A Visual Capsule Network Intrusion Detection Method

Abstract

This invention discloses a visualization-based capsule network intrusion detection method, which involves a network intrusion detection approach comprising three steps: data processing, model training, and model classification. First, historical network security data is collected and preprocessed, then the entire dataset is normalized and scaled proportionally. Next, the sample data is visualized, transforming it from one-dimensional data into a two-dimensional matrix with spatial information, thus better suited to deep learning models. Collision features identified during visualization are selected using an information entropy-weighted averaging algorithm to construct new feature values ​​and improve network performance. A social network search algorithm is used to optimize the capsule network structure and determine the optimal parameters. Finally, network intrusion classification and detection are performed on the real-time collected network data. This invention improves the detection rate of network attacks and reduces the false positive rate.

Description

Technical Field

[0001] This invention relates to a network intrusion detection method, and more particularly to a network intrusion detection method based on a visualization capsule. Background Technology

[0002] The process of detecting attempted or ongoing network intrusions is called intrusion detection. It focuses on analyzing network traffic, detecting anomalies, and correctly identifying them. In recent years, major security incidents involving network intrusions have been increasing in various countries, causing greater impact and constantly threatening everyone's information security. By collecting and analyzing system traffic and protocol information in real time, intrusion detection systems can judge and classify various behaviors within the network.

[0003] With the development of deep learning, more and more deep learning technologies are being applied to the field of intrusion detection. Genetic algorithms are used to obtain the optimal initial weights, thresholds, and network structure parameters in convolutional networks, constructing intrusion detection models and achieving good results. Recurrent neural networks are also being applied to intrusion detection, performing binary and multi-class classification on network datasets, with promising results. While deep learning has powerful classification and information extraction capabilities, some information is inevitably lost during convolutional kernel pooling. However, for intrusion detection, every dimension of data is crucial. In 2017, the concept of Capsule Networks (CapsNet) was proposed. This network improves upon the insensitivity of traditional convolutional neural networks to target location and has been applied to intrusion detection. A variable fusion stochastic attention capsule network intrusion detection model is proposed. Using a stochastic attention mechanism, the model can better capture data features. A feature extraction module is built based on residual blocks in the capsule network, and a global average pooling layer is introduced to obtain high-quality data features, improving detection accuracy while implicitly extracting features. It exhibits stronger robustness to imbalanced data and is closer to the needs of intrusion detection technology in the industrial internet.

[0004] Capsule networks can extract high-quality features from industrial internet data, thereby creating better intrusion detection models. Visualization processing can increase the correlation between features in data samples. Traditional one-dimensional data is simply piled up, neglecting spatial information and increasing the detection rate and false positive rate of network attacks. Summary of the Invention

[0005] The purpose of this invention is to provide a visualization-based capsule network intrusion detection method. Inspired by capsule networks and data visualization, this method constructs a data visualization-based capsule network intrusion detection model, learns the data association characteristics of the industrial Internet, and improves the detection rate of industrial intrusion behavior.

[0006] The objective of this invention is achieved through the following technical solution:

[0007] A visualization-based capsule network intrusion detection method, the method comprising the following steps:

[0008] Step S1. Collect historical network security data and preprocess it: Numericalization: For character features in intrusion detection data, expand them into unit vectors through a one-hot operation to complete the numericalization; assuming that the feature has i feature values, set it to one of the corresponding values ​​in {0,1,...,i-1}; Normalization: scale the data proportionally and map it uniformly to the interval [-1,1].

[0009] Step S2. Perform improved visualization operations on the processed data to transform it from one-dimensional data into a two-dimensional matrix with spatial information, thereby making it more suitable for deep learning models;

[0010] Step S3. Improve the capsule network using the CBAM module; CBAM (Convolutional Block Attention Module) is a module for improving convolutional neural networks, which can be used to improve capsule networks; the CBAM module weights features through an attention mechanism, which can better utilize input features, thereby improving the performance of the capsule network;

[0011] Step S4. Apply the visualized intrusion detection data to the improved capsule network intrusion detection model;

[0012] Step S5. Use the capsule network model trained in step S4 to perform network intrusion classification and detection on the real-time collected network data.

[0013] The aforementioned visualization-based capsule network intrusion detection method includes intrusion modes such as denial-of-service intrusion, remote unauthorized access intrusion, unauthorized privilege escalation intrusion, and detection and scanning intrusion.

[0014] The visualization-based capsule network intrusion detection method, in step S1, specifically involves visualizing the data as follows:

[0015] In intrusion detection datasets, a certain parameter in most intrusion behavior data is abnormally high, resulting in too many and too large outliers. If maximum-minimum normalization is directly applied, these outliers with large extreme values ​​will cause the remaining data to become too concentrated, failing to reflect the relative magnitude of the values. Therefore, Normalization 2 is used to ensure the topological structure of the features.

[0016] X tr (j,:)←log(X tr(j,:)+|Min j +1)

[0017] Max = max(X) tr )

[0018] Where X tr For the training set, X jr (j,:) represents all data in the training set for the j-th feature, Min j represents the minimum value in the j-th feature, and Max is the maximum value among all data.

[0019] In the aforementioned visualization-based capsule network intrusion detection method, step S2 involves visualizing the data, specifically as follows:

[0020] Step S2-1. Determine T'; Transpose the data T to obtain T';

[0021] Step S2-2. Use t-SNE to reduce the dimensionality of the M*N data and visualize it to obtain an M*2 matrix; in this way, each feature Xi∈X1D is assigned to a two-dimensional point on the plane, with coordinates tsne(T')[i,1] and tsne(T')[i,2] respectively;

[0022] Step S2-3. Use the convex hull algorithm to find the smallest rectangle (minimum bounding box) containing all the two-dimensional points associated with the X1D features, and rotate it to a horizontal or vertical form; the rotated rectangle is represented by min(x), max(x), min(y), and max(y), which represent the minimum and maximum coordinates along the two-dimensional coordinate system x and y; the two-dimensional grid X2D is divided into an n×m pixel frame, with a pixel frame length max(x)-min(x) / n and a width max(y)-min(y) / m.

[0023] The advantages and effects of this invention are:

[0024] 1. This invention proposes a visualization-based intrusion detection method based on data preprocessing and visualization processing. Compared with traditional processing methods, visualization avoids the influence of useless spatial information generated by simple splicing, and improves the element collision handling in the visualization process to retain more feature information. Using an improved capsule network as the detection model, the classification effect is also better than that of ordinary convolutional models.

[0025] 2. In the method of this invention, the traditional one-dimensional intrusion detection data processing method is replaced with a visualization-based processing method. This avoids the influence of spatial information generated by simple data stacking on the classification results. Furthermore, the element collision resolution method is improved by using mutual information entropy as weights to perform a weighted average of collision information, preserving each feature's information. This processing method allows intrusion detection data to be better input into the deep learning model; it utilizes capsule networks as the detection model and employs a CBAM module to better extract spatial information, thereby achieving better classification results. Attached Figure Description

[0026] Figure 1 This is a schematic diagram of the CBAM module; this module can improve the network's performance by adding an attention mechanism.

[0027] Figure 2 This is a diagram of a capsule network structure incorporating a CBAM module, according to a specific embodiment of the present invention.

[0028] Figure 3 A diagram illustrating the visualization and transformation process of intrusion detection data;

[0029] Figure 4 This is a flowchart of a visual capsule network algorithm according to a specific embodiment of the present invention; compared with similar methods, this method has a higher detection rate and a lower false alarm rate, and has a certain learning and adaptive ability;

[0030] Figure 5 Line graph showing the test results of the capsule network before and after data transformation;

[0031] Figure 6 A pixel comparison chart before and after data visualization transformation;

[0032] Figure 7 A comparison of test results between capsule networks and other methods to improve performance. Detailed Implementation

[0033] The present invention will now be described in detail with reference to the embodiments shown in the accompanying drawings.

[0034] This invention relates to an intrusion detection method based on visualized capsule networks, comprising the following steps:

[0035] Step S1. Collect and preprocess network security data as training data for the intrusion detection model; the preprocessing specifically includes the following steps:

[0036] Step S1-1. Numericalization: For character-type features in intrusion detection data, numericalization is achieved by expanding them into unit vectors using a one-hot operation; assuming the feature has i feature values, they are set to one of the corresponding values ​​in {0,1,...,i-1}.

[0037] Step S1-2. Normalization: This invention uses normal form 2 normalization to ensure the topological structure of the features.

[0038] X tr (j,:)←log(X tr (j,:)+|Min j +1)

[0039] Max = max(X) tr )

[0040] Where X tr For the training set, X jr (j, :) represents all data in the training set for the j-th feature, Min j represents the minimum value in the j-th feature, and Max is the maximum value among all data.

[0041] Step S2. Perform improved visualization operations on the processed data, transforming it from one-dimensional data into a two-dimensional matrix with spatial information, thereby making it more suitable for deep learning models; specifically including the following steps:

[0042] Step S2-1. Transpose the training set data to obtain the transposed data matrix;

[0043] Step S2-2. Use the TSNE algorithm to perform dimensionality reduction visualization of the transposed data matrix;

[0044] Step S2-3. Use the convex hull algorithm to find the smallest rectangle (minimum bounding box) that contains all the two-dimensional points associated with the feature vector, and rotate it to a horizontal or vertical form.

[0045] Step S2-4. Process the colliding elements, using the mutual information entropy of the colliding elements as weights, and select the final weighted average as the new feature. The calculation method is as follows:

[0046]

[0047]

[0048] Where x represents the feature that caused the collision, info is the information entropy of the corresponding feature, and f is the weight of the feature's information entropy relative to the colliding elements. f is calculated using the formula, and new feature values ​​are constructed using f as the weights.

[0049] Step S3. Improve the capsule network using the CBAM module; CBAM (Convolutional Block Attention Module) is a module for improving convolutional neural networks, which can be used to improve capsule networks. Its structure is as follows: Figure 1 As shown.

[0050] The CBAM module weights features through an attention mechanism, which can better utilize input features and thus improve the performance of capsule networks. The calculation methods for the channel attention module and the spatial attention module are as follows:

[0051]

[0052]

[0053] In the formula, F represents the feature matrix, σ represents the sigmoid function, and W0 and W1 represent the weights of the multilayer perceptron. F′ represents the feature matrix from which channel information has been extracted, f 7×7 This indicates a feature operation with a convolution kernel size of 7*7.

[0054] A lightweight attention module—CBAM—is added to the convolutional layers of the capsule network. This module extracts features from both the data space and channel dimensions before the data undergoes convolution, better preserving important information and thus improving the information extraction rate. The capsule network structure incorporating the CBAM module is as follows: Figure 2 As shown.

[0055] Step S4. Apply the visualized intrusion detection data to the improved capsule network intrusion detection model;

[0056] Step S5. Use the capsule network model trained in step S4 to perform network intrusion classification and detection on the real-time collected network data.

[0057] Step S6. Design a network intrusion detection software module based on the neural network intrusion detection model, deploy the network intrusion detection software module in the network environment to monitor network data traffic in real time, and generate alarms for detected abnormal network traffic; the network intrusion detection software module specifically includes the following modules:

[0058] (1) The attack warning module is the first layer of the network intrusion detection software. It monitors the changes in the request flow in real time. When the request flow reaches a certain threshold, it forwards the traffic to the traffic preprocessing module for preliminary processing.

[0059] (2) The traffic preprocessing module collects the received network traffic data packets, performs data preprocessing on the data packets, and sends them to the neural network intrusion detection module;

[0060] (3) The neural network intrusion detection module receives the data packets forwarded by the traffic preprocessing module, and the neural network intrusion detection model detects the data packets;

[0061] (4) The attack response module receives the detection results from the neural network intrusion detection module and generates corresponding alarm information for data with abnormal detection results.

[0062] Step S1. Collect historical network security data and preprocess it: Numericalization: For character features in intrusion detection data, expand them into unit vectors through a one-hot operation to complete the numericalization; assuming that the feature has i feature values, set it to one of the corresponding values ​​in {0,1,...,i-1}; Normalization: scale the data proportionally and map it uniformly to the interval [-1,1].

[0063] Step S2. Perform improved visualization operations on the processed data to transform it from one-dimensional data into a two-dimensional matrix with spatial information, thereby making it more suitable for deep learning models;

[0064] Step S3. Improve the capsule network using the CBAM module; CBAM (Convolutional Block Attention Module) is a module for improving convolutional neural networks, which can be used to improve capsule networks. The CBAM module weights features through an attention mechanism, which can better utilize input features, thereby improving the performance of the capsule network.

[0065] Step S4. Apply the visualized intrusion detection data to the improved capsule network intrusion detection model;

[0066] Step S5. Use the capsule network model trained in step S4 to perform network intrusion classification and detection on the real-time collected network data.

[0067] Intrusion modes include denial-of-service intrusion, remote unauthorized access intrusion, unauthorized privilege escalation intrusion, and probe and scan intrusion.

[0068] In step S1, the data visualization process specifically involves:

[0069] In intrusion detection datasets, a certain parameter in most intrusion behavior data is abnormally high, resulting in too many and too large outliers. If maximum-minimum normalization is directly applied, these outliers with large extreme values ​​will cause the remaining data to become overly concentrated, failing to reflect the relative magnitude of the values. This invention uses a paradigm 2 normalization operation to ensure the topological structure of the features:

[0070] X tr (j,:)←log(Xtr (j,:)+|Min j +1)

[0071] Max = max(X) tr )

[0072] Where X tr For the training set, X jr (j, :) represents all data in the training set for the j-th feature, Min j represents the minimum value in the j-th feature, and Max is the maximum value among all data.

[0073] In step S2, the data visualization process specifically involves:

[0074] Step S2-1. Determine T'. Transpose the data T to obtain T'.

[0075] Step S2-2. Use t-SNE to reduce the dimensionality of the M*N data and visualize it to obtain an M*2 matrix. In this way, we assign each feature Xi∈X1D to a two-dimensional point on the plane, with coordinates tsne(T')[i,1] and tsne(T')[i,2].

[0076] Step S2-3. Use the convex hull algorithm to find the minimum rectangle (minimum bounding box) containing all 2D points associated with the X1D features, and rotate it to a horizontal or vertical form. The rotated rectangle can be represented by min(x), max(x), min(y), and max(y), which represent the minimum and maximum coordinates along the x and y coordinates of the 2D coordinate system. It is divided into a 2D X2D grid of n×m pixel frames, with a pixel frame length of max(x) - min(x) / n and a width of max(y) - min(y) / m.

[0077] In the above operations, when falling within the same pixel frame, the positions of various X1D features may collide. This method addresses intra-pixel collisions by constructing a new feature for each set of colliding features. The method uses the mutual information entropy of the colliding elements as weights and selects the final weighted average as the new feature.

[0078] Table 1. Meaning of Symbols

[0079]

[0080]

[0081] This invention visualizes intrusion detection data, enabling one-dimensional data to meet the input requirements of deep learning models while incorporating spatial information between features. It also improves upon traditional element collision resolution methods, thereby enhancing data utilization.

[0082] In capsule networks, a group of neurons is wrapped together to form a vector that replaces the individual neurons in the neural network. Each neuron represents various attributes of the extracted features. The magnitude of the vector represents the probability of the feature represented by the capsule. Finally, each capsule outputs to the category capsule layer through dynamic routing. This invention inserts a CBAM module into the convolutional layer of the capsule network to improve its feature extraction capability. The CBAM module first performs average pooling and max pooling on the features, and then weights the features through a fully connected layer to obtain the final attention features. Finally, the original features and the attention features are added together to obtain the final features. By using the CBAM module, the capsule network can better utilize the input features and improve its ability to understand image content. Therefore, using the CBAM module can effectively improve the performance of capsule networks.

[0083] The present invention's approach to intrusion detection based on visualization capsule networks is as follows: numericalization and normalization of sample attributes; visualization processing of sample data; reconstruction of collision features; pre-training of model parameters; and training and prediction of the model.

[0084] Based on data visualization, this method, taking the Industrial Internet as its object, proposes the following: Figure 4 The intrusion detection system shown.

[0085] This model improves the detection rate of intrusion behavior by reconstructing industrial internet traffic data, visualizing data samples, enhancing the correlation of data in two-dimensional samples, and improving the shallow convolutional layers of the capsule network using the CBAM module. It includes the following modules:

[0086] (1) Data processing module: The network traffic data is preprocessed and normalized. The transpose matrix is ​​visualized to obtain the feature distribution. The data samples are reconstructed based on the feature distribution and the samples are converted into 3D matrices acceptable for deep learning.

[0087] (2) Training module: Input image samples, extract features through the CBAM module and feed them into the capsule network model. Select parameters for the capsule network using the Optune framework.

[0088] (3) Classification module: Use the trained model to predict the data samples, output the classification results, construct the confusion matrix based on the label values, and output the classification report.

[0089] The UNSW-NB15 dataset, released by the Australian Cyber ​​Security Centre in 2015, is more recent than the KDD99 and NSL-KDD datasets and covers more attack types. The CIC-IDS2017 dataset comes from network data collected by the Canadian Cyber ​​Security Institute over five days, with the first day consisting entirely of normal traffic and the remaining days showing various attack behaviors. To compare the predictive capabilities of different models, each model was trained and subjected to classification tests. This method uses three machine learning models—KNN, Random Forest, and GBDT—and two deep learning models—CNN and RNN—for comparison. Machine learning excels at extracting information from one-dimensional features, CNN excels at extracting spatial features, and RNN excels at extracting temporal features. The experimental results are shown in the table. The proposed model achieved the highest accuracy and the lowest false negative rate. The proposed model also achieved the highest F1 score of 91.83%, indicating that it has the best classification ability.

[0090] Table 2 UNSW-NB15 Classification Results

[0091]

[0092] Table 3. IDS-2017 Data Details

[0093]

[0094] In the multi-class classification experiment, the same model was used for comparative training. The accuracy rates are shown in the table below:

[0095] Table 4. Multiclassification Results of UNSW-NB15

[0096]

[0097] Although the present invention has been described in detail through the preferred embodiments above, it should be understood that the above description should not be considered as a limitation of the present invention. Various modifications and substitutions to the present invention will be apparent to those skilled in the art after reading the above description. Therefore, the scope of protection of the present invention should be defined by the appended claims.

Claims

1. A visualization-based capsule network intrusion detection method, characterized in that, The method includes the following steps: Step S1. Collect historical network security data and preprocess it: Numericalization: For character features in intrusion detection data, expand them into unit vectors through one-hot encoding to complete numericalization; assuming that the feature has i feature values, set them to one of the corresponding values ​​in {0,1,...,i-1}; Normalization: scale the data proportionally and map it uniformly to the range [-1,1]. Step S2. Perform improved visualization operations on the processed data, transforming it from one-dimensional data into a two-dimensional matrix with spatial information, thereby making it more suitable for deep learning models; specifically including the following steps: Step S2-1. Transpose the training set data to obtain the transposed data matrix; Step S2-2. Use the t-distributed random neighborhood embedding (tsne) algorithm to perform dimensionality reduction visualization of the transposed data matrix; Step S2-3. Use the convex hull algorithm to find the smallest rectangle containing all the two-dimensional points associated with the feature vector, and rotate it to a horizontal or vertical form; Step S2-4. Process the colliding elements, using the mutual information entropy of the colliding elements as weights, and select the final weighted average as the new feature. The calculation method is as follows: ; in To generate collision characteristics, The information entropy of the corresponding feature, The information entropy of the feature is the weight of the colliding element; it is calculated using the formula. and with Construct new eigenvalues ​​for the weights; Step S3. Improve the capsule network using the Convolutional Block Attention (CBAM) module; CBAM is an improved convolutional neural network module used to improve the capsule network; the CBAM module weights features through an attention mechanism, making better use of input features, thereby improving the performance of the capsule network; Step S4. Apply the visualized intrusion detection data to the improved capsule network intrusion detection model; Step S5. Use the capsule network model trained in step S4 to perform network intrusion classification and detection on the real-time collected network data.

2. The visualization-based capsule network intrusion detection method according to claim 1, characterized in that, The intrusion modes include denial-of-service intrusion, remote unauthorized access intrusion, unauthorized privilege escalation intrusion, and detection and scanning intrusion.

3. The visualization-based capsule network intrusion detection method according to claim 1, characterized in that, In step S2, the data visualization process specifically involves: In intrusion detection datasets, a certain parameter in most intrusion behavior data is abnormally high, resulting in too many and too large outliers. If maximum and minimum value normalization is performed directly, these outliers with very large extreme values ​​will cause the remaining data to be too concentrated, failing to reflect the relative magnitude of the values. Therefore, the normalization operation of equation (2) is used to ensure the topological structure of the features: （2）； in For the training set, This represents the first training set. All data for the dimensional features, Representing the Minimum value in dimensional features It represents the maximum value among all the data.

Images