A network intrusion detection method based on MMFSA and DSCA-BiLSTM

Abstract

The present invention relates to a network intrusion detection method based on MMFSA and DSCA-BiLSTM, comprising the following steps: S1, constructing an original data set and preprocessing the original data set; S2, processing the preprocessed data set based on a multi-metric feature selection algorithm to generate a feature subset; S3, inputting the original data set into a DSCA-BiLSTM network model to perform implicit feature capture and bidirectional time series modeling to obtain a classification model; S4, capturing the network traffic of a terminal device and preprocessing the network traffic; S5, using the feature subset generated in step S2, performing data dimensionality reduction on the network traffic preprocessed in step S4, and the traffic data after dimensionality reduction enters the classification model for anomaly detection. Compared with the prior art, the present invention has higher accuracy and detection rate, and better false alarm rate.

Description

Technical Field

[0001] The present invention relates to the field of computer network security, and in particular to a network intrusion detection method based on MMFSA and DSCA-BiLSTM. Background Art

[0002] 5G networks and the Internet of Things (IoT), key business drivers of future networks, offer higher data rates and throughput than traditional networks. Wireless communication technologies simultaneously provide excellent connectivity and convenience. While wireless networks offer convenience, their ease of access also presents more opportunities for attackers, placing higher demands on intrusion detection efficiency and low latency. In addition to classic attacks such as denial of service (DDOS), injection attacks, and flooding attacks, wireless networks are also facing a growing number of new attacks, such as the key reinstallation attack (KRACK) discovered in WPA2 and native attacks residing at the link layer of the OSI protocol stack.

[0003] Existing intrusion detection systems are primarily categorized as anomaly intrusion detection and misuse intrusion detection. Misuse intrusion detection systems detect attacks by matching traffic with predefined attack behaviors. While this detection method offers high precision, it is less effective for detecting new types of attacks. Anomaly intrusion detection improves detection of new types of attacks, but suffers from a higher false positive rate compared to misuse intrusion detection. Furthermore, feature selection techniques are an effective means of data dimensionality reduction, providing a higher-quality data source for anomaly intrusion detection systems.

[0004] Finally, most feature selection algorithms in existing intrusion detection systems use a single metric, and the thresholds are often manually set, which can easily lead to the loss of important features. Therefore, it is necessary to design an intrusion detection method that can solve the above problems. Summary of the Invention

[0005] The purpose of the present invention is to overcome the defects of the above-mentioned prior art and provide a network intrusion detection method based on MMFSA and DSCA-BiLSTM.

[0006] The purpose of the present invention can be achieved by the following technical solutions:

[0007] A network intrusion detection method based on MMFSA and DSCA-BiLSTM includes the following steps:

[0008] S1. Constructing an original data set and preprocessing the original data set;

[0009] S2, based on the multi-metric feature selection algorithm, the preprocessed data set is processed to generate feature subsets;

[0010] S3. Inputting the original data set into the DSCA-BiLSTM network model to perform implicit feature capture and bidirectional time series modeling to obtain a classification model;

[0011] S4. Capturing network traffic of the terminal device and preprocessing the network traffic;

[0012] S5. Using the feature subset generated in step S2, perform data dimensionality reduction on the network traffic preprocessed in step S4, and the traffic data after dimensionality reduction enters the classification model for anomaly detection.

[0013] Furthermore, in step S1, preprocessing the original data set includes the following steps:

[0014] Delete attributes in the original dataset whose null value ratio is greater than the preset threshold;

[0015] Use zero values ​​to fill missing values ​​in the original dataset to obtain a dataset without null values;

[0016] Convert character type attributes to numeric type attributes and remove attributes that cannot be converted;

[0017] Normalize the data;

[0018] The label attributes are hard-coded and one-hot encoded and used to train the model.

[0019] Furthermore, the calculation formula for normalizing the data is:

[0020]

[0021] Where x i is the sample attribute value, min(x i ) is the maximum value of the sample attribute, max(x i ) is the minimum value of the sample attribute.

[0022] Furthermore, step S2 includes the following sub-steps:

[0023] Determining a base algorithm of the multi-metric feature selection algorithm;

[0024] Using different base algorithms to perform feature removal on the preprocessed data set;

[0025] The n feature subsets obtained after feature screening using n base algorithms are combined to obtain the final feature subset.

[0026] Furthermore, using different base algorithms to perform feature removal on the preprocessed data set includes the following steps:

[0027] Use the base algorithm to obtain the importance score of the preprocessed data set and sort it;

[0028] The mean importance score of the features is calculated, and features with a value less than the mean are removed, thereby reducing the dimensionality of the dataset.

[0029] Furthermore, in step S2, the base algorithms of the multi-metric feature selection algorithm include information gain rate, chi-square test and ReliefF algorithm.

[0030] Furthermore, in step S4, the DSCA-BiLSTM network model includes a deep separable convolutional neural network module, a key feature enhancement module, a bidirectional long short-term memory network module and a detection and classification module;

[0031] The depthwise separable convolutional neural network module is used to capture the spatial features of traffic data;

[0032] The key feature enhancement module introduces an attention mechanism to calculate the attention distribution of the hidden state of the traffic and enhance the key features of the traffic through the weighted average of the hidden state;

[0033] The bidirectional long short-term memory network module is used to perform bidirectional sequence modeling on the hidden state of the traffic to capture the temporal characteristics of the traffic;

[0034] The detection and classification module is used to detect and classify the output data of the bidirectional long short-term memory network module through a fully connected layer.

[0035] Furthermore, in the key feature enhancement module, the calculation formula of the attention weight is:

[0036]

[0037] The calculation formula of the score function is:

[0038]

[0039] Where h t-1 is the historical hidden state, h t is the current target hidden state, is the candidate hidden state, W a is the implicit parameter matrix, is the attention value matrix.

[0040] Furthermore, the bidirectional long short-term memory network module prevents model overfitting through a dropout layer and obtains the final multi-classification result through a softmax layer.

[0041] Furthermore, the output layer of the detection and classification module normalizes k real numbers into k probability distributions through the softmax function, whose values ​​are all between (0,1) and the sum is 1; for (z1,z2,z3…z k )∈R k , the calculation formula of the softmax function is:

[0042]

[0043] The calculation formula for the predicted category is as follows:

[0044]

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] 1. The intrusion detection method based on MMFSA and DSCA-BiLSTM involved in the present invention adopts a multi-metric feature selection algorithm to screen features according to different metrics, without setting thresholds in advance, and can effectively reduce model parameters.

[0047] 2. This invention uses DSCA-BiLSTM for bidirectional time series modeling, capturing implicit features in the data and improving the model's detection accuracy. It achieves good detection results on public wireless network and internet datasets. Therefore, this invention is well-designed and effective for feature filtering of high-dimensional wireless traffic data and intrusion detection in foggy environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 It is the overall system framework diagram of the present invention;

[0049] Figure 2 1 is a flow chart of data preprocessing of an intrusion detection system based on MMFSA and DSCA-BiLSTM in an embodiment of the present invention;

[0050] Figure 3 1 is a summary diagram of the intrusion detection feature selection algorithm based on MMFSA and DSCA-BiLSTM in an embodiment of the present invention;

[0051] Figure 4 1 is a schematic diagram of a multi-metric feature selection algorithm (MMFSA) in an embodiment of the present invention;

[0052] Figure 5 is a structural diagram of a depthwise separable convolutional network in an embodiment of the present invention;

[0053] Figure 6 This is a diagram of the overall architecture of an intrusion detection system based on MMFSA and DSCA-BiLSTM in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The present invention is described in detail below with reference to the accompanying drawings and specific embodiments. This embodiment is implemented based on the technical solution of the present invention, and provides a detailed implementation method and specific operation process, but the protection scope of the present invention is not limited to the following embodiments.

[0055] To overcome the shortcomings of existing technologies while meeting the lightweight requirements of intrusion detection models, this paper uses a deep separable convolutional neural network with an attention mechanism to further accelerate model training. This is combined with a bidirectional long short-term memory (BiLSTM) network to capture traffic time series characteristics using bidirectional time series modeling.

[0056] Specifically, the present invention provides a network intrusion detection method based on multi-measure feature selection algorithm (MMFSA) and DSCA-BiLSTM (Bi-directional Long Short-Term Memory).

[0057] like Figure 1 As shown, the present invention includes the following steps:

[0058] Step 1: The original data set is converted into a format suitable for analysis through data preprocessing, and the processed data set is used in the subsequent feature selection algorithm to generate the final feature subset;

[0059] Step 2: Use the proposed multi-metric feature selection algorithm to sort the feature importance of the preprocessed training set to generate a feature subset, and perform dimensionality reduction on the dataset processed in step 1 to obtain a reduced dataset;

[0060] Step 3: Input the original dataset into the DSCA-BiLSTM network model for implicit feature capture and bidirectional time series modeling to obtain the final classification model;

[0061] Step 4: convert the network traffic captured by the terminal device into a format suitable for analysis through data preprocessing;

[0062] Step 5: Use the feature subset generated by the feature selection algorithm to reduce the data dimension of the traffic processed in step 4. The traffic data after dimension reduction is fed into the classification model for anomaly detection.

[0063] like Figure 2 As shown, in this embodiment, in step 1 and step 4, the preprocessing is to process the data into a format suitable for model processing, which mainly includes the following steps:

[0064] Step a: Delete attributes whose null value ratio is greater than a preset threshold. In this embodiment, columns with null value ratios greater than 50% in the original dataset are deleted, and rows with null values ​​are retained because some attributes are missing for some minority attacks.

[0065] Step b, fill missing values ​​with zero values ​​to obtain a data set without null values;

[0066] Step c: convert character type attributes into numeric type attributes, and remove attributes that cannot be converted;

[0067] Step d: Normalize the data. The target formula is as follows:

[0068]

[0069] where x i is the sample attribute value, min(x i ) is the maximum value of the sample attribute, max(x i ) is the minimum value of the sample attribute. The normalized data is scaled to the interval [0,1] to speed up the convergence of the model;

[0070] In step e, hard-code and one-hot-encode the label attributes and use them to train the model.

[0071] In this embodiment, step S2 includes the following sub-steps:

[0072] Determine the base algorithm of the multi-metric feature selection algorithm;

[0073] Use different base algorithms to perform feature removal on the preprocessed data set;

[0074] The n feature subsets obtained after feature screening using n base algorithms are combined to obtain the final feature subset.

[0075] In this embodiment, the information gain rate (GR), chi-square test (CS), and ReliefF (RfF) algorithm are selected as the base algorithms in the MMFSA in step 2, and the features with importance scores greater than the threshold are taken as the union to obtain the final feature subset.

[0076] Figure 3 The existing feature selection algorithm classification is introduced in detail, and the existing filtering feature selection algorithms are divided into three metrics based on the principle:

[0077] Existing feature selection algorithms mainly fall into three categories: filtering, wrapper, and embedded. Filtering feature selection algorithms score features based on divergence and relevance, using heuristic methods to assess the quality or robustness of the resulting feature subset. Filtering algorithms first perform feature selection, then obtain reduced-dimensional data to train subsequent models. The feature selection process is independent of model training. Wrapper feature selection algorithms employ black-box and statistical validation methods to avoid overfitting and use the performance of the final learner as the evaluation criterion for feature subsets. Feature subsets are generated primarily through full search, heuristic search, and random search.

[0078] Based on the basic principles of filtering feature selection, it can be divided into three categories: entropy-based algorithms, statistics-based algorithms, and instance-based algorithms. Entropy-based algorithms mainly focus on using a feature to estimate the difference between prior and posterior expected uncertainty. Information gain represents the degree to which information uncertainty is reduced under a condition. The information gain formula is shown in (2), where D is the dataset and v is the possible value of attribute a.

[0079]

[0080] The information gain rate is used as a compensation measure to solve the problem of information gain having a large number of preference values. Its formula is shown in (3).

[0081]

[0082] The calculation of the intrinsic value IV(a) is similar to that of information entropy, as shown in formula (4).

[0083]

[0084] Feature selection algorithms based on statistical metrics mainly include chi-square test, T test and Pearson correlation coefficient. Chi-square test is a hypothesis test. This method belongs to non-parametric test, which can compare the correlation analysis of two categorical variables. The chi-square test calculation formula is shown in formula 5, where x i is the actual value, T is the theoretical value, x 2 Represents the value of the chi-square test.

[0085]

[0086] In terms of feature selection algorithms based on instance metrics, the Reilef and ReliefF algorithms assign different weights to features according to the relevance between features and categories, and sort them according to the weights to remove low-weight features to achieve feature selection. The formula is shown in Equation 6:

[0087]

[0088] Among them, diff(a, r1, r2) represents the difference between sample r1 and sample r2 on feature a, and its calculation formula is shown in Formula 7. j (C) represents the jth nearest neighbor sample in class C.

[0089]

[0090] like Figure 4 As shown, the specific implementation of step 2 in this embodiment is:

[0091] In step a, the information gain ratio (GR) was selected from the entropy-based algorithm, the chi-square test (CS) was selected from the statistical metric-based algorithm, and the ReliefF (RfF) was selected from the instance-based algorithm;

[0092] Step b: Use different base algorithms to obtain the importance scores of features for the original data set and sort them in descending order;

[0093] Step c: calculate the mean importance score and remove features with a value less than the mean;

[0094] In step d, the three feature subsets are combined to obtain the final feature subset.

[0095] This algorithm effectively avoids the problem of losing important features caused by using a single metric, and the algorithm is based on different metrics, avoiding the algorithm redundancy problem caused by blindly combining too many algorithms.

[0096] In this embodiment, step 5 performs data dimensionality reduction based on the feature subset obtained in step 2.

[0097] like Figure 5 As shown in Figure 8, the number of channels of the convolution kernel of the traditional convolutional neural network is the same as the number of input channels of the convolution layer. The number of parameters of the convolution layer is calculated as shown in Formula 8:

[0098] W i ×H i ×d i ×d j (8)

[0099] Where W i , H i are the width and height of the convolution kernel, d i is the number of input channels, d j is the number of output channels

[38] . According to the convolution principle, the lower the dimension of the convolution kernel, the smaller the computational complexity of the convolution layer and the faster the computational speed. However, low-dimensional convolution kernels are difficult to extract sufficient information, so it is necessary to use high-dimensional convolution kernels for feature extraction while avoiding high computational costs.

[0100] Depthwise separable convolution mainly consists of two parts: channel-by-channel convolution and point-by-point convolution. In channel-by-channel convolution, the convolution kernel performs independent convolution on each input channel, thereby generating feature maps with the same number of input channels. Its parameter calculation method is shown in Equation 9:

[0101] W i ×H i ×d i (9)

[0102] Compared to standard convolution, the number of convolution kernel parameters is reduced by a multiple of the output channels, thus significantly reducing computational complexity. However, channel-by-channel convolution does not utilize the feature information of different channels at the same position, so point-by-point convolution is required to capture the information of different channels and obtain higher-dimensional feature maps. The convolution kernel size of point-by-point convolution is 1×1×d i , where d i is the input channel dimension. In order to obtain the same output dimension as the standard convolution, the number of output channels is set to d j , the number of parameters of point-by-point convolution is 1×1×d i ×d j , the total parameters of depth-wise separable convolution are shown in Equation 10:

[0103] Wi×Hi×di+di×dj (10)

[0104] It can be seen that for the same convolution dimension, depthwise separable convolution has fewer parameters and lower computational cost.

[0105] like Figure 6 As shown, the present invention introduces the specific details of the DSCA-BiLSTM network structure in detail.

[0106] In this embodiment, for step 3, a deep separable convolutional neural network with an attention mechanism is used to further accelerate model training. This is combined with a bidirectional long short-term memory (BiLSTM) network to capture traffic time series features using bidirectional time series modeling.

[0107] The DSCA-BiLSTM network proposed in this paper for detecting abnormal traffic in wireless networks consists of four main modules. The first module is a deep separable convolutional neural network module. This module replaces standard convolution with separable convolution with fewer parameters to capture the spatial characteristics of traffic data, meet the requirements of a lightweight model, and reduce the model's computational burden.

[0108] The second part is the key feature enhancement module, which introduces the attention mechanism to calculate the attention distribution of the hidden state of the traffic and enhances the key features of the traffic through the weighted average of the hidden state. The attention weight calculation method is shown in formula 10, where h t-1 , h tare the historical hidden state and the current target hidden state respectively, where the score function is calculated as shown in Formula 11.

[0109]

[0110]

[0111] The third module is a bidirectional long short-term memory network module. It uses BiLSTM (Bi-directional Long Short-Term Memory) to perform bidirectional sequence modeling on the hidden state output by the previous module to capture the temporal characteristics of the traffic. It also uses a dropout layer to prevent overfitting of the model, and finally uses softmax to obtain the final multi-classification result.

[0112] The fourth module is the detection and classification module, which detects and classifies the data output by the third module through the fully connected layer. The output layer normalizes k real numbers into k probability distributions through the softmax function, whose values ​​are all between (0,1) and the sum is 1. For (z1,z2,z3…z k )∈R k ,The calculation formula of the softmax function is shown in Equation 12, and the calculation formula of the predicted category is shown in Equation 13.

[0113]

[0114]

[0115] Comparing the method of this embodiment with the existing method, it can be seen that the accuracy, detection rate and false alarm rate of the method of this embodiment are all better.

[0116] In summary, the intrusion detection method based on MMFSA and DSCA-BiLSTM, as described in this invention, employs a filtering feature selection algorithm based on different metrics. This algorithm automatically extracts features without predefined thresholds and effectively preserves key traffic characteristics. It also employs a DSCA-BiLSTM network to extract implicit traffic features and perform bidirectional time series modeling to detect abnormal traffic.

[0117] The above describes in detail the preferred embodiments of the present invention. It should be understood that those skilled in the art can make numerous modifications and variations based on the concepts of the present invention without inventive effort. Therefore, any technical solutions that can be derived by those skilled in the art through logical analysis, reasoning, or limited experimentation based on the concepts of the present invention and the prior art should be within the scope of protection defined by the claims.

Claims

1. A network intrusion detection method based on MMFSA and DSCA-BiLSTM, characterized in that: The following steps are involved: S1. Constructing an original data set and preprocessing the original data set; S2, based on the multi-metric feature selection algorithm, the preprocessed data set is processed to generate feature subsets; Step S2 includes the following sub-steps: Determining a base algorithm of the multi-metric feature selection algorithm; Using different base algorithms to perform feature removal on the preprocessed data set; Will adopt n The obtained n Take the union of feature subsets to obtain the final feature subset; The process of using different base algorithms to perform feature removal on the preprocessed data set includes the following steps: Use the base algorithm to obtain the importance score of the preprocessed data set and sort it; Calculate the mean importance score of the features and remove features with a value less than the mean, thereby reducing the dimensionality of the dataset; S3. Inputting the original data set into the DSCA-BiLSTM network model to perform implicit feature capture and bidirectional time series modeling to obtain a classification model; S4. Capturing network traffic of the terminal device and preprocessing the network traffic; S5. Using the feature subset generated in step S2, perform data dimensionality reduction on the network traffic preprocessed in step S4, and the traffic data after dimensionality reduction enters the classification model for anomaly detection.

2. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 1, characterized in that: In step S1, preprocessing the original data set includes the following steps: Delete attributes in the original dataset whose null value ratio is greater than the preset threshold; Use zero values ​​to fill missing values ​​in the original dataset to obtain a dataset without null values; Convert character type attributes to numeric type attributes and remove attributes that cannot be converted; Normalize the data; The label attributes are hard-coded and one-hot encoded and used to train the model.

3. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 2, characterized in that: The calculation formula for normalizing the data is: Where, is the sample attribute value, is the minimum value of the sample attribute, is the maximum value of the sample attribute.

4. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 1, characterized in that: In step S2, the base algorithms of the multi-metric feature selection algorithm include information gain rate, chi-square test and ReliefF algorithm.

5. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 1, characterized in that: In step S4, the DSCA-BiLSTM network model includes a deep separable convolutional neural network module, a key feature enhancement module, a bidirectional long short-term memory network module and a detection and classification module; The depthwise separable convolutional neural network module is used to capture the spatial features of traffic data; The key feature enhancement module introduces an attention mechanism to calculate the attention distribution of the hidden state of the traffic and enhance the key features of the traffic through the weighted average of the hidden state; The bidirectional long short-term memory network module is used to perform bidirectional sequence modeling on the hidden state of the traffic to capture the temporal characteristics of the traffic; The detection and classification module is used to detect and classify the output data of the bidirectional long short-term memory network module through a fully connected layer.

6. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 5, characterized in that: In the key feature enhancement module, the calculation formula of attention weight is: The calculation formula of the score function is: Where, For historical hidden state, is the current target hidden state, is a candidate hidden state, is the implicit parameter matrix, is the attention value matrix.

7. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 5, characterized in that: The bidirectional long short-term memory network module uses a dropout layer to prevent the model from overfitting and obtains the final multi-classification result through a softmax layer.

8. A network intrusion detection method based on MMFSA and DSCA-BiLSTM according to claim 5, characterized in that: The output layer of the detection and classification module is converted into real numbers are normalized into probability distributions whose values ​​are between (0,1) and sum to 1; , the calculation formula of the softmax function is: The calculation formula for the predicted category is as follows: 。

Images