Network intrusion detection method and system based on traffic feature fusion

Abstract

The application discloses a network intrusion detection method and system based on traffic feature fusion, and comprises the following steps: obtaining network traffic data to be detected; preprocessing the network traffic data; inputting the preprocessed network traffic data into a trained network intrusion detection model to obtain a network intrusion detection result; wherein the trained network intrusion detection model comprises the following steps: performing feature extraction on the preprocessed network traffic data respectively to obtain first feature data and second feature data; performing feature fusion on the extracted first feature data and second feature data to obtain fusion features; and classifying the fusion features to obtain a classification result.

Description

Technical Field

[0001] This invention relates to the field of network intrusion detection technology, and in particular to a network intrusion detection method and system based on traffic feature fusion. Background Technology

[0002] The statements in this section merely refer to the background art related to this invention and do not necessarily constitute prior art.

[0003] In today's society, with the advancement of science and technology, the internet has become increasingly integrated into people's lives and work. However, with the development of the network, its environment has also become increasingly complex, and various network attack methods have emerged one after another. The diversification of attack methods and the high frequency of attacks have led to increasingly frequent global network security breaches, seriously endangering the information security of individuals, enterprises, and nations. Intrusion detection technology, as one of the proactive security defense technologies that enables network traffic to propagate securely, plays an important role in today's network security. Traditional machine learning-based intrusion detection models have not achieved ideal accuracy and have a high false positive rate. Furthermore, with the development of the internet, today's network traffic is increasingly massive, and intrusion data has become more voluminous and complex. The operation of intrusion detection models requires processing and feature extraction of large amounts of traffic data, which traditional machine learning cannot handle well.

[0004] With the rise of supercomputing, computing power has greatly improved in recent years, and deep learning has been widely applied. Deep learning, represented by Convolutional Neural Networks (CNNs), has received widespread attention in academia, its outstanding feature being its ability to extract deep features without human intervention. Therefore, researchers have proposed various deep learning-based intrusion detection models, such as autoencoders and CNNs. However, these models still have some problems that need to be solved. For example, their simple structure makes it difficult to extract features from various data types. While CNN-based intrusion detection models perform well in extracting spatial features, possessing advantages such as automatic feature extraction, parameter sharing, coefficient concatenation, and translation invariance, they also require dataset normalization, neglect long-term dependencies between features, and cannot extract global features at once. Similarly, TVAE-based intrusion detection models perform well in feature reconstruction, but their ability to reconstruct temporal features is still insufficient. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a network intrusion detection method and system based on traffic feature fusion; In a first aspect, the present invention provides a network intrusion detection method based on traffic feature fusion; Network intrusion detection methods based on traffic feature fusion include: Acquire network traffic data to be detected; Preprocess network traffic data; The preprocessed network traffic data is input into the trained network intrusion detection model to obtain network intrusion detection results. The trained network intrusion detection model includes: extracting features from the preprocessed network traffic data to obtain first feature data and second feature data; fusing the extracted first feature data and second feature data to obtain fused features; and classifying the fused features to obtain classification results.

[0006] Secondly, this invention provides a network intrusion detection system based on traffic feature fusion; A network intrusion detection system based on traffic feature fusion includes: The acquisition module is configured to acquire network traffic data to be detected. The preprocessing module is configured to preprocess network traffic data. The output module is configured to: input preprocessed network traffic data into a trained network intrusion detection model to obtain network intrusion detection results; wherein the trained network intrusion detection model includes: extracting features from the preprocessed network traffic data to obtain first feature data and second feature data; fusing the extracted first feature data and second feature data to obtain fused features; and classifying the fused features to obtain classification results.

[0007] Thirdly, the present invention also provides an electronic device, comprising: Memory, used for non-transitory storage of computer-readable instructions; and Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the method described in the first aspect above.

[0008] Fourthly, the present invention also provides a storage medium for non-transitory storage of computer-readable instructions, wherein, when the non-transitory computer-readable instructions are executed by a computer, the instructions for executing the method described in the first aspect are executed.

[0009] Fifthly, the present invention also provides a computer program product, including a computer program that, when run on one or more processors, is used to implement the method described in the first aspect.

[0010] Compared with the prior art, the beneficial effects of the present invention are: (1) While reconstructing and denoising network traffic data based on the TVAE neural network model, adding the BiGRU neural network model can improve its ability to reconstruct features at different times of time series.

[0011] (2) Based on the one-dimensional convolutional neural network model and the BiGRU neural network model, the structure is reorganized and a residual network structure is added. This can effectively accelerate convergence and prevent gradient explosion while extracting the spatial and temporal features of network traffic data.

[0012] (3) Using a multi-head attention mechanism to extract importance from the fused data can effectively utilize the feature attributes of the data and improve the detection accuracy.

[0013] (4) Construct a D1CNN-BiGRU-TVAE neural network model. While using TVAE to denoise the data, extract the spatial and temporal features of network traffic data and perform feature fusion to conduct network security detection. The accuracy is higher than that of using D1CNN neural network model, BiGRU neural network model and TVAE neural network model alone, which effectively improves the accuracy of network attack detection algorithm.

[0014] (5) To address the shortcomings of the TVAE model in handling temporal features well, the neural units of the VAE encoder input layer and decoder output layer in TVAE, as well as the decoder output layer of AE, are replaced with BiGRU gated recurrent units to improve their ability to reconstruct temporal feature data.

[0015] (6) To address the ability to simultaneously extract spatial and temporal features and achieve rapid convergence, a one-dimensional CNN and BiGRU are concatenated, and a residual network structure is added. This improves the model's ability to extract spatial and temporal features from traffic data, while also accelerating convergence and preventing gradient explosion.

[0016] (7) By adding a multi-head attention mechanism to the fused data and assigning different weights to different feature types, the relationship between global and local features can be better captured; finally, the random forest algorithm is used to perform ten-class detection on the model output. This invention can better extract features from various data types and improve the feature representation capability of the overall network. Attached Figure Description

[0017] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0018] Figure 1 This is a flowchart of the overall model. Figure 2 Flowchart of the BiGRU-TVAE model; Figure 3 The flowchart is for the D1CNN-BiGRU residual model; Figure 4 This is a structural diagram of a dual variational automatic encoder (TVAE) in the prior art. Figure 5 This is a structural diagram of a variational automatic encoder (VAE) in the prior art. Figure 6 This is a structural diagram of an automatic encoder (AE) in the prior art. Detailed Implementation

[0019] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0020] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the exemplary embodiments of the present invention. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. Furthermore, it should be understood that the terms “comprising” and “having”, and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0021] All data acquisition in this embodiment is carried out in accordance with laws and regulations and with user consent, and the data is used legally.

[0022] like Figure 4 As shown, the Twin Variational Autoencoder (TVAE) has three components: an encoder, a hermaphroditic part, and a decoder. The hermaphroditic part is shared by the VAE (Variational Autoencoder) and the AE (Autoencoder), with the decoder of the VAE acting as the encoder for the AE. The goal of the autoencoder AE in the TVAE is to reconstruct the latent representation of the VAE at its output layer. Therefore, the output of the autoencoder AE in the TVAE can serve as a new representation of the original data. This new representation is then used as input to a classification algorithm to detect potentially malicious data.

[0023] Example 1 This embodiment provides a network intrusion detection method based on traffic feature fusion; Network intrusion detection methods based on traffic feature fusion include: S101: Obtain network traffic data to be detected; S102: Preprocess network traffic data; S103: Input the preprocessed network traffic data into the trained network intrusion detection model to obtain the network intrusion detection results; The trained network intrusion detection model includes: Feature extraction is performed on the preprocessed network traffic data to obtain the first feature data and the second feature data. The extracted first and second feature data are fused to obtain the fused features; The fused features are then classified to obtain the classification results.

[0024] Further, in step S101: acquire network traffic data to be detected by capturing network traffic data.

[0025] Furthermore, S102: preprocessing the network traffic data specifically includes: converting the data type of the network traffic data and normalizing the data type conversion result.

[0026] Furthermore, such as Figure 1 As shown, the network structure of the trained network intrusion detection model includes: Parallel BiGRU-TVAE model and D1CNN-BiGRU residual model; The input end of the BiGRU-TVAE model is used to input preprocessed network traffic data, and the output end of the BiGRU-TVAE model is connected to the input end of the data fusion module. The input of the D1CNN-BiGRU residual model is used to input preprocessed network traffic data, and the output of the D1CNN-BiGRU residual model is connected to the input of the data fusion module. The output of the data fusion module is connected to the input of the multi-head attention mechanism module, the output of the multi-head attention mechanism module is connected to the input of the random forest algorithm module, and the output of the random forest algorithm module is used to output the network intrusion detection classification results.

[0027] Furthermore, the data fusion module uses an additive approach to perform data fusion.

[0028] Furthermore, such as Figure 2As shown, the BiGRU-TVAE model has the following network structure: The encoder, linear activation layer, decoder of the variational autoencoder (VAE), and decoder of the autoencoder (AE) are connected in sequence. In particular, the input layer neural unit of the encoder of the variational autoencoder (VAE), the output layer neural unit of the decoder of the variational autoencoder (VAE), and the output layer neural unit of the decoder of the autoencoder (AE) are all replaced with a gated loop unit (BiGRU).

[0029] Furthermore, the working process of the BiGRU-TVAE model includes: The gated recurrent unit BiGRU of the variational automatic encoder (VAE) captures the temporal characteristics of network traffic data. The linear activation layer processes the temporal characteristics and outputs the mean and variance of the temporal characteristics. Then, the mean and variance are reparameterized to estimate the distribution of latent variables of the point vector. The gated recurrent unit (BiGRU) of the decoder in the variational autoencoder (VAE) performs temporal reconstruction of the input data of the dataset based on the latent variable distribution of the point vectors. The gated recurrent unit (BiGRU) of the decoder of the automatic encoder (AE) decodes the temporal reconstruction result to obtain the reconstruction vector.

[0030] It should be understood that the BiGRU-TVAE model employs both BiGRU and TVAE models. To improve TVAE's ability to extract temporal features, the neural units of the VAE encoder input layer and decoder output layer, as well as the decoder output layer of the AE, are replaced with BiGRU gated recurrent units within the TVAE framework. This effectively enhances the model's ability to learn temporal features of network traffic data, overcomes the gradient vanishing and exploding problems in the feature extraction process of traditional recurrent neural networks, and achieves correct encoding and decoding of data features.

[0031] It should be understood that in the BiGRU-TVAE model, the data is directly input into the model. The BiGRU unit of the VAE encoder in the TVAE captures the temporal characteristics of the network traffic data, and outputs the mean value corresponding to the feature value through the Linear activation layer. and variance Then, the VAE encoder performs a reparameterization operation to estimate the latent variable distribution Z of the point vector; the VAE's BiGRU unit decoder then performs temporal reconstruction of the data based on the latent variable Z; and its output layer data is used as the input data of the BiGRU unit of the AE decoder to decode the data again, and finally outputs the reconstructed vector.

[0032] It should be understood that the BiGRU-TVAE model employs both BiGRU and TVAE models. To improve TVAE's ability to extract temporal features, within the TVAE framework, the neural units of the VAE encoder input layer and decoder output layer, as well as the decoder output layer of the AE, are replaced with BiGRU gated recurrent units. This effectively enhances the model's ability to learn temporal features of network traffic data, overcomes the gradient vanishing and exploding problems in the feature extraction process of traditional recurrent neural networks, and achieves correct encoding and decoding of data features.

[0033] TVAE can automatically extract features from traffic data, preserving the overall characteristics of the data while iteratively extracting more complex and reliable features, reducing the impact of noise on traffic intrusion detection, and reducing feature dimensionality. However, TVAE only learns linear or nonlinear relationships between data features, ignoring the temporal dependencies between data sequences. BiGRU neural network models have good performance in learning temporal features of natural language; therefore, using BiGRU to learn the temporal relationships between multiple traffic feature vectors, and compared to other RNN variants, BiGRU has advantages such as simpler structure, fewer parameters, faster training speed for low-dimensional deep feature data, and less time consumption, can improve the accuracy of traffic intrusion detection.

[0034] First, the preprocessed data is directly input into the model. Within the existing TVAE model framework, the neural units of the VAE encoder input layer and decoder output layer in TVAE, as well as the decoder output layer of AE, are replaced with BiGRU gated recurrent units. The input dimension of the VAE encoder in TVAE is set to 81 dimensions, and the number of hidden layer nodes is 128. The BiGRU unit of the VAE encoder captures the temporal features of network traffic data, and outputs the mean values ​​corresponding to the feature values ​​through a Linear activation layer. and variance ; Then, a reparameterization operation is performed within the VAE framework to estimate the latent variable distribution Z of the point vector. The VAE decoder dimension is set to 81 dimensions and the number of hidden layer nodes is 128. The VAE's BiGRU unit decoder performs temporal reconstruction of the data based on the latent variable Z. The output layer data is then used as the input data of the BiGRU unit of the AE decoder to decode the data again. The AE decoder dimension is 81 dimensions and the number of hidden layer nodes is 128. Finally, the number of output reconstruction vector units is 10.

[0035] like Figure 5 As shown, the variational autoencoder (VAE) includes an encoder, a hidden layer, and a decoder connected in sequence.

[0036] like Figure 6 As shown, the auto encoder AE includes an encoder, a hidden layer, and a decoder connected in sequence.

[0037] Furthermore, such as Figure 3 As shown, the D1CNN-BiGRU residual model has the following network structure: The following layers are connected in sequence: a one-dimensional convolutional layer C1, a batch normalized layer BN1, a max pooling layer M1, a one-dimensional convolutional layer C2, a batch normalized layer BN2, a max pooling layer M2, a gated recurrent unit BiGRU1, a max pooling layer M3, a batch normalized layer BN3, a fully connected layer Q1, a fully connected layer Q2, a fully connected layer Q3, and an output layer. The output of the maximum pooling layer M1 is connected to the input of the gated recurrent unit BiGRU1. The output of the max pooling layer M2 is connected to the input of the max pooling layer M3.

[0038] Furthermore, the working process of the D1CNN-BiGRU residual model includes: A one-dimensional convolutional layer C1 extracts features from the input data, and a max pooling layer M1 reduces the dimensionality of the features. One-dimensional convolutional layer C2 extracts features from the data output by max pooling layer M1, and max pooling layer M2 performs dimensionality reduction on the features; The gated recurrent unit BiGRU1 extracts temporal features from the data output of the max pooling layer M2; The max pooling layer M3 performs dimensionality reduction on the extracted temporal features; Fully connected layers Q1, Q2, and Q3 are used to unify dimensions.

[0039] Because the output dimensions of BiGRU and one-dimensional convolution are inconsistent, a fully connected layer is needed to adjust its dimension. After adjusting to a unified dimension, residuals can be calculated.

[0040] It should be understood that the D1CNN-BiGRU residual model transforms the features of the input data into a tensor of dimension (128,1) and inputs it into the input layer; then, after feature extraction through multiple one-dimensional convolutional layers, BN layers are added to accelerate convergence, and after feature dimensionality reduction through multiple one-dimensional max pooling layers, it is input into the BiGRU neural network layer for temporal feature extraction, and then input into the one-dimensional max pooling layer for further feature dimensionality reduction, and finally connected to three fully connected layers.

[0041] The residual structure comprises a one-dimensional convolutional layer, a batch normalization (BN) layer, and a one-dimensional max pooling layer as a single network layer, totaling two layers. Combining this with BiGRU as a residual structure prevents gradient explosion and accelerates convergence. Finally, cross-entropy is used as the output.

[0042] The D1CNN-BiGRU residual model employs a cascaded one-dimensional CNN and BiGRU structure. It utilizes the D1CNN model to extract spatial features from the input data and the BiGRU model to extract temporal features from the input data. It includes six deep learning layers: Input Layer, Conv1D Layer, MaxPool1D Layer, Batch Normalization, Dense Layer, and BiGRU Layer.

[0043] D1CNN is a CNN that uses a one-dimensional grid to acquire sequential data for feature recognition. Although D1CNN has only one dimension, it retains the translation invariance advantage of D2CNN in feature recognition. Based on this, D1CNN is used to extract local features from traffic data. The D1CNN model achieves local spatial feature extraction by stacking one-dimensional convolutional layers and pooling layers, solving the problem of local feature loss. The one-dimensional convolutional layer is key to feature extraction; it obtains a set of optimal convolutional kernels with minimum loss through training on traffic data, and automatically extracts complex traffic features using these kernels (filters). The i-th sample of the traffic data can be represented as an m-dimensional feature vector. Multiple continuous vectors , ,..., It can be represented as One-dimensional convolution only performs convolution in the vertical direction of the traffic feature data sequence. Therefore, the width of its convolution kernel is the dimension of the traffic feature. By applying the convolution operation to the input traffic data using a filter w, a feature map is constructed to achieve local spatial feature extraction. The calculation formula is as follows:

[0044] Where b is the bias value, and f represents the nonlinear activation function for convolution computation, the Rectified Linear Unit (ReLU).

[0045] Pooling layers further aggregate and preserve the short-term features extracted by the convolutional layers, yielding the most important features. Commonly used pooling methods are max pooling and average pooling. This invention uses max pooling layers to merge the maximum values ​​of the feature vectors from each convolutional layer, using these as feature values.

[0046] Batch-normalization (BN) adjusts the input value distribution of neurons in each layer of a neural network to a standard normal distribution with a mean of 0 and a variance of 1. This addresses the difficulties in network training, effectively improving training speed, preventing gradient vanishing, and enhancing generalization ability. The output of batch-normalization is expressed as: = +

[0047] in: It is a coefficient; Depend on = , = , =

[0048] The calculation shows that m is the batch size. It is a time series.

[0049] The basic idea of ​​a bidirectional GRU (BiGRU) neural network is to configure unidirectional GRUs in both the forward and backward directions of each training sequence, with both GRUs connected to the same output layer. This structure provides the output layer with both the past and future information of a sequence of data points. A BiGRU consists of two GRUs stacked on top of each other. At any time t, the input terminal simultaneously provides the same input data to the two GRUs in opposite directions. The output states of the forward GRU are obtained respectively. and the output state of the backward GRU Output GRU_ State of the forward GRU and the output state of the backward GRU It is assembled according to specific criteria.

[0050] The calculation process of the BiGRU neural network is as follows: Assume the input at time step t is The activation function of the hidden layer is The forward-hidden state is The backward hidden state is ,So: = ( ) = ( ) in, , , , These represent the weight parameters, , These represent the biases corresponding to the forward and backward hidden states, respectively. The output GRU_ of the output layer is then calculated based on these biases. : GRU_ =( ) +

[0051] in, This represents the weight parameters of the output layer. Indicates the bias of the output layer. This represents the concatenation of the forward and backward hidden states. By weighted concatenation of the forward and backward hidden states to calculate the final output, effective information can be learned while maintaining the same output dimension. Compared to directly concatenating the hidden states in the two directions, this reduces the dimensionality and helps to reduce training time.

[0052] First, the features of the input data are transformed into tensors of dimension (128, 1) and then input into the input layer. This is followed by two one-dimensional convolutional layers with kernel sizes of 3 and 3, strides of 1 and 2, and ReLU activation functions. After each one-dimensional convolutional layer, a batch normalization (BN) layer with 128 channels and a MaxPool1D layer with a pooling size of 1 are added. The BN layer accelerates convergence. Then, a BiGRU layer with an input size of 81 is added to extract temporal features. This layer, along with a MaxPool1D layer with a pooling size of 1 and a BN layer, has 128 channels. Finally, three fully connected layers are added, resulting in 10 output units for a 10-class classification scenario. The residual structure consists of two layers: a one-dimensional convolutional layer, a BN layer, and a one-dimensional max-pooling layer. Combining this with the BiGRU in a residual structure prevents gradient explosion and accelerates convergence. Finally, cross-entropy is used as the output.

[0053] Further, the step of extracting features from the preprocessed network traffic data to obtain first feature data and second feature data includes: The BiGRU-TVAE model extracts features from the preprocessed network traffic data to obtain the first feature data. The D1CNN-BiGRU residual model extracts features from the preprocessed network traffic data to obtain the second feature data.

[0054] Further, the step of fusing the extracted first feature data and second feature data to obtain fused features includes: The extracted first and second feature data are added together to obtain the fused feature. The fused features are input into a multi-head attention layer, followed by a linear layer, and finally classified by cross-entropy.

[0055] Furthermore, the classification of the fused features to obtain the classification result includes: A multi-head attention mechanism module is used to assign different weights to different feature types, and a random forest model is used to classify the features.

[0056] The multi-head attention mechanism module is developed based on the self-attention layer. Using the multi-head attention mechanism module, learning information from different modules can be combined.

[0057] The input vector Through respectively , , , to obtain the corresponding , , Then, by using the number of heads h, the obtained , , Divide into h parts. The corresponding head formula is:

[0058] By obtaining each head i The corresponding Qi, Ki, and Vi parameters are used to obtain the corresponding results for each head using a self-attention mechanism. The formula for the self-attention mechanism is as follows:

[0059] Next, the results from each head are concatenated, and then the concatenated result is processed through W. o The learnable parameters are fused together to obtain the final result. The corresponding formula is:

[0060]

[0061] The fused features are assigned different weights through a multi-head attention mechanism, and then the weighted fused features are extracted again. Then a liner layer is added, and finally cross-entropy classification is performed.

[0062] During training, a random forest model was used to conduct a 10-class classification experiment on the features. This 10-class classification experiment divided the CIC-IDS-2017 data into normal samples and nine other attack samples, labeled "DosHulk," "PortScan," "DDos," "Dos GoldenEye," "FTP-Patator," "SSH-Parator," "Dosslowloris," "Dos Slowhttptest," and "Bot." To avoid overfitting, the optimal model was automatically saved if performance did not improve after 12 consecutive epochs. The batch size used in this invention was 512 samples, the learning rate was 0.001, and after 33 training epochs, the final trained model achieved an accuracy of 96.8%, a recall of 97%, and an F1 score of 93.1% on the test set for the 10-class classification problem using the random forest algorithm.

[0063] Furthermore, the training process of the trained network intrusion detection model includes: Construct training and testing sets; both training and testing sets consist of network traffic data with known network intrusion detection classification results. The training set is input into the network intrusion detection model to train the model. Training is stopped when the loss function value of the model no longer decreases or the number of iterations exceeds the set number, and the network intrusion detection model after preliminary training is obtained. Input the test set into the initially trained network intrusion detection model to test the model. Stop the test when all test indicators meet the requirements. The network intrusion detection model that passes the test is the final trained network intrusion detection model.

[0064] Furthermore, the test metrics include: accuracy, recall, and F1 score; Accuracy (AC), recall (RE), and F1-score (F1) are used as evaluation metrics, and their calculation formulas are as follows: ; ; ; ; Among them, TP, FP, TN and FN are true positive, false positive, true negative and false negative, respectively, and their physical meanings are shown in Table 2.

[0065] Table 2 Physical meaning of terms

[0066] Furthermore, the construction of the training set and test set includes: The input data is normalized using the min-max method, which normalizes all values ​​to the range [0,1]. The calculation formula is as follows: =

[0067] in, and These represent the minimum and maximum values ​​of all values ​​in a certain feature attribute, respectively.

[0068] The input data is divided into 80% training set and 20% test set, and the data is cleaned. The first 80 dimensions of each data set are features. To facilitate the conversion of the data into a two-dimensional format, the 81st dimension is filled with 0, and the 82nd dimension is the type label.

[0069] The CIC-IDS-2017 dataset was used as the input data for network intrusion detection. Machine learning algorithms were used to transform the data type of the input data, remove four features that were irrelevant to feature extraction: Flow ID, Source IP, Destination IP, and Timestamp. After deleting null values, the data was normalized using MinMaxScaler in sk-learn, and the last column of the dataset was extracted as the label.

[0070] The input data is shown in Table 1, including 80% of the dataset as the training set and 20% of the dataset as the test set. The first 80 dimensions of each set of data are feature quantities. To facilitate the conversion of the data into a two-dimensional format, the 81st dimension is filled with 0, and the 82nd dimension is the type label. The data is divided into 10 data types, and the labels are converted into int types from 0 to 9. The total amount of data is 1,053,853.

[0071] Table 1. Composition of Training and Test Sets

[0072] Data Cleaning: Since the data is captured from a real network environment, the possibility of invalid data is very high. This invention removes invalid data to improve the accuracy of the detection results. In addition, more than 80 features are extracted from the original data, such as flow duration, total length of forward packets, and total length of backward packets, which are important features for intrusion detection in this invention's model. However, features such as IP address, protocol, and port number are also present, which are not needed. Therefore, this invention removes these unnecessary feature fields, such as Flow ID, Source IP, Destination IP, and Timestamp.

[0073] For dataset normalization, given the significant differences in the range of values ​​for each attribute, a min-max method is used. Assuming there are N samples in the dataset, each feature attribute of all samples can be mapped to X = ... This normalizes all values ​​to the range [0,1].

[0074] This invention proposes an intrusion detection method based on network traffic data feature fusion. It introduces BiGRU into TVAE, recombines it with CNN neural network, adds residual network structure, and finally applies a multi-head attention mechanism to the fused data.

[0075] Example 2 This embodiment provides a network intrusion detection system based on traffic feature fusion; A network intrusion detection system based on traffic feature fusion includes: The acquisition module is configured to acquire network traffic data to be detected. The preprocessing module is configured to preprocess network traffic data. The output module is configured to: input preprocessed network traffic data into a trained network intrusion detection model to obtain network intrusion detection results; wherein the trained network intrusion detection model includes: extracting features from the preprocessed network traffic data to obtain first feature data and second feature data; fusing the extracted first feature data and second feature data to obtain fused features; and classifying the fused features to obtain classification results.

[0076] It should be noted that the acquisition module, preprocessing module, and output module described above correspond to steps S101 to S103 in Embodiment 1. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in Embodiment 1. It should also be noted that these modules, as part of the system, can be executed in a computer system, such as a set of computer-executable instructions.

[0077] The descriptions of each embodiment in the above embodiments have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0078] The proposed system can be implemented in other ways. For example, the system embodiments described above are merely illustrative, and the division of modules described above is only a logical functional division. In actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed.

[0079] Example 3 This embodiment also provides an electronic device, including: one or more processors, one or more memories, and one or more computer programs; wherein, the processor is connected to the memory, and the one or more computer programs are stored in the memory. When the electronic device is running, the processor executes the one or more computer programs stored in the memory to cause the electronic device to perform the method described in Embodiment 1.

[0080] It should be understood that in this embodiment, the processor can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0081] Memory may include read-only memory and random access memory, and provides instructions and data to the processor. A portion of memory may also include non-volatile random access memory. For example, memory may also store information about the device type.

[0082] In the implementation process, each step of the above method can be completed by the integrated logic circuits in the processor hardware or by software instructions.

[0083] The method in Embodiment 1 can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor. The software modules can reside in readily available storage media in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory; the processor reads information from the memory and, in conjunction with its hardware, completes the steps of the above method. To avoid repetition, a detailed description is not provided here.

[0084] Those skilled in the art will recognize that the units and algorithm steps described in connection with the various examples of this embodiment can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this invention.

[0085] Example 4 This embodiment also provides a computer-readable storage medium for storing computer instructions, which, when executed by a processor, complete the method described in Embodiment 1.

[0086] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A network intrusion detection method based on traffic feature fusion, characterized in that: include: Acquire network traffic data to be detected; Preprocess network traffic data; The preprocessed network traffic data is input into the trained network intrusion detection model to obtain network intrusion detection results. The trained network intrusion detection model includes: extracting features from the preprocessed network traffic data to obtain first feature data and second feature data; fusing the extracted first feature data and second feature data to obtain fused features; and classifying the fused features to obtain classification results. The trained network intrusion detection model has the following network structure: Parallel BiGRU-TVAE model and D1CNN-BiGRU residual model; the BiGRU-TVAE model network structure includes: The encoder, linear activation layer, decoder of variational autoencoder (VAE), and decoder of autoencoder (AE) are connected in sequence. Among them, the input layer neural unit of the encoder of the variational auto encoder (VAE), the output layer neural unit of the decoder of the variational auto encoder (VAE), and the output layer neural unit of the decoder of the auto encoder (AE) are all replaced with gated loop units (BiGRU). The D1CNN-BiGRU residual model has the following network structure: The following layers are connected in sequence: a one-dimensional convolutional layer C1, a batch normalized layer BN1, a max pooling layer M1, a one-dimensional convolutional layer C2, a batch normalized layer BN2, a max pooling layer M2, a gated recurrent unit BiGRU1, a max pooling layer M3, a batch normalized layer BN3, a fully connected layer Q1, a fully connected layer Q2, a fully connected layer Q3, and an output layer. The output of the maximum pooling layer M1 is connected to the input of the gated recurrent unit BiGRU1. The output of the max pooling layer M2 is connected to the input of the max pooling layer M3. The input end of the BiGRU-TVAE model is used to input preprocessed network traffic data, and the output end of the BiGRU-TVAE model is connected to the input end of the data fusion module. The input of the D1CNN-BiGRU residual model is used to input preprocessed network traffic data, and the output of the D1CNN-BiGRU residual model is connected to the input of the data fusion module. The output of the data fusion module is connected to the input of the multi-head attention mechanism module, the output of the multi-head attention mechanism module is connected to the input of the random forest algorithm module, and the output of the random forest algorithm module is used to output the network intrusion detection classification results.

2. The network intrusion detection method based on traffic feature fusion as described in claim 1, characterized in that, The working process of the BiGRU-TVAE model includes: The gated recurrent unit BiGRU of the variational automatic encoder (VAE) captures the temporal characteristics of network traffic data. The linear activation layer processes the temporal characteristics and outputs the mean and variance of the temporal characteristics. Then, the mean and variance are reparameterized to estimate the distribution of latent variables of the point vector. The gated recurrent unit (BiGRU) of the decoder in the variational autoencoder (VAE) performs temporal reconstruction of the input data of the dataset based on the latent variable distribution of the point vectors. The gated recurrent unit (BiGRU) of the decoder of the automatic encoder (AE) decodes the temporal reconstruction result to obtain the reconstruction vector.

3. The network intrusion detection method based on traffic feature fusion as described in claim 1, characterized in that, The working process of the D1CNN-BiGRU residual model includes: A one-dimensional convolutional layer C1 extracts features from the input data, and a max pooling layer M1 reduces the dimensionality of the features. One-dimensional convolutional layer C2 extracts features from the data output by max pooling layer M1, and max pooling layer M2 performs dimensionality reduction on the features; The gated recurrent unit BiGRU1 extracts temporal features from the data output of the max pooling layer M2; The max pooling layer M3 performs dimensionality reduction on the extracted temporal features; Fully connected layers Q1, Q2, and Q3 are used to unify dimensions.

4. The network intrusion detection method based on traffic feature fusion as described in claim 1, characterized in that, The step of extracting features from the preprocessed network traffic data to obtain first feature data and second feature data includes: The BiGRU-TVAE model extracts features from the preprocessed network traffic data to obtain the first feature data. The D1CNN-BiGRU residual model extracts features from the preprocessed network traffic data to obtain the second feature data. The process of classifying the fused features to obtain classification results includes: A multi-head attention mechanism module is used to assign different weights to different feature types, and a random forest model is used to classify the features.

5. A network intrusion detection system based on traffic feature fusion, characterized in that: include: The acquisition module is configured to acquire network traffic data to be detected. The preprocessing module is configured to preprocess network traffic data. The output module is configured to: input preprocessed network traffic data into a trained network intrusion detection model to obtain network intrusion detection results; wherein the trained network intrusion detection model includes: extracting features from the preprocessed network traffic data to obtain first feature data and second feature data; fusing the extracted first feature data and second feature data to obtain fused features; and classifying the fused features to obtain classification results. The trained network intrusion detection model has the following network structure: Parallel BiGRU-TVAE model and D1CNN-BiGRU residual model; the BiGRU-TVAE model network structure includes: The encoder, linear activation layer, decoder of variational autoencoder (VAE), and decoder of autoencoder (AE) are connected in sequence. Among them, the input layer neural unit of the encoder of the variational auto encoder (VAE), the output layer neural unit of the decoder of the variational auto encoder (VAE), and the output layer neural unit of the decoder of the auto encoder (AE) are all replaced with gated loop units (BiGRU). The D1CNN-BiGRU residual model has the following network structure: The following layers are connected in sequence: a one-dimensional convolutional layer C1, a batch normalized layer BN1, a max pooling layer M1, a one-dimensional convolutional layer C2, a batch normalized layer BN2, a max pooling layer M2, a gated recurrent unit BiGRU1, a max pooling layer M3, a batch normalized layer BN3, a fully connected layer Q1, a fully connected layer Q2, a fully connected layer Q3, and an output layer. The output of the maximum pooling layer M1 is connected to the input of the gated recurrent unit BiGRU1. The output of the max pooling layer M2 is connected to the input of the max pooling layer M3. The input end of the BiGRU-TVAE model is used to input preprocessed network traffic data, and the output end of the BiGRU-TVAE model is connected to the input end of the data fusion module. The input of the D1CNN-BiGRU residual model is used to input preprocessed network traffic data, and the output of the D1CNN-BiGRU residual model is connected to the input of the data fusion module. The output of the data fusion module is connected to the input of the multi-head attention mechanism module, the output of the multi-head attention mechanism module is connected to the input of the random forest algorithm module, and the output of the random forest algorithm module is used to output the network intrusion detection classification results.

6. An electronic device, characterized in that it comprises: Memory is used to store computer-readable instructions in a non-transitory manner. as well as Processor, for executing the computer-readable instructions, When the computer-readable instructions are executed by the processor, they perform the method described in any one of claims 1-4.

7. A storage medium, characterized in that, The computer-readable instructions are stored non-transitory, wherein when the non-transitory computer-readable instructions are executed by a computer, the instructions of the method according to any one of claims 1-4 are executed.

Images