Network Attack Intrusion Detection Method Based on Improved XGBoost and Adaptive Optimization K-means Model

Abstract

The present invention discloses a method for detecting network attack intrusion based on machine learning, including: constructing an XGBoost intrusion detection model, initializing the basic parameters of XGBoost and the parameters required for the simulated annealing algorithm. Calculate the current accuracy Accnow and perform positive and negative random perturbations on the XGBoost parameters to generate new parameters and calculate the corresponding new accuracy Accnew. Decide whether to accept the new parameters according to the Metropolis criterion. Repeat the above steps until the temperature cools to the lowest point. Use the XGBoost corresponding to the optimal parameters to perform intrusion detection on the validation set, and transmit all the "coarse classification" results determined to be attacks to the improved K-means model. Initialize the k value to 3 and use K-means to perform clustering analysis on all the real attack samples in the training set and the attack samples "coarsely classified" by XGBoost in the validation set. Record the number of benign samples R recalled by the clustering analysis. Continuously increase the k value and perform clustering analysis again and record the benign recall number R until the R value no longer increases, then determine the k value and record the center point and the historical maximum distance.

Description

Technical Field

[0001] The present invention relates to the technical fields of machine learning and network security, and particularly to a network attack intrusion detection method based on an improved XGBoost and an adaptive optimization K-means model. Background Art

[0002] With the rapid development of network technologies represented by 5G technology, the Internet has been widely applied in various fields such as industry, finance, and education. While the information network has become an important guarantee for social development, due to the diversity, unevenness, and openness of network forms, computers are vulnerable to network attacks during application, resulting in information data leakage and damage. Relevant data shows that during the decade from 2015 to 2025, the potential global economic losses caused by network attacks may reach up to $294 billion. The escalation of network risks has drawn increasing attention from governments, enterprises, and individuals. In a large network, Windows-based authentication events can be represented as an attack graph. Through the attack graph, it can be analyzed which computer is most likely to be the source of an attack when a host is compromised, so as to trace the source of the attack and help the defense side better analyze and make decisions.

[0003] Currently, there are many methods available for intrusion detection, such as intrusion detection methods based on rule matching, attack detection algorithms based on graph clustering, intrusion detection methods based on deep autoencoders, and so on. In the process of determining the center point of the attack detection model based on graph clustering, it is necessary to continuously perform repetitive calculations on all data. As the sample size increases exponentially, it will generate incalculable time overhead. Machine learning models such as random forest, decision tree, and LightGBM have a large number of parameters including learning rate, number of leaf nodes, and depth of the tree. Manual parameter tuning requires a large amount of manpower, and the parameters finally obtained by the traditional grid-based tuning method are not optimized. Therefore, a method for automatic optimization and tuning of the model is needed to reduce manual operations. The unsupervised K-means clustering analysis model requires repeated traversal of all data multiple times during model training, resulting in huge computational time overhead. At the same time, the selection of the k value in the model is extremely challenging. The k value selection method based on experience often cannot select the best k value, making the model effect unable to reach the best state. The intrusion detection method based on rule matching can only deal with existing simple pattern attacks and cannot detect attack variants and new attacks. The intrusion detection method based on deep autoencoders combines an autoencoder for data feature screening and uses a deep neural network model for intrusion detection. However, the deep neural network model cannot model the correlation in time series, and in the intrusion detection scenario, the data has a time series relationship. Summary of the Invention

[0004] The present invention overcomes the deficiencies of the prior art and provides a new method for fine-grained assessment based on rural population hollowing out. The object of the present invention is achieved by the following technical solutions:

[0005] The present invention provides a network attack intrusion detection method based on an improved XGBoost and an adaptive optimized K-means model, including:

[0006] S1: Construct an XGBoost intrusion detection model based on a data set;

[0007] S2: Initialize the basic parameters of the XGBoost intrusion detection model and the basic parameters of the simulated annealing algorithm;

[0008] S3: Calculate the corresponding intrusion detection accuracy ACC under the current XGBoost parameters according to the training set data of the XGBoost intrusion detection model now , perform positive and negative random perturbations on the basic parameters of the XGBoost intrusion detection model to generate new parameters, and calculate the corresponding classification accuracy ACC under the new parameters new ;

[0009] S4: Determine probabilistically whether to accept the new parameters as the current optimal solution according to the Metropolis criterion by comparing ACC now and ACC new ;

[0010] S5: If it is decided to accept the new parameters as the current optimal solution, the iteration count +1, and determine whether the current iteration count f reaches the initialized Markov chain length L mar ;

[0011] S6: If the current iteration count f reaches the initialized Markov chain length L mar , reset the iteration count f = 0, and perform a temperature decay, and determine whether the current temperature T start ' reaches the initialized termination temperature T end , if so, end the simulated annealing algorithm;

[0012] S7: If the current temperature T start ' reaches the initialized termination temperature T[[ID=4**3]] end , then perform intrusion detection on the validation set through the XGBoost intrusion detection model corresponding to the new parameters;

[0013] S8: Initialize the k value of K-means, and introduce all malicious samples D t in the training set and samples D x identified as attacks by the XGBoost model from the validation set into the K-means model;

[0014] S9: Train the K-means model, and use the K-means model to perform clustering analysis on all incoming data. Recall the samples misjudged as malicious samples by the XGBoost intrusion detection model as benign samples, and record the recall number n now ;

[0015] S10: Gradually increase the k value of the K-means model, and repeat S9 to recall the number of samples n misidentified as attacks by the XGBoost intrusion detection model new , until n new >n now Then replace n now with n new and continue to execute S10 until the optimal k value is obtained;

[0016] S11: Calculate the k center points C of the K-means model i and the maximum distance D to the corresponding center point i ;

[0017] S12: Determine whether a new type of attack is detected. If a new type of attack is detected, return to S9.

[0018] Preferably, in S2, the basic parameters of the XGBoost intrusion detection model include the learning rate, the depth of the tree, and the feature ratio; the basic parameters of the simulated annealing algorithm include the starting temperature T start and the termination temperature T end as well as the length L of the Markov chain mar and the temperature decay coefficient R.

[0019] Preferably, in S4, the probabilistic calculation formula of the Metropolis criterion is as follows:

[0020]

[0021] where f represents the current iteration number and T represents the current temperature.

[0022] Preferably, in S4, if it is decided not to accept the new parameter as the current optimal solution, the iteration number is increased by 1, and it is determined whether the iteration number reaches the length of the Markov chain. If not, return to S3.

[0023] Preferably, in S5, if the current iteration number f is less than the initialized length L of the Markov chain mar , then return to S4.

[0024] More preferably, in S6, the temperature decay calculation formula is as follows:

[0025] T start ' = T start ×R

[0026] If the current temperature T is greater than the initialized minimum temperature, then return to S4.

[0027] Preferably, in S9, the K-means model is used to perform clustering analysis on the incoming data, and the samples are classified into k categories. The incoming data includes all known malicious samples from the training set and the samples identified as malicious by the XGBoost model in the validation set. The malicious samples from the training set and the samples identified as malicious by the XGBoost model in the validation set are divided into k categories, where the malicious samples from the training set contain p categories, and the samples from the validation set are divided into q categories, and the number of benign recalls n is recorded. now 。

[0028] More preferably, in S12, the framework is deployed and launched. For each log entry to be detected, it is first input into the XGBoost intrusion detection model for rough classification to determine whether the log belongs to an attack event. If it is determined to be a benign behavior, it is directly used as the determination result of the framework for this log entry. Conversely, if the XGBoost intrusion detection model determines this log entry as an attack behavior, then this log entry is passed into the optimized K-means model for fine classification.

[0029] First, calculate the distances from this log entry to the k center points, and use the category with the smallest distance as its classification result. Then compare whether the distance is greater than the historical maximum clustering distance. If it is greater than the historical maximum distance, trigger the K-means model to perform automatic update and optimization of the k value. Conversely, if it is less than the historical maximum distance, determine whether this category belongs to the attack category. If it does not belong, perform a benign recall to indicate that it was misjudged as an attack event by the XGBoost intrusion detection model. If it belongs to the attack category, then this log entry is finally determined as an attack event by the framework.

[0030] The network attack intrusion detection method based on the improved XGBoost and adaptive optimization K-means model proposed in this application has the following beneficial effects:

[0031] 1. Combining the supervised XGBoost model and the unsupervised K-means model for intrusion detection can achieve high detection rates and low false alarm rates. In the process of combining the two models, we introduced the idea of a data pipeline. The unsupervised K-means model only needs to receive all attack samples in the training set during the model training stage (intrusion detection is an application scenario with extremely unbalanced positive and negative samples, and the number of attack samples is extremely small, so the concealment is extremely high) and the samples identified as attacks after the initial screening by the supervised XGBoost model, so as to correct the misjudged results of the supervised XGBoost model. The idea of the data pipeline ensures that the intrusion detection model will not reduce its timeliness due to the integration of the K-means model.

[0032] 2. During the process of training the K-means model, the idea of data pipeline was ingeniously used, and only all malicious samples from the training set and the samples determined to be malicious by XGBoost in the validation set were passed in. Since in the attack detection scenario, it is a scenario with extremely unbalanced positive and negative samples, and the number of benign samples in the training set is hundreds of thousands of times that of malicious samples. Therefore, in order to reduce the time overhead of the K-means model, only all malicious samples in the training set were introduced, aiming to correct the samples misjudged by the XGBoost model in the validation set by combining the feature distribution of malicious samples.

[0033] 3. Multiple model parameters of the XGBoost model were automatically optimized through the simulated annealing algorithm, realizing the process of automatic parameter tuning, and the finally determined model parameters must be the optimal ones. A method for adaptively determining the k value for the unsupervised K-means model was designed. The k value was automatically determined and optimized, and the k value would be automatically updated according to the business scenario after the intrusion detection framework was deployed online. When the framework detected new types of attacks, it would also trigger the K-means model to automatically update the k value. Brief Description of the Drawings

[0034] The present invention will be further described with reference to the accompanying drawings. However, the embodiments in the drawings do not constitute any limitation to the present invention. For those of ordinary skill in the art, other drawings can be obtained according to the following drawings without creative efforts.

[0035] Figure 1 It is a flowchart of a network attack intrusion detection method based on an improved XGBoost and an adaptive optimized K-means model provided by an embodiment of the present application;

[0036] Figure 2 It is a design flowchart for adaptively determining and optimizing the k value provided by an embodiment of the present application; Detailed Description of the Embodiment

[0037] The following further describes in detail the network attack intrusion detection method based on an improved XGBoost and an adaptive optimized K-means model with specific embodiments. These embodiments are only for the purpose of comparison and explanation, and the present invention is not limited to these embodiments.

[0038] In one embodiment, as Figure 1 shown, the present invention provides a network attack intrusion detection method based on an improved XGBoost and an adaptive optimized K-means model, including:

[0039] S1: Construct an XGBoost intrusion detection model based on the data set;

[0040] S2: Initialize the basic parameters of the XGBoost intrusion detection model and the basic parameters of the simulated annealing algorithm;

[0041] The basic parameters of the simulated annealing algorithm include the starting temperature T start and the termination temperature T end as well as the length L of the Markov chain mar and the temperature decay coefficient R.

[0042] S3: Calculate the corresponding intrusion detection accuracy ACC under the current XGBoost parameters based on the training set data of the XGBoost intrusion detection model now , perform positive and negative random perturbations on the basic parameters of the XGBoost intrusion detection model to generate new parameters, and calculate the corresponding classification accuracy ACC under the new parameters new ;

[0043] S4: Determine probabilistically whether to accept the new parameters as the current optimal solution (i.e., replace the original model parameters with the new model parameters) according to the Metropolis criterion by comparing ACC now and ACC new ; The probabilistic calculation formula of the Metropolis criterion is as follows:

[0044]

[0045]

[0046] where f represents the current iteration number and T represents the current temperature.

[0047] S5: If it is decided to accept the new parameters as the current optimal solution, the iteration number is incremented by 1, and it is judged whether the current iteration number f reaches the initialized length L of the Markov chain mar ;

[0048] S6: If the current iteration number f reaches the initialized length L of the Markov chain mar , reset the iteration number f = 0, perform a temperature decay, and judge whether the current temperature T start ' reaches the initialized termination temperature T end , and if it reaches, end the simulated annealing algorithm;

[0049] The temperature decay calculation formula is as follows:

[0050] T start ' = T start ×R

[0051] S7: If the current temperature T start ' reaches the initialized termination temperature T end , then perform intrusion detection on the validation set through the XGBoost intrusion detection model corresponding to the new parameters;

[0052] The XGBoost intrusion detection model after optimizing the parameters using the simulated annealing algorithm performs an intrusion detection on the validation set data, and filters out the samples identified as attacks by the model.

[0053] XGBoost is a supervised model. Intrusion detection is a binary classification scenario, and the samples in the training set include two categories: malicious and benign. The aim is to train the XGBoost model using all the data in the training set. After the model is trained, for the validation set data, the model can automatically determine which are benign and which are malicious.

[0054] S8: Initialize the k value of K-means, and introduce all the malicious samples D in the training set t and the samples D identified as attacks by the XGBoost model from the validation set x into the K-means model;

[0055] Initialize the k value of the K-means model to 4 and introduce all the existing malicious samples D in the training set t (Only introduce malicious samples. The number of malicious samples is very small, so it will not increase the time overhead of training the K-means model) and the samples D identified as attacks by the XGBoost intrusion detection model x into the K-means model.

[0056] S9: Train the K-means model. Use the K-means model to perform clustering analysis on all the input data, recall the samples misjudged as malicious samples by the XGBoost intrusion detection model as benign samples, and record the recall number n now ;

[0057] Find the outlier samples in the validation set as benign recalls by observing the distribution characteristics of all the malicious samples in the training set. (That is, there is an intersection between class p and class q, that is, the same class. Screen out the classes in q that do not appear in p as benign samples)

[0058] Train the K-means model: All the malicious samples D in the training set t and the samples D identified as attacks by the XGBoost intrusion detection model from the validation set x are clustered into k classes K = {n1, n2, ···, n k}. Among them, D t contains p classes p = {n1, n2, ···, n p}, and D x contains q = {n1, n2, ···, n q}. From D xSelect the data with the category belonging to K-P from the screened data as the recalled benign samples (i.e., the samples that are actually benign but misidentified as attack samples by the XGBoost intrusion detection model). Record the number n of the recalled samples now . In this embodiment, k = 4, and the calculation method of k is as follows:

[0059]

[0060] S10: Gradually increase the k value of the K-means model, and repeat S9 to recall the number n of samples misidentified as attacks by the XGBoost intrusion detection model new , until n new > n now Then replace n now with n new and continue to execute S10 until the optimal k value is obtained;

[0061] On the contrary, exit the process of updating the k value and use the k value corresponding to n now as the optimal k value of the K-means model. The benign samples recalled by the optimal k value are the benign samples actually misjudged by XGBoost

[0062] S11: Calculate the k center points C of the K-means model i and the maximum distance D to the corresponding center points i ;

[0063] According to the K-means model corresponding to the optimal k value, calculate the k center points Ci of the K-means model and the maximum distance D to the corresponding center points i .

[0064] S12: Determine whether a new type of attack is detected. If a new type of attack is detected, return to S9

[0065] After the framework is deployed and goes online, in the face of new log data, first perform a preliminary detection through the XGBoost intrusion detection model. If the detection result is benign, the log is benign; otherwise, the K-means model will perform further screening. The specific method is as follows: First, calculate the distance d from the new log entry to the k center points of the K-means model i . If the distance is greater than the k historical maximum distances D i then jump to step S8 to automatically update and optimize the k value; otherwise, regard the category to which the nearest distance belongs as the log category category i . If the category category i belongs to P, the log will finally be determined as an attack behavior; otherwise, regard it as a benign behavior

[0066] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than limiting the protection scope of the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those of ordinary skill in the art should understand that the technical solutions of the present invention can be modified or equivalently replaced without departing from the essence and scope of the technical solutions of the present invention.

Claims

1. A network attack intrusion detection method based on an improved XGBoost and an adaptive optimized K-means model, characterized in that, Including: S1: Construct an XGBoost intrusion detection model based on a dataset; S2: Initialize the basic parameters of the XGBoost intrusion detection model and the basic parameters of the simulated annealing algorithm; S3: Calculate the corresponding intrusion detection accuracy ACC under the current XGBoost parameters based on the training set data of the XGBoost intrusion detection model now , randomly perturb the basic parameters of the XGBoost intrusion detection model in both positive and negative directions to generate new parameters, and calculate the corresponding classification accuracy ACC under the new parameters new ; S4: By comparing ACC now and ACC new then probabilistically decide whether to accept the new parameter as the current optimal solution according to the Metropolis criterion; S5: If it is decided to accept the new parameter as the current optimal solution, increment the iteration count by 1, and determine whether the current iteration count f has reached the initialized Markov chain length L mar ; S6: If the current iteration number f reaches the initialized length L of the Markov chain mar , then reset the iteration number f = 0, perform a temperature decay, and determine whether the current temperature T start ' has reached the initialized termination temperature T end . If it has reached, end the simulated annealing algorithm; S7: If the current temperature T start reaches the termination temperature T end of the initialization, the intrusion detection of the validation set is performed by the XGBoost intrusion detection model corresponding to the new parameters; S8: Initialize the k value of K-means, and include all malicious samples D in the training set t and samples D identified as attacks by the XGBoost model from the validation set x Introduce the K-means model; S9: Train the K-means model, use the K-means model to perform clustering analysis on all incoming data, recall the samples misjudged as malicious samples by the XGBoost intrusion detection model as benign samples, and record the recall number n now ; S10: Gradually increase the value of k in the K-means model, and repeat S9 to recall the number of samples n that are misidentified as attacks by the XGBoost intrusion detection model new , until D new > D now Then replace n now with D new And continue to execute S10 until the optimal K value is obtained; S11: Calculate the k center points C of the K-means model i and the maximum distance D to the corresponding center points i ; S12: Determine whether a new type of attack is detected. If a new type of attack is detected, return to S9.

2. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 1, characterized in that, In S2, the basic parameters of the XGBoost intrusion detection model include the learning rate, the depth of the tree, and the feature ratio; The basic parameters of the simulated annealing algorithm include the starting temperature T start and the termination temperature T end as well as the length L of the Markov chain mar and the temperature decay coefficient R.

3. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 1, characterized in that, In S4, the probabilistic calculation formula of the Metropolis criterion is as follows: where f represents the current iteration number and T represents the current temperature.

4. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 1, characterized in that, In S4, if it is decided not to accept the new parameter as the current optimal solution, the iteration number is increased by 1, and it is judged whether the iteration number reaches the length of the Markov chain. If it does not reach, return to S3.

5. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 1, wherein In S5, if the current iteration number f is less than the initialized Markov chain length L mar , then return to S4.

6. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 2, characterized in that, In S6, the temperature decay calculation formula is as follows: T start ' = T start × R If the current temperature T is greater than the initialized lowest temperature point, return to S4.

7. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 1, characterized in that, In S9, the incoming data is subjected to clustering analysis through the K-means model, and the samples are classified into k categories. The incoming data is all the known malicious samples from the training set and the samples identified as malicious by the XGBoost model from the validation set. The malicious samples from the training set and the samples identified as malicious by the XGBoost model from the validation set are divided into k categories, where the malicious samples from the training set contain p categories, and the samples from the validation set are divided into q categories, and the number of benign recalls n is recorded now 。 8. The network attack intrusion detection method based on the improved XGBoost and adaptive optimized K-means model according to claim 7, characterized in that, In S12, the framework is deployed and launched. For each log entry to be detected, it is first input into the XGBoost intrusion detection model for rough classification to determine whether the log belongs to an attack event. If it is determined to be a benign behavior, it is directly used as the determination result of the framework for this log; On the contrary, if the XGBoost intrusion detection model determines that this log is an attack behavior, this log is passed into the optimized K-means model for fine classification; First, calculate the distances from this log to the k center points, and use the category with the smallest distance as its classification result. Then compare whether the distance is greater than the historical maximum clustering. If it is greater than the historical maximum distance, trigger the K-means model to automatically update and optimize the k value; on the contrary, if it is less than the historical maximum distance, judge whether this category belongs to the attack category; if it does not belong, perform a benign recall to explain that it was misjudged as an attack event by the XGBoost intrusion detection model; if it belongs to the attack category, this log is finally determined by the framework to be an attack event.

Images