network by using benign traffic samples and malicious traffic samples; secondly, in the manifold similarity calculation, two noise reduction autoencoders trained based on the benign traffic and the malicious traffic are used as low-dimensional manifold mapping models, and the low-dimensional manifold mapping of various features of the benign traffic and the malicious traffic is performed and the average manifold vector is calculated. Finally, the noise reduction autoencoders trained based on the malicious traffic samples and the benign traffic samples are used as the generation model of the input sample feature reconstruction for data distribution feature enhancement reconstruction.

[0106] The test process: first, various features of the to-be-tested sample are extracted to obtain high-contribution features, high-representation features and soft label features; secondly, the low-dimensional manifold mapping is performed on the various features to obtain low-dimensional manifold vectors, and then the manifold similarity is calculated with the average manifold vectors of the corresponding features of the benign samples and the malicious samples, and the similar category label is output according to the similarity size; then the sample is input into the generation model corresponding to the similar category for reconstruction, the sample data distribution feature is enhanced, the sample difference is amplified, and the difference value between the reconstructed sample and the original sample is calculated and combined with the original feature vector to form a new vector, and the single clustering is selected according to the vector to select the clustering center as the optimal reconstructed sample. Finally, the intrusion detection deep neural network model is used for classifying the reconstructed traffic sample, the evaluation indexes are calculated according to the classification label, and the defense performance of the method is verified.

[0107] The experiment is performed on a computer and a GPU server. The computer is configured as: Intel(R) Core(TM) i7-6700, CPU frequency 3.40GHz, 8GB RAM, and the operating system is 64-bit Windows 10; the server is configured as: GTX1080Ti, RAM 256G, and the operating system is Linux Ubuntu 64-bit.

[0108] Experimental results: the experimental results of the defense method of the present application and other comparative methods are shown in Tables 3 and 4.

[0109] Table 3. Comparison of experimental results of NSL-KDD data set malicious traffic adversarial sample defense

[0110]

[0111] Table 4. Comparison of experimental results of CICIDS2017 data set malicious traffic adversarial sample defense

[0112]

[0113] The experimental results show that:

[0114] (1)The intrusion detection model based on the deep neural network reaches 99.7% of the classification accuracy under the condition of normal traffic samples, and each performance in the adversarial sample dataset has a significant decline, which shows that the adversarial sample can mislead the classifier to make an error classification. The present application achieves better defense effect, and reaches 97.3% and 96.4% of the accuracy in the NSL-KDD dataset and the CICIDS dataset respectively, and the recall rate reaches 98.0% and 97.5%, which shows that the method can filter the adversarial perturbation and make the model correctly classify the adversarial sample, and effectively limits the influence of the adversarial perturbation on the detection accuracy of the intrusion detection system.

[0115] (2)The accuracy of the comparative method in the NSL-KDD dataset is 94.0% and 93.5% respectively, and the recall rate is 90.8% and 93.8% respectively, which are lower than the accuracy of 97.3% and the recall rate of 98.0% of the present application; in the CICIDS2017 dataset, the accuracy of the improved model architecture method is only 69.7%, and the accuracy based on the data enhancement method is 91.8%, which is significantly lower than the accuracy of 96.4% of the present application. Therefore, compared with the comparative method, the present application can achieve better defense effect of the adversarial sample.

[0116] In summary, the present application can effectively eliminate the interference of redundant features and reduce the influence of adversarial perturbation by extracting multiple features from network traffic samples, reduce the success rate of adversarial sample attack; in addition, calculating the similarity of multiple feature manifolds and performing sample feature reconstruction processing can effectively improve the problem that the difference between benign samples and malicious samples is small and cannot be identified by the classifier, causing malicious traffic to escape, and improve the accuracy and robustness of the intrusion detection system under the attack of the adversarial sample, and further enhance the defense ability of the intrusion detection system to the adversarial sample.

[0117] The above specific description further describes the purpose, technical scheme and beneficial effects of the present application, and it should be understood that the above description is only a specific embodiment of the present application and is not used to limit the protection scope of the present application, and any modification, equivalent replacement, improvement, etc. within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. An adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors, characterized in that... The method includes the following steps: Step 1: Perform feature preprocessing on the input network traffic samples, extract non-functional features, encode non-numerical features, and normalize numerical features. Step 2: Extract various features from the traffic samples after feature preprocessing. The specific extraction steps are as follows: Step 2.1: Construct a sample category prediction probability calculation network using a radial neural network to calculate the category prediction probability of traffic samples and use it as a soft label feature; Step 2.2: Construct a feature weight calculation network based on the attention mechanism, calculate the weight of each feature to the model decision, and select high-weight features as high-contribution features. Step 2.3: Calculate the correlation between sample features, construct a representation ability calculation network by combining the proposed random recursive feature elimination algorithm, and select high correlation features as high representation features. Step 3: Perform low-dimensional manifold mapping on the features extracted in Step 2, and calculate the similarity with the manifold vectors of benign samples and malicious samples to determine the similarity category. Step 4: Input the preprocessed samples into the similar category corresponding generation model for reconstruction, so as to enhance the distribution characteristics of the sample data, amplify the differences between samples, and cluster all reconstructed samples. Take the cluster center point and perform inverse processing as the optimal reconstructed sample. Step 5: The intrusion detection system classifies the optimal reconstructed traffic samples and outputs the classification result as benign traffic or malicious traffic.

2. The adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors according to claim 1, characterized in that: In step 2, various features were extracted from the traffic samples, including high contribution features, high representation features, and soft label features.

3. The adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors according to claim 1, characterized in that: In step 2, a representation ability calculation network was constructed. First, the Person correlation coefficient between each feature and other features was calculated, and the top 20 features were extracted in order of numerical value to form a feature matrix. Then, the optimal combination of feature vectors in each dimension of the matrix was selected using a random recursive feature elimination algorithm.

4. The adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors according to claim 1, characterized in that: Step 2 proposes a stochastic recursive feature elimination algorithm for the i-th vector in the input feature matrix. The following process is performed: First, initialize a random value m in the range of 0 to 20 according to the set random seed, and initialize the optimal accuracy acc in the range of 0 to 0.

6. best The corresponding optimal feature combination is r best =null; secondly from r x Extract the first m features to form a new feature subset s m Train a deep neural network and record the accuracy (acc) during the training process. i If acc i >acc best Let acc best =acc i And r best =s m This process is repeated until the optimal subset r is selected. best As the present The optimal high-relevance feature, i.e.

5. The adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors according to claim 1, characterized in that: Step 2 constructs a representation capability index to calculate the representation capability of the i-th feature subset after processing by the recursive feature elimination algorithm. The calculation formula is: (num i / n+acc i ) / (2×acc i ×num i / n), where n represents the number of preprocessed sample features, acc i ,num i These represent the optimal accuracy and the number of representational features corresponding to the i-th feature vector, respectively.

6. The adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors according to claim 1, characterized in that: In step 3, manifold similarity is measured based on multiple features of the current sample and similarity category is determined. Specifically, for the low-dimensional manifold with multiple features obtained after manifold mapping, manifold similarity is calculated with the average manifold with multiple features corresponding to benign samples and the average manifold with multiple features corresponding to malicious samples, and the similarity category label of the current sample is output according to the similarity value.

7. The adversarial sample defense method for intrusion detection systems utilizing multiple feature manifold vectors according to claim 1, characterized in that: In step 4, the samples are reconstructed based on similar categories to enhance the distribution characteristics of the sample data and amplify the differences between samples. Specifically, the preprocessed samples are first input into the noise reduction autoencoder corresponding to the similar categories for reconstruction. Then, the difference values ​​between the 50 reconstructed traffic samples and the original samples are calculated and combined with the feature vector of the original samples. Based on this vector, a single cluster is performed, and finally, the cluster center point is selected as the optimal reconstructed sample.

Images