Feature rule extraction method and device, network intrusion detection method and device

Abstract

The embodiment of the application provides a feature rule extraction method and device, a network intrusion detection method and device, and belongs to the technical field of network security. The method comprises the following steps: obtaining an intrusion detection sample; expanding feature data in the sample to obtain expanded feature data; selecting a candidate feature data set according to the importance degree of label data and the association relationship between the expanded feature data; performing clustering processing on the plurality of candidate feature data sets to obtain a plurality of clustering centers; calculating a center offset value of the candidate feature data; determining target feature data in the candidate feature data set according to the center offset value; and obtaining a feature expansion rule corresponding to the target feature data as a target feature expansion rule. The method can extract the feature expansion rule most suitable for the intrusion detection model, thereby improving the quality of the features extracted from the network data packet, and further improving the accuracy of network intrusion detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a feature rule extraction method and device and a network intrusion detection method and device. BACKGROUND

[0002] At present, with the continuous development of Internet technology, people's production and life are more and more closely related to the Internet, which makes network security problems increasingly serious. Network intrusion detection technology is a technology that detects whether there is a break-in or break-in attempt to the system by operating on network behavior, security logs, audit data or other information available on the network. As an active security protection technology, network intrusion detection technology greatly improves network security through multi-level defense of network subjects.

[0003] The detection methods commonly involved in network intrusion detection technology include expert system-based intrusion detection methods and neural network-based intrusion detection methods. Among them, the neural network-based intrusion detection method can effectively improve the detection efficiency and accuracy of network intrusion detection by using artificial intelligence (AI) technology to extract and detect features of intrusion detection data.

[0004] However, in some cases, there is a problem of low quality of extracted features in the feature extraction process of intrusion detection data, which further leads to low accuracy of neural network-based network intrusion detection. SUMMARY

[0005] The main purpose of the embodiments of the present application is to propose a feature rule extraction method and device and a network intrusion detection method and device, aiming to improve the quality of features obtained by extracting features from intrusion detection data, and further improve the accuracy of network intrusion detection.

[0006] To achieve the above purpose, a first aspect of the embodiments of the present application proposes a feature rule extraction method, which comprises:

[0007] Obtain a plurality of intrusion detection samples, wherein the intrusion detection samples comprise intrusion detection data and label data, and the intrusion detection data comprises a plurality of feature data;

[0008] Perform feature expansion on the plurality of feature data according to a plurality of feature expansion rules to obtain a plurality of expanded feature data;

[0009] According to the importance degree of the expanded feature data to the label data and the association relationship between the expanded feature data, select a plurality of candidate feature data from the plurality of expanded feature data to obtain a candidate feature data set corresponding to the intrusion detection sample.

[0010] perform clustering processing on the plurality of candidate feature data sets corresponding to the plurality of intrusion detection samples to obtain a plurality of clustering centers;

[0011] calculate a center offset value of the candidate feature data in the candidate feature data set, the center offset value being positively correlated with an offset distance, the offset distance being a distance between the candidate feature data and the corresponding clustering center;

[0012] determine target feature data in the candidate feature data set according to the center offset value;

[0013] obtain a feature expansion rule corresponding to the target feature data as a target feature expansion rule, the target feature expansion rule being used for expansion processing on features of a network data packet to be detected.

[0014] In some embodiments, the calculating a center offset value of the candidate feature data in the candidate feature data set, the center offset value being positively correlated with an offset distance, the offset distance being a distance between the candidate feature data and the corresponding clustering center, comprises:

[0015] calculate a mean value of offset distances between the center feature data and corresponding candidate feature data in a plurality of candidate feature data sets in a clustering group, the center feature data being feature data corresponding to the clustering center, and the clustering group being a plurality of groups obtained by clustering the plurality of candidate feature data sets;

[0016] calculate a sum of a plurality of mean values corresponding to a plurality of clustering groups to obtain the center offset value of the candidate feature data corresponding to the center feature data.

[0017] In some embodiments, the performing clustering processing on the plurality of candidate feature data sets corresponding to the plurality of intrusion detection samples to obtain a plurality of clustering centers, comprises:

[0018] perform normalization processing on the candidate feature data in the plurality of candidate feature data sets corresponding to the plurality of intrusion detection samples to obtain a plurality of normalized feature data sets corresponding to the plurality of intrusion detection samples;

[0019] perform clustering processing on the plurality of normalized feature data sets to obtain a plurality of clustering centers;

[0020] The calculating a center offset value of the candidate feature data in the candidate feature data set, the center offset value being positively correlated with an offset distance, the offset distance being a distance between the candidate feature data and the corresponding clustering center, comprises:

[0021] a center offset value of the normalized feature data in the normalized feature data set is calculated, the center offset value is positively correlated with an offset distance, the offset distance is a distance between the normalized feature data and a corresponding cluster center;

[0022] the target feature data is determined in the candidate feature data set according to the center offset value, including:

[0023] the target feature data is determined in the normalized feature data set according to the center offset value.

[0024] In some embodiments, the target feature data is determined in the normalized feature data set according to the center offset value, including:

[0025] a first selection parameter is obtained, the first selection parameter is a parameter obtained by iteratively optimizing and learning a detection effect of intrusion detection of detection samples with different selection ratios according to a preset neural network model;

[0026] a first number is calculated according to the first selection parameter and a number of normalized feature data in the normalized feature data set;

[0027] a plurality of normalized feature data are sorted in order from low to high according to the center offset value, and a first number of normalized feature data sorted in front are determined as target feature data.

[0028] In some embodiments, the target feature data is determined in the normalized feature data set according to the center offset value, including:

[0029] The plurality of extended feature data are processed by principal component analysis based on the label data, and a plurality of first feature data are determined in the plurality of extended feature data according to a processing result of the principal component analysis processing;

[0030] The plurality of first feature data are processed by correlation analysis based on the label data, and a plurality of second feature data are determined in the plurality of first feature data according to a processing result of the correlation analysis processing;

[0031] A plurality of candidate feature data are determined in the plurality of second feature data according to an association relationship between the plurality of second feature data, and a candidate feature data set corresponding to the intrusion detection sample is obtained.

[0032] In some embodiments, the principal component analysis processing is performed on the plurality of extended feature data based on the label data, and a plurality of first feature data is determined from the plurality of extended feature data according to a processing result of the principal component analysis processing, including:

[0033] The principal component analysis processing is performed on the plurality of extended feature data based on the label data, and importance of the plurality of extended feature data relative to the label data is determined according to a processing result of the principal component analysis processing;

[0034] A second quantity is calculated according to the second selection parameter and a quantity of the extended feature data;

[0035] The plurality of extended feature data is sorted according to an order from high to low importance, and a second quantity of extended feature data in the front of the sorting is selected to obtain a plurality of first feature data.

[0036] In some embodiments, the correlation analysis processing is performed on the plurality of first feature data based on the label data, and a plurality of second feature data is determined from the plurality of first feature data according to a processing result of the correlation analysis processing, including:

[0037] The correlation analysis processing is performed on the plurality of first feature data based on the label data, and correlation of the plurality of first feature data with the label data is determined according to a processing result of the correlation analysis processing;

[0038] A third quantity is calculated according to the second selection parameter and a quantity of the first feature data;

[0039] The plurality of first feature data is sorted according to an order from high to low correlation, and a third quantity of first feature data in the front of the sorting is selected to obtain a plurality of second feature data.

[0040] In some embodiments, a plurality of candidate feature data is determined from the plurality of second feature data according to an association relationship between the plurality of second feature data, and a candidate feature data set corresponding to the intrusion detection sample is obtained, including:

[0041] Mutual information between the plurality of second feature data is calculated respectively, and a mutual information set corresponding to the second feature data is constructed according to the mutual information;

[0042] A sum of a plurality of mutual information in the mutual information set corresponding to the second feature data is calculated to obtain target mutual information corresponding to the second feature data;

[0043] A plurality of candidate feature data is determined from the plurality of second feature data according to the target mutual information, and a candidate feature data set corresponding to the intrusion detection sample is obtained.

[0044] In some embodiments, the determining a plurality of candidate feature data from the plurality of second feature data according to the target mutual information comprises:

[0045] obtaining a third selection parameter, and calculating a fourth number based on the third selection parameter and the number of the second feature data;

[0046] sorting the plurality of second feature data in a descending order of the target mutual information, and selecting a fourth number of second feature data in the front to obtain a candidate feature data set containing a plurality of candidate feature data.

[0047] To achieve the above object, a second aspect of the embodiment of the present application provides a feature rule extraction device, which comprises:

[0048] a first obtaining module, configured to obtain a plurality of intrusion detection samples, wherein the intrusion detection sample comprises intrusion detection data and label data, and the intrusion detection data comprises a plurality of feature data;

[0049] an expansion module, configured to perform feature expansion on the plurality of feature data according to a plurality of feature expansion rules to obtain a plurality of expanded feature data;

[0050] a selection module, configured to select a plurality of candidate feature data from the plurality of expanded feature data according to the importance degree of the label data to the expanded feature data and the association relationship between the expanded feature data to obtain a candidate feature data set corresponding to the intrusion detection sample;

[0051] a clustering module, configured to perform clustering processing on a plurality of candidate feature data sets corresponding to the plurality of intrusion detection samples to obtain a plurality of cluster centers;

[0052] a calculation module, configured to calculate a center offset value of a candidate feature data in a candidate feature data set, wherein the center offset value is positively correlated with an offset distance, and the offset distance is a distance between the candidate feature data and a corresponding cluster center;

[0053] a determination module, configured to determine a target feature data from the candidate feature data set according to the center offset value;

[0054] a second obtaining module, configured to obtain a feature expansion rule corresponding to the target feature data as a target feature expansion rule, wherein the target feature expansion rule is used for performing expansion processing on the feature of a network data packet to be detected.

[0055] To achieve the above object, a third aspect of the embodiment of the present application provides a network intrusion detection method, which comprises:

[0056] obtain a network data packet to be detected, the network data packet having the same data structure as the intrusion detection data in the feature rule extraction method provided in the first aspect;

[0057] extract features from the network data packet to obtain a plurality of features to be detected;

[0058] obtain a feature processing rule, the feature processing rule being a target feature expansion rule extracted by the feature rule extraction method provided in the first aspect;

[0059] perform feature processing on the plurality of features to be detected by using the feature processing rule to obtain target detection features;

[0060] perform network intrusion detection on the target detection features by using a preset neural network model to obtain a detection result.

[0061] To achieve the above object, the fourth aspect of the embodiment of the present application provides a network intrusion detection device, the device comprises:

[0062] a third obtaining module configured to obtain a network data packet to be detected, the network data packet having the same data structure as the intrusion detection data in the feature rule extraction method provided in the first aspect;

[0063] an extracting module configured to extract features from the network data packet to obtain a plurality of features to be detected;

[0064] a fourth obtaining module configured to obtain a feature processing rule, the feature processing rule being a target feature expansion rule extracted by the feature rule extraction method provided in the first aspect;

[0065] a processing module configured to perform feature processing on the plurality of features to be detected by using the feature processing rule to obtain target detection features;

[0066] a detection module configured to perform network intrusion detection on the target detection features by using a preset neural network model to obtain a detection result.

[0067] To achieve the above object, the fifth aspect of the embodiment of the present application provides a computer device, the computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the method of the first aspect or the third aspect when executing the computer program.

[0068] To achieve the above object, the fourth aspect of the embodiment of the present application provides a computer readable storage medium, the computer readable storage medium storing a computer program, and the computer program implementing the method of the first aspect or the third aspect when executed by a processor.

[0069] The feature rule extraction method and apparatus, and the network intrusion detection method and apparatus proposed in this application, involve the following steps: The feature rule extraction method acquires multiple intrusion detection samples, including intrusion detection data and label data, with the intrusion detection data including multiple feature data. The multiple feature data are then expanded according to various feature expansion rules to obtain multiple expanded feature data. Based on the importance of the expanded feature data to the label data and the correlation between the expanded feature data, multiple candidate feature data are selected from the multiple expanded feature data to obtain a candidate feature data set corresponding to the intrusion detection samples. The multiple candidate feature data sets corresponding to the multiple intrusion detection samples are then clustered to obtain multiple cluster centers. The center offset value of the candidate feature data in the candidate feature data set is calculated; the center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center. Target feature data is determined from the candidate feature data set based on the center offset value. The feature expansion rule corresponding to the target feature data is obtained as the target feature expansion rule, which is used to expand the features of the network data packets to be detected.

[0070] Therefore, by fully expanding the feature data in intrusion detection samples to obtain multiple possible combinations of feature data, a large amount of expanded feature data is obtained. Then, based on the label data, these expanded feature data are filtered to retain high-quality candidate feature data. Furthermore, the candidate feature data of multiple samples are clustered, and the dimensionality of the candidate feature data is further reduced based on the distance between the candidate feature data and the cluster center to obtain higher-quality target feature data. By extracting the target feature expansion rules of these target feature data, the feature expansion rules for extracting high-quality feature data can be obtained. Therefore, this method can be used to improve the quality of features obtained from intrusion detection data, thereby improving the accuracy of network intrusion detection. Attached Figure Description

[0071] Figure 1 This is a flowchart of the feature rule extraction method provided in the embodiments of this application;

[0072] Figure 2 yes Figure 1 The flowchart of step S103 in the process;

[0073] Figure 3 yes Figure 2 The flowchart of step S201 in the text;

[0074] Figure 4 yes Figure 2 The flowchart of step S202 in the document;

[0075] Figure 5 yes Figure 2The flowchart of step S203 in the process;

[0076] Figure 6 yes Figure 5 The flowchart of step S503 in the process;

[0077] Figure 7 yes Figure 1 The flowchart of step S105 in the process;

[0078] Figure 8 This is a schematic diagram illustrating the clustering of candidate feature data sets;

[0079] Figure 9 yes Figure 1 The flowchart of step S104 in the process;

[0080] Figure 10 This is a schematic diagram of the feature rule extraction device provided in the embodiments of this application;

[0081] Figure 11 This is a flowchart illustrating the network intrusion detection method provided in the embodiments of this application;

[0082] Figure 12 This is a schematic diagram of the network intrusion detection device provided in the embodiments of this application;

[0083] Figure 13 This is a schematic diagram of the hardware structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0084] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0085] It should be noted that although functional modules are divided in the device schematic diagram and a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the device or the order in the flowchart. The terms "first," "second," etc., in the specification, claims, and the aforementioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0086] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0087] First, let's analyze some of the terms used in this application:

[0088] Artificial intelligence (AI) is a new branch of computer science that studies, develops, and applies theories, methods, technologies, and systems to simulate, extend, and expand human intelligence. It aims to understand the essence of intelligence and produce intelligent machines that can react in a way similar to human intelligence. Research in this field includes robotics, speech recognition, image recognition, natural language processing, and expert systems. AI can simulate the information processes of human consciousness and thought. Furthermore, AI utilizes digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceiving the environment, acquiring knowledge, and using that knowledge to achieve optimal results.

[0089] In related technologies, when using intrusion detection models to detect network intrusions in network data packets, it is necessary to first extract important features from the network data packets to eliminate redundant and interfering features that could negatively impact the performance of the intrusion detection model. Specifically, mathematical methods such as principal component analysis and correlation analysis, as well as optimization methods such as particle swarm optimization, are typically used to filter features from network data packets. However, these methods only select from the original features of the network data packets, and the filtering process can lead to the loss of some features.

[0090] Other techniques normalize data in network packets and extract features that significantly impact intrusion detection using an information gain voting algorithm. Intrusion detection is then achieved through a hybrid analysis of multiple algorithms. However, the information gain criterion tends to favor features with more values, making the extracted features inadequate for scenarios with imbalanced data, thus hindering the detection of highly concealed abnormal behaviors.

[0091] In other techniques, a linear correlation coefficient algorithm is used as a feature filter, combined with the Squid Optimization algorithm as a feature wrapper, to extract features from intrusion detection data. Finally, a decision tree is used as the classification model for intrusion detection. While the linear correlation coefficient-based feature extraction method has the advantages of strong interpretability and simple implementation, the feature sequence obtained by this method is only selected from the original features and cannot extract the optimal features.

[0092] In other techniques, feature extraction is performed using particle swarm optimization (PSO) combined with ensemble tree models for intrusion detection. PSO is a collaborative random search algorithm developed by simulating the foraging behavior of bird flocks. Theoretically, it can find the globally optimal feature combination pattern in the search space. However, while PSO converges quickly in its early stages, it is prone to premature convergence and getting trapped in local optima, leading to model instability.

[0093] In other techniques, principal component analysis is used to extract intrusion detection feature sequences, which are then combined with reinforced support vector machines for intrusion detection. However, when the factor loadings of the principal components have both positive and negative signs, the extracted feature sequences are not very representative, meaning that the optimal features cannot be extracted.

[0094] In summary, the feature extraction of intrusion detection data in related technologies is not accurate enough, which prevents the intrusion detection model from achieving optimal performance and thus results in inaccurate intrusion detection results.

[0095] Based on this, embodiments of this application provide a feature rule extraction method and apparatus, and a network intrusion detection method and apparatus, aiming to improve the quality of features obtained by feature extraction from intrusion detection data, thereby improving the accuracy of intrusion detection.

[0096] The feature rule extraction method and apparatus, and the network intrusion detection method and apparatus provided in this application are specifically described through the following embodiments. First, the feature rule extraction method in the embodiments of this application is described.

[0097] The feature rule extraction method provided in this application relates to the field of artificial intelligence technology. This feature rule extraction method can be applied to a terminal, a server, or software running on either a terminal or a server. In some embodiments, the terminal can be a smartphone, tablet, laptop, desktop computer, etc.; the server can be configured as an independent physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN, and big data and artificial intelligence platforms; the software can be an application implementing the feature rule extraction method, but is not limited to the above forms.

[0098] This application can be used in a wide variety of general-purpose or special-purpose computer system environments or configurations. Examples include: personal computers, server computers, handheld or portable devices, tablet devices, multiprocessor systems, microprocessor-based systems, set-top boxes, programmable consumer electronics, network PCs, minicomputers, mainframe computers, and distributed computing environments including any of the above systems or devices. This application can be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform specific tasks or implement specific abstract data types. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0099] It should be noted that in all specific embodiments of this application, when processing data related to user identity or characteristics, such as user information, user behavior data, user historical data, and user location information, user permission or consent is obtained first. Furthermore, the collection, use, and processing of this data comply with relevant laws, regulations, and standards. In addition, when embodiments of this application require access to sensitive personal information of users, separate permission or consent from the user is obtained through pop-ups or redirection to confirmation pages. Only after obtaining the user's separate permission or consent is the necessary user-related data required for the proper functioning of these embodiments acquired.

[0100] Figure 1 This is an optional flowchart of the feature rule extraction method provided in the embodiments of this application. Figure 1 The method may include, but is not limited to, steps S101 to S107.

[0101] Step S101: Obtain multiple intrusion detection samples.

[0102] The feature rule extraction method provided in this application uses a large number of labeled intrusion detection samples to perform feature inflation and label-based multi-level feature dimensionality reduction, thereby selecting the optimal feature combination, and then extracting the optimal feature processing rule for feature processing from the optimal feature combination.

[0103] Specifically, multiple intrusion detection samples can be obtained first, and these samples can be divided into training and testing sets. The optimal feature processing rules are then extracted using the training set, and the optimal feature processing rules are validated using the testing set. Both the training and testing sets contain intrusion detection data and label data. The intrusion detection data can specifically be network packets, and it includes multiple feature data. These feature data can be characteristics inherent to the network packets themselves, such as protocol type, service, root shell, etc. Generally, network packets have 41 features. The label data can be binary labels, such as "normal" and "attack"; in some embodiments, the label data can also be multi-class labels. Specifically, attack labels can be subdivided into denial-of-service (DoS), probing, user-to-root (U2R), and remote-to-local (R2L) labels. DoS is an attack that attempts to shut down traffic to and from a target system; Probe (or surveillance) is an attack that attempts to obtain information from a network; U2R is an attack that starts with a regular user account and attempts to access a system or network as a superuser; R2L is an attack that attempts to gain local access to a remote machine.

[0104] The intrusion detection samples can be obtained from intrusion detection datasets (such as NSL-KDD or KDD99 datasets) or from other channels such as network data traffic logs.

[0105] Step S102: Extend the features of multiple feature data according to multiple feature extension rules to obtain multiple extended feature data.

[0106] In intrusion detection data, multiple features can conflict and interfere with each other when applied to an intrusion detection model. Furthermore, some features may have low value, affecting the detection performance of the intrusion detection model. Moreover, features in intrusion detection data are not necessarily directly positively or negatively correlated with labels on their own, but rather associated with labels in specific combinations. For example, the presence of both feature A and feature B increases the likelihood of an attack label; conversely, the presence of feature A and the absence of feature C increases the likelihood of a normal label. Therefore, in this embodiment, feature expansion can be performed based on multiple features of the intrusion detection data. Specifically, feature expansion can involve using various expansion rules to extend the original features of the intrusion detection sample. For example, feature expansion can be achieved by performing addition, subtraction, multiplication, division, averaging, or concatenation on the feature data of the intrusion detection sample; in some embodiments, the feature data of the intrusion detection sample can also be retained. Feature expansion can use specific combination patterns to reconstruct the original feature data of the intrusion detection sample, achieving feature inflation and expanding the original dozens of feature data into thousands or even tens of thousands of extended feature data. The extended feature data here can specifically be feature vectors. Multiple feature vectors can form a feature matrix. Therefore, the extended feature data obtained by extending multiple feature data can be represented by the feature matrix F1.

[0107] Specifically, feature expansion for multiple feature data can be automated using deep feature synthesis (DFS) technology. Deep feature synthesis can significantly improve the efficiency of feature expansion, thereby improving the efficiency of feature rule extraction.

[0108] It is understandable that the process of expanding multiple feature data of an intrusion detection sample to obtain multiple expanded feature data described above is for a single intrusion detection sample. For other intrusion detection samples, the same method can be used to expand features and obtain the expanded feature data corresponding to each intrusion detection sample, that is, to obtain the F1 score for each intrusion detection sample.

[0109] Step S103: Based on the importance of the extended feature data to the label data and the correlation between the extended feature data, select multiple candidate feature data from the multiple extended feature data to obtain the candidate feature data set corresponding to the intrusion detection sample.

[0110] In the process of expanding multiple feature data of intrusion detection samples to obtain a large amount of expanded feature data, both high-quality feature data suitable for intrusion detection models and a large amount of low-quality feature data are generated. Therefore, in this embodiment, feature filtering can be further performed on the multiple expanded feature data obtained from feature expansion. Multiple higher-quality expanded feature data are selected from the expanded features and determined as candidate feature data, forming a candidate feature data set. Furthermore, each intrusion detection sample can be traversed, and feature filtering can be performed on the expanded feature data corresponding to each intrusion detection sample to obtain a candidate feature data set corresponding to each intrusion detection sample. The candidate feature data can also be feature vectors, and the candidate feature data set can also be represented by a feature matrix, such as feature matrix F3. Since the number of candidate feature data is less than the number of expanded feature data, feature matrix F3 can be understood as a feature matrix obtained by dimensionality reduction of feature matrix F1. It is understood that different intrusion detection samples have the same number of feature data and all use the same feature expansion and feature filtering methods; therefore, the number of candidate feature data in the candidate feature data sets corresponding to different intrusion detection samples can also be the same.

[0111] In this embodiment, the process of feature filtering on a large amount of extended feature data can specifically be based on the importance of the extended feature data to the label data and the correlation between the extended feature data. Generally, the lower the importance of the extended feature data relative to the label data, the lower its value and the more likely it is to be interfering feature data. Therefore, it can be excluded, and only extended feature data with a relatively high importance to the label data can be selected as candidate feature data. In addition, features with a stronger correlation between extended feature data are more likely to be normal features, while features with a weaker correlation with other extended feature data may be abnormal features and need to be excluded. Therefore, only features with a strong correlation with other extended features can be selected as candidate feature data.

[0112] Step S104: Cluster the multiple candidate feature data sets corresponding to multiple intrusion detection samples to obtain multiple cluster centers.

[0113] As mentioned earlier, through feature expansion and feature filtering, a candidate feature data set F3 can be obtained for each intrusion detection sample. Then, some or all of the feature data sets can be selected from these candidate feature data sets for clustering to obtain multiple cluster centers. The purpose of clustering the candidate feature data sets of multiple intrusion detection samples is to analyze the similarity between the candidate feature data sets corresponding to different intrusion detection samples, thereby enabling further analysis of the relationships between corresponding candidate feature data within the candidate feature data sets. In essence, clustering multiple candidate feature data sets corresponding to multiple intrusion detection samples is to perform clustering processing on the corresponding candidate feature data within each of the multiple candidate feature data sets.

[0114] In this embodiment, multiple cluster centers are obtained by clustering candidate feature data sets corresponding to multiple intrusion detection samples. Specifically, the multiple candidate feature data sets can first be divided into several cluster groups using k-means clustering, with each cluster group containing several candidate feature data sets. Then, for each cluster group, the cluster center corresponding to that cluster group is calculated, resulting in multiple cluster centers. Calculating the cluster center corresponding to a cluster group can be achieved by calculating the mean of the multiple candidate feature data sets within that cluster group. For ease of understanding, a specific example can be given as follows: a cluster group includes two candidate feature data sets. The first candidate feature data set includes elements x1, x2, and x3, and the second candidate feature data set includes elements y1, y2, and y3. The cluster centers are then the sets containing elements (x1+y1) / 2, (x2+y2) / 2, and (x3+y3) / 2. The cluster group exemplified here contains two candidate feature data sets; in other embodiments, the cluster group may also contain multiple candidate feature data sets. Cluster centers are obtained by calculating the mean of these multiple candidate feature data sets. As can be seen from the example above, the number of central feature data points in a cluster center can be the same as the number of candidate feature data points in each candidate feature data set, and there can be a one-to-one correspondence between the candidate feature data points in the candidate feature data sets and the central feature data points in the cluster centers.

[0115] Step S105: Calculate the center offset value of the candidate feature data in the candidate feature data set. The center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center.

[0116] In this embodiment, the center offset value of candidate feature data in a candidate feature data set can be calculated based on multiple cluster centers. Here, the center offset value corresponds to the number of candidate feature data in a single candidate feature data set. For example, a total of 10 intrusion detection samples are obtained, and each intrusion detection sample contains 41 features. In the feature expansion stage, the features of each intrusion detection data are expanded to 1000; in the feature filtering stage, the features of each intrusion detection data can be filtered down to 100. That is, the candidate feature data set corresponding to each intrusion detection sample contains 100 elements, and similarly, each cluster center also contains 100 elements, and there is a one-to-one correspondence between the candidate feature data set and the 100 cluster elements of the cluster center. Thus, calculating the center offset value of the candidate feature data is equivalent to calculating the degree of separation of these 100 candidate feature data among multiple intrusion detection samples, specifically represented by the center offset value. Here, the center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center. This will be illustrated with specific examples below.

[0117] Step S106: Determine the target feature data from the candidate feature data set based on the center offset value.

[0118] The greater the degree of divergence of candidate feature data among multiple intrusion detection samples, the more discrete the feature distribution is, and the greater the possibility that the feature is a interference feature. Therefore, it is necessary to remove candidate feature data with a large degree of divergence, i.e. a large center offset value, and retain features with a smaller degree of divergence as higher quality features.

[0119] That is, based on the center offset value, the target feature data with a smaller degree of separation, i.e. higher quality, can be determined in the candidate feature data set.

[0120] Step S107: Obtain the feature expansion rule corresponding to the target feature data as the target feature expansion rule.

[0121] The target feature data consists of high-quality new combined features selected through feature expansion, feature filtering, and dimensionality reduction. These features have a high degree of fit with the intrusion detection model, which can improve the model's performance and thus enhance its detection accuracy. By obtaining the feature expansion rules for these target feature data, feature expansion rules applicable to other intrusion detection data can be derived. Here, the feature expansion rules corresponding to the target feature data are defined as the target feature expansion rules.

[0122] Because network data packets have a uniform format—meaning the intrusion detection data in the intrusion detection sample shares a consistent data format with other intrusion detection data to be detected on the internet—target feature expansion rules extracted from target feature data can be effectively reused in other intrusion detection data to be detected. This allows for the extraction of feature data suitable for intrusion detection models from the intrusion detection data, thus improving the quality of features obtained from intrusion detection data feature extraction and consequently enhancing the accuracy of intrusion detection.

[0123] Steps S101 to S107 of this embodiment involve feature expansion and reconstruction of the features of intrusion detection data in the intrusion detection samples. Then, based on the expanded features, a preliminary screening is performed on the importance of the label data in the intrusion detection samples and the correlation between the expanded features to obtain high-quality candidate feature data. Further, interfering features are filtered out based on the degree of dissimilarity between the candidate feature data and different samples, thereby obtaining higher-quality target feature data. By extracting feature expansion rules from the target feature data, good feature expansion rules that can be reused in other intrusion detection data can be obtained. This method can extract good feature expansion rules, thereby improving the quality of features obtained from feature extraction of intrusion detection data.

[0124] Please see Figure 2 In some embodiments, step S103 may include, but is not limited to, steps S201 to S203:

[0125] Step S201: Perform principal component analysis on multiple extended feature data based on the label data, and determine multiple first feature data from the multiple extended feature data according to the processing results of the principal component analysis.

[0126] Step S202: Perform correlation analysis on multiple first feature data based on the label data, and determine multiple second feature data from the multiple first feature data according to the processing results of the correlation analysis.

[0127] Step S203: Based on the correlation between multiple second feature data, determine multiple candidate feature data from the multiple second feature data to obtain a set of candidate feature data corresponding to the intrusion detection sample.

[0128] In step S201 of some embodiments, for the extended feature set F1 composed of multiple extended feature data, principal component analysis (PCA) can be used to perform principal component analysis on the multiple extended feature data and label data in the extended feature set F1, thereby obtaining the importance of each extended feature data to the label data. Then, based on the importance of each extended feature data to the label data, multiple feature data with higher importance are determined from the multiple extended feature data, resulting in multiple first feature data. Here, the first feature data is used to distinguish it from the second feature data in this embodiment, and does not limit the order of the data.

[0129] Principal component analysis (PCA), also known as principal component analysis, aims to reduce the dimensionality of multiple indicators by converting them into a few comprehensive indicators. In this embodiment, due to the large amount of extended feature data, it is difficult to determine the importance of each extended feature data point to the label data. PCA can reduce the dimensionality of the extended feature data, converting multiple extended feature data points into a few principal component features. Then, by determining the importance of the principal component features to the label data, the importance of each extended feature data point to the label data can be derived in reverse. In some embodiments, factor analysis can also be used to calculate the importance of each extended feature data point to the label.

[0130] In step S202 of some embodiments, for the multiple first feature data selected by principal component analysis, correlation analysis can be performed. This correlation analysis analyzes the correlation between the first feature data and the label data. Specifically, the correlation analysis method can be Pearson bivariate correlation analysis, Spearman correlation analysis, or other correlation analysis methods. This analysis method can determine the impact of changes in the first feature data on the label data, i.e., determine the correlation between the first feature data and the label data. Then, based on the results of the correlation analysis, multiple second feature data are determined from the multiple first feature data. Specifically, the first feature data with a high correlation to the label data can be determined as the second feature data. Here, the second feature data can be eigenvectors, and the set of multiple second feature data can be represented by a feature matrix, specifically, a feature matrix F2.

[0131] In step S203 of some embodiments, for multiple second feature data selected by correlation analysis, the correlation between the second feature data can be calculated, and then the correlation value between each second feature data and other second feature data can be determined based on the correlation between the second feature data. Generally, the larger the correlation value of a second feature data, the stronger its correlation with other second feature data, that is, the less likely the second feature data is to be a distracting feature. Conversely, the smaller the correlation value of a second feature data, the more likely it is to be a distracting feature. Therefore, the second feature data with higher correlation values ​​can be identified as candidate feature data, thereby obtaining a candidate feature data set. Here, the candidate feature data set is the candidate feature data set corresponding to an intrusion detection sample. For each intrusion detection sample, the above method can be used to determine its corresponding candidate feature data set. Here, the candidate feature data set can be represented by the aforementioned feature matrix F3.

[0132] In this embodiment of the application, by using an integrated analysis and screening method, principal component analysis and correlation analysis are first performed on the feature data and label data to screen out a portion of higher-quality extended features. Then, the association relationship between the feature data is used to further screen the screened extended features. This can largely achieve feature dimensionality reduction and filter out a large number of low-quality features, thereby reducing the amount of computation required for the feature separation degree analysis process and greatly improving the efficiency of feature rule extraction.

[0133] Please see Figure 3 In some embodiments, step S201 may include, but is not limited to, steps S301 to S303:

[0134] Step S301: Perform principal component analysis on the multiple extended feature data based on the label data, and determine the importance of the multiple extended features relative to the label data based on the principal component analysis results.

[0135] Step S302: Obtain the second selection parameter, and calculate the second quantity based on the second selection parameter and the quantity of the extended feature data.

[0136] Step S303: Sort the multiple extended feature data in descending order of importance, and select the second number of extended feature data that are ranked first to obtain multiple first feature data.

[0137] In step S301 of some embodiments, principal component analysis can be used to determine the importance of extended features relative to the label data. This process has been described in the foregoing steps and will not be repeated here.

[0138] In step S302 of some embodiments, a second selection parameter a can be obtained. This second selection parameter a is distinguished from the first selection parameter c and the third selection parameter b in this application; there is no restriction on the order or magnitude of the three. The second selection parameter a can be pre-learned or learned during the feature rule extraction process. That is, this selection parameter is not manually set, but rather learned through iterative optimization based on the different detection effects of intrusion detection when using features selected at different ratios for intrusion detection by the intrusion detection model.

[0139] Specifically, in the learning process of the second selection parameter, an intrusion detection model needs to be introduced. By controlling other parameters (including the first selection parameter c and the third selection parameter b) and keeping them constant, only the value of the second selection parameter is changed. Then, the target feature data extracted with different selection ratios are input into the intrusion detection model to obtain the detection results. The detection results are then evaluated. If the quality of the detection results is poor, the second selection parameter is adjusted. This process is iteratively optimized until the second selection parameter a that achieves the optimal detection effect of the intrusion detection model is found. Then, based on the second selection parameter a, the extended feature data with a relatively high importance (a%) compared to the label data can be selected as the first feature data. Specifically, the second quantity can be calculated first based on the quantity of extended feature data and the second selection parameter a. Here, the second quantity is also used to distinguish it from the first or third quantity in this application and has no size limitation.

[0140] In step S303 of some embodiments, a second number of extended feature data that are more important to the label data are selected. Specifically, the extended feature data can be sorted in descending order of importance to the label data. Then, the second number of extended feature data that are ranked first are determined as the first feature data. Alternatively, the order can be reversed, that is, sorted in ascending order of importance, and the second number of extended feature data that are ranked last are determined as the first feature data.

[0141] In this embodiment, the optimal screening ratio is determined by using an iterative optimization method that combines an intrusion detection model. Then, the optimal screening ratio is used for feature dimensionality reduction, which can further improve the quality of the extracted features.

[0142] Please see Figure 4 In some embodiments, step S202 may include, but is not limited to, steps S401 to S403:

[0143] Step S401: Perform correlation analysis on multiple first feature data based on the label data, and determine the correlation between the multiple first feature data and the label data based on the processing results of the correlation analysis.

[0144] Step S402: Calculate the third quantity based on the second selection parameter and the quantity of the first feature data.

[0145] Step S403: Sort the multiple first feature data in descending order of relevance, and select the third number of first feature data in the sorted order to obtain multiple second feature data.

[0146] In step S401 of some embodiments, the correlation analysis method is used to analyze the correlation between multiple first feature data and label data, which has been described in detail in the foregoing embodiments and will not be repeated here.

[0147] In step S402 of some embodiments, a second selection parameter determined through iterative optimization using an intrusion detection model is also employed to control the screening process. Specifically, a third quantity can be calculated based on the second selection parameter and the quantity of the first feature data.

[0148] In step S403 of some embodiments, a third number of second feature data that are highly correlated with the label data are selected from the first feature data according to a third number.

[0149] In this embodiment, the optimal screening ratio suitable for the intrusion detection model is used for feature screening, thereby further improving the quality of the extracted features.

[0150] Please see Figure 5 In some embodiments, step S203 may also include, but is not limited to, steps S501 to S503:

[0151] Step S501: Calculate the mutual information between multiple second feature data respectively, and construct the mutual information set corresponding to the second feature data based on the mutual information.

[0152] Step S502: Calculate the sum of multiple mutual information in the mutual information set corresponding to the second feature data to obtain the target mutual information corresponding to the second feature data.

[0153] Step S503: Based on the target mutual information, determine multiple candidate feature data from multiple second feature data to obtain the candidate feature data set corresponding to the intrusion detection sample.

[0154] In step S501 of some embodiments, the correlation between the second features can be determined by calculating the mutual information between the second feature data. Here, the mutual information between two random variables is a measure of the interdependence between variables. Mutual information measures the information shared by two random variables, that is, the degree to which the uncertainty about random variable Y is reduced knowing random variable X. The mutual information between two variables can be represented by I(X;Y), and the specific formula is as follows:

[0155]

[0156] Where p(x) represents X = x i The probability of occurrence, p(y) represents Y = y i The probability of occurrence. P(x,y) represents X = x i and Y = y i The probability of two things happening at the same time is called the joint probability. The base of the logarithm can be e or 2.

[0157] The method described above for calculating mutual information between two variables can be used to calculate the mutual information between each second feature data and other second feature data separately, thus obtaining the mutual information set corresponding to each second feature data. For example, if there are n second feature data, then the mutual information between each second feature data and the other n-1 second feature data can be calculated, resulting in n-1 mutual information sets. That is, each second feature data can have n-1 mutual information sets calculated, and these n-1 mutual information sets constitute the mutual information set of that second feature data.

[0158] In step S502 of some embodiments, the sum of n-1 mutual information in the mutual information set corresponding to each mutual information is calculated to obtain the target mutual information corresponding to each second feature data. Here, the target mutual information is the association value of each of the aforementioned second feature data.

[0159] In step S503 of some embodiments, the target mutual information of the second feature data represents the degree of correlation between the second feature data and other second feature data. A higher mutual information indicates a stronger correlation, and a lower mutual information indicates a weaker correlation. A weaker correlation indicates a higher probability that the feature is an interfering feature. Therefore, second feature data with higher target mutual information can be selected based on the target mutual information of each second feature data to obtain multiple candidate feature data. These multiple candidate feature data constitute a candidate feature data set for an intrusion detection sample. By traversing each intrusion detection sample, the candidate feature data set corresponding to each intrusion detection sample can be obtained.

[0160] In this embodiment, the association between the second feature data is determined by calculating the mutual information between them. This improves the accuracy of evaluating the association between features, thereby improving the accuracy of feature extraction and ultimately enhancing the quality of the extracted features.

[0161] Please see Figure 6 In some embodiments, step S503 includes, but is not limited to, steps S601 to S602:

[0162] Step S601: Obtain the third selection parameter, and calculate the fourth quantity based on the third selection parameter and the quantity of the second feature data.

[0163] Step S602: Sort the multiple second feature data in descending order of target mutual information, and select the fourth number of second feature data in the sorted order to obtain a candidate feature data set containing multiple candidate feature data.

[0164] In step S601 of some embodiments, when selecting candidate feature data from multiple second feature data based on the target mutual information of the second feature data, an optimal selection ratio can also be used to control the feature selection process. Here, the optimal selection ratio can specifically be a third selection parameter b, which can be a parameter determined through iterative optimization using an intrusion detection model. Once the third selection parameter is obtained, a fourth quantity can be calculated based on the third selection parameter and the number of second feature data.

[0165] In step S602 of some embodiments, a fourth number of second feature data with higher target mutual information are selected from a plurality of second feature data as candidate feature data according to a fourth number.

[0166] In this embodiment, the quality of the extracted features is improved by controlling the screening process of the second feature data using an optimal screening ratio suitable for the intrusion detection model.

[0167] Please see Figure 7 In some embodiments, step S105 may include, but is not limited to, steps S701 to S702:

[0168] Step S701: Calculate the mean offset distance between the central feature data and the corresponding candidate feature data in multiple candidate feature data sets within the cluster group. The central feature data is the feature data corresponding to the cluster center, and the cluster group is multiple groups obtained by clustering multiple candidate feature data sets.

[0169] Step S702: Calculate the sum of multiple means corresponding to multiple cluster groups to obtain the center offset value of the candidate feature data corresponding to the center feature data.

[0170] In step S701 of some embodiments, the average distance between each candidate feature data and the cluster center in different cluster groups is used to characterize the degree of separation of the candidate feature data. Specifically, multiple distances between the candidate feature data in each cluster group and the corresponding central feature data in the cluster center can be calculated. Then, the average distance is calculated to obtain the average distance between the candidate feature data and the corresponding cluster group.

[0171] For example, such as Figure 8The diagram illustrates multiple clusters obtained through clustering. As shown, assuming there are 7 intrusion detection samples, the feature data in the intrusion detection data of each of these 7 samples is expanded and filtered to obtain candidate feature data sets for each intrusion detection sample, namely, set S1, set S2, set S3, set S4, set S5, set S6, and set S7. These 7 candidate feature data sets are then clustered to obtain three cluster groups: cluster group 10, cluster group 20, and cluster group 30. The cluster center of cluster group 10 is cluster center C1, the cluster center of cluster group 20 is cluster center C2, and the cluster center of cluster group 30 is cluster center C3. We also assume that each feature dataset and cluster center contains three feature data points f1, f2, and f3. f1 (f2 or f3) in different feature datasets can be the same or different, but there is a corresponding relationship between f1 (f2 or f3) in different feature datasets; specifically, they can have the same feature expansion rules. Below, we will use f1 as an example to introduce the calculation of the center offset value.

[0172] For cluster group 10, the mean distance between candidate feature data and the corresponding central feature data in the cluster centers can be expressed as: For cluster group 20, the mean distance between candidate feature data and the corresponding central feature data in the cluster centers can be expressed as: For cluster group 30, the mean distance between candidate feature data and the corresponding central feature data in the cluster centers can be expressed as: Here, C1.f1 represents the central feature data f1 in the first cluster center C1, and other data can be represented by analogy.

[0173] In step S702 of some embodiments, the sum of multiple distance means corresponding to multiple cluster groups is further calculated to obtain the center offset value corresponding to the candidate feature data f1. The specific formula is as follows:

[0174]

[0175] Furthermore, the above method can be used to calculate the center offset values ​​corresponding to candidate feature data f2 and f3 respectively.

[0176] This application embodiment characterizes the degree of divergence (center offset) of candidate feature data obtained by expanding each type of feature expansion rule by calculating the sum of the average distances between the candidate feature data obtained by expanding each type of feature expansion rule and the corresponding center feature data in the multiple cluster centers obtained by clustering multiple intrusion detection samples. This can more accurately filter out interfering features and retain higher quality features, thereby further improving the feature quality of the extracted features.

[0177] Please see Figure 9 In some embodiments, step S104 may include, but is not limited to, the following steps S901 to S902:

[0178] Step S901: Normalize the candidate feature data in the multiple candidate feature data sets corresponding to multiple intrusion detection samples to obtain multiple normalized feature data sets corresponding to multiple intrusion detection samples.

[0179] Step S902: Perform clustering on multiple normalized feature data sets to obtain multiple cluster centers.

[0180] In step S901 of some embodiments, the multiple candidate feature data sets F3 corresponding to the multiple intrusion detection samples can be normalized to obtain multiple normalized feature data sets F4 corresponding to the multiple intrusion detection samples. The purpose of the normalization process is to eliminate the dimensions of the candidate feature data, avoiding any impact on clustering analysis and feature distance calculation. Specifically, the normalization operation can be performed using the following formula:

[0181]

[0182] Where x* represents the normalized data of the candidate feature data x, x max x is the maximum value in the candidate feature dataset. min It is the minimum value in the candidate feature data set.

[0183] In step S902 of some embodiments, after normalizing the candidate feature data set F3 to obtain a normalized feature data set F4, the normalized feature data set F4 can replace the candidate feature data set F3 in the processes of clustering, calculating center offset values, and obtaining target feature expansion rules. Specifically, the center offset value of the candidate feature data in the candidate feature data set is calculated. The center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center, including:

[0184] Calculate the center offset value of the normalized feature data in the normalized feature data set. The center offset value is positively correlated with the offset distance, which is the distance between the normalized feature data and the corresponding cluster center.

[0185] The target feature data is determined from the candidate feature data set based on the center offset value, including:

[0186] The target feature data is determined from the normalized feature data set based on the center offset value.

[0187] In this embodiment of the application, by normalizing the candidate feature data in the candidate feature data set, the dimensions carried by the candidate feature data are eliminated, thereby simplifying the cluster analysis and feature distance calculation process, reducing the workload of subsequent calculations, and improving the efficiency of feature rule extraction.

[0188] In some embodiments, determining the target feature data from the normalized feature data set based on the center offset value includes:

[0189] Obtain the first selection parameter, which is a parameter obtained by iteratively optimizing the detection effect of intrusion detection on detection samples with different selection ratios based on a preset neural network model;

[0190] The first quantity is calculated based on the first selected parameters and the number of normalized feature data in the normalized feature data set;

[0191] The normalized feature data are sorted in ascending order of center offset value, and the first number of normalized feature data in the sorted order is determined as the target feature data.

[0192] In this embodiment, the process of determining target feature data from the normalized feature data set based on the center offset value corresponding to each normalized feature data can specifically involve obtaining a first selection parameter c and then using the first selection parameter c to control the screening ratio. Finally, the normalized features with the smallest center offset value (c%) are selected as the target feature data. Here, the first selection parameter can also be the parameter most suitable for the intrusion detection model, determined through iterative optimization using the intrusion detection model. Using this parameter to control the screening process of the target feature data can further improve the quality of the extracted features.

[0193] Please see Figure 10 This application also provides a feature rule extraction apparatus that can implement the above-described feature rule extraction method. The apparatus includes:

[0194] The first acquisition module is used to acquire multiple intrusion detection samples, the intrusion detection samples including intrusion detection data and tag data, the intrusion detection data including multiple feature data;

[0195] The extension module is used to extend the multiple feature data according to various feature extension rules to obtain multiple extended feature data.

[0196] The selection module is used to select multiple candidate feature data from the multiple extended feature data according to the importance of the extended feature data to the tag data and the correlation between the extended feature data, so as to obtain a set of candidate feature data corresponding to the intrusion detection sample.

[0197] The clustering module is used to perform clustering processing on the multiple candidate feature data sets corresponding to the multiple intrusion detection samples to obtain multiple cluster centers;

[0198] The calculation module is used to calculate the center offset value of the candidate feature data in the candidate feature data set. The center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center.

[0199] The determination module is used to determine the target feature data in the candidate feature data set based on the center offset value;

[0200] The second acquisition module is used to acquire the feature expansion rules corresponding to the target feature data as target feature expansion rules, which are used to expand the features of the network data packets to be detected.

[0201] The specific implementation of this feature rule extraction device is basically the same as the specific embodiment of the feature rule extraction method described above, and will not be repeated here.

[0202] Figure 11 This is an optional flowchart of the network intrusion detection method provided in the embodiments of this application. Figure 11 The method may include, but is not limited to, steps S1101 to S1105:

[0203] Step S1101: Obtain the network data packets to be detected.

[0204] The network packets to be detected can be network packets directly obtained from the network used for intrusion detection. Here, the network packets have the same data structure as the intrusion detection data in the feature rule extraction method.

[0205] Step S1102: Feature extraction is performed on the network data packets to obtain multiple features to be detected.

[0206] In this case, the network data packets have the same data structure as the intrusion detection data in the above feature rule extraction method embodiment. Therefore, the multiple features to be detected obtained by feature extraction of the network data packets have the same feature type and number as the multiple feature data contained in the intrusion detection data.

[0207] Step S1103: Obtain feature processing rules. The feature processing rules are the target feature expansion rules extracted using the feature rule extraction method.

[0208] Since the multiple features to be detected extracted from network packets have the same feature type and number as the feature data in the intrusion detection data in the feature rule extraction method embodiment, the optimal target feature expansion rule determined based on the intrusion detection data can be reused in the multiple features to be detected in this embodiment. Therefore, the target feature expansion rule extracted by the feature rule extraction method in this application can be obtained for later use.

[0209] Step S1104: Perform feature processing on multiple features to be detected using feature processing rules to obtain target detection features.

[0210] That is, the target detection features are obtained by using the acquired target feature expansion rules to expand the features of multiple features to be detected.

[0211] Step S1105: Use a preset neural network model to perform network intrusion detection on the target detection features and obtain the detection results.

[0212] The neural network model here is assumed to be an intrusion detection model from the feature rule extraction method. Since the target feature expansion rule is the most suitable feature expansion rule for the intrusion detection model obtained through the feature rule extraction method, the target detection feature obtained by expanding the feature to be detected using this target feature expansion rule is also the most suitable feature for the intrusion detection model. Therefore, the accuracy of intrusion detection can be improved by enhancing the quality of the features obtained from feature extraction. In other words, this method can significantly improve the accuracy of network intrusion detection.

[0213] Please see Figure 12 This application also provides a network intrusion detection device that can implement the above-described network intrusion detection method. The device includes:

[0214] The third acquisition module is used to acquire network data packets to be detected. The network data packets have the same data structure as the intrusion detection data in the feature rule extraction method.

[0215] The extraction module is used to extract features from network data packets to obtain multiple features to be detected;

[0216] The fourth acquisition module is used to acquire feature processing rules, which are target feature expansion rules extracted using feature rule extraction methods.

[0217] The processing module is used to perform feature processing on multiple features to be detected using feature processing rules to obtain target detection features;

[0218] The detection module is used to perform network intrusion detection on target detection features using a preset neural network model and obtain detection results.

[0219] The specific implementation of this network intrusion detection device is basically the same as the specific implementation of the network intrusion detection method described above, and will not be repeated here.

[0220] This application also provides a computer device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned feature rule extraction method or network intrusion detection method. This computer device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0221] Please see Figure 13 , Figure 13 The hardware structure of a computer device according to another embodiment is illustrated. The computer device includes:

[0222] The processor 1301 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this application.

[0223] The memory 1302 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1302 can store the operating system and other applications. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1302 and is called and executed by the processor 1301 to execute the feature rule extraction method or network intrusion detection method of the embodiments of this application.

[0224] The input / output interface 1303 is used to implement information input and output;

[0225] The communication interface 1304 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, Ethernet cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0226] Bus 1305 transmits information between various components of the device (e.g., processor 1301, memory 1302, input / output interface 1303, and communication interface 1304);

[0227] The processor 1301, memory 1302, input / output interface 1303 and communication interface 1304 are connected to each other within the device via bus 1305.

[0228] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned feature rule extraction method or network intrusion detection method.

[0229] Memory, as a non-transitory computer-readable storage medium, can be used to store non-transitory software programs and non-transitory computer-executable programs. Furthermore, memory may include high-speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some embodiments, memory may optionally include memory remotely located relative to the processor, and these remote memories can be connected to the processor via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0230] The embodiments described in this application are for the purpose of more clearly illustrating the technical solutions of the embodiments of this application, and do not constitute a limitation on the technical solutions provided by the embodiments of this application. As those skilled in the art will know, with the evolution of technology and the emergence of new application scenarios, the technical solutions provided by the embodiments of this application are also applicable to similar technical problems.

[0231] Those skilled in the art will understand that the technical solutions shown in the figures do not constitute a limitation on the embodiments of this application, and may include more or fewer steps than shown, or combine certain steps, or different steps.

[0232] The preferred embodiments of the present application have been described above with reference to the accompanying drawings, but this does not limit the scope of the claims of the present application. Any modifications, equivalent substitutions, and improvements made by those skilled in the art without departing from the scope and substance of the embodiments of the present application shall be within the scope of the claims of the present application.

Claims

1. A feature rule extraction method, characterized in that, The method includes: Multiple intrusion detection samples are acquired, the intrusion detection samples include intrusion detection data and tag data, and the intrusion detection data includes multiple feature data; The multiple feature data are extended according to various feature extension rules to obtain multiple extended feature data. Based on the importance of the extended feature data to the tag data and the correlation between the extended feature data, multiple candidate feature data are selected from the multiple extended feature data to obtain a set of candidate feature data corresponding to the intrusion detection sample. Clustering is performed on the multiple candidate feature data sets corresponding to the multiple intrusion detection samples to obtain multiple cluster centers; Calculate the center offset value of the candidate feature data in the candidate feature data set. The center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center. The target feature data is determined from the candidate feature data set based on the center offset value; The feature expansion rule corresponding to the target feature data is obtained as the target feature expansion rule, which is used to expand the features of the network data packet to be detected. The step involves selecting multiple candidate feature data from the multiple extended feature data based on the importance of the extended feature data to the tag data and the correlation between the extended feature data, to obtain a candidate feature data set corresponding to the intrusion detection data, including: Principal component analysis is performed on the multiple extended feature data based on the label data, and multiple first feature data are determined from the multiple extended feature data according to the processing results of the principal component analysis. Based on the label data, a correlation analysis is performed on the plurality of first feature data, and a plurality of second feature data are determined from the plurality of first feature data according to the processing results of the correlation analysis. Based on the correlation between the multiple second feature data, multiple candidate feature data are determined from the multiple second feature data to obtain a set of candidate feature data corresponding to the intrusion detection sample.

2. The method according to claim 1, characterized in that, The calculation of the center offset value of candidate feature data in the candidate feature data set, wherein the center offset value is positively correlated with the offset distance, wherein the offset distance is the distance between the candidate feature data and the corresponding cluster center, including: The mean offset distance between the central feature data and the corresponding candidate feature data in multiple candidate feature data sets within the cluster group is calculated. The central feature data is the feature data corresponding to the cluster center, and the cluster group is multiple groups obtained by clustering the multiple candidate feature data sets. The sum of multiple means corresponding to multiple cluster groups is calculated to obtain the center offset value of the candidate feature data corresponding to the center feature data.

3. The method according to claim 1, characterized in that, The clustering process is performed on the multiple candidate feature data sets corresponding to the multiple intrusion detection samples to obtain multiple cluster centers, including: The candidate feature data in the multiple candidate feature data sets corresponding to the multiple intrusion detection samples are normalized to obtain multiple normalized feature data sets corresponding to the multiple intrusion detection samples. Clustering is performed on the multiple normalized feature data sets to obtain multiple cluster centers; The calculation of the center offset value of candidate feature data in the candidate feature data set, wherein the center offset value is positively correlated with the offset distance, wherein the offset distance is the distance between the candidate feature data and the corresponding cluster center, including: Calculate the center offset value of the normalized feature data in the normalized feature data set. The center offset value is positively correlated with the offset distance, which is the distance between the normalized feature data and the corresponding cluster center. The step of determining the target feature data from the candidate feature data set based on the center offset value includes: The target feature data is determined in the normalized feature data set based on the center offset value.

4. The method according to claim 3, characterized in that, The step of determining the target feature data in the normalized feature data set based on the center offset value includes: Obtain the first selection parameter, which is a parameter obtained by iteratively optimizing the detection effect of intrusion detection on detection samples with different selection ratios based on a preset neural network model; The first quantity is calculated based on the first selection parameter and the number of normalized feature data in the normalized feature data set; The normalized feature data are sorted in ascending order of the center offset value, and the first number of normalized feature data in the sorted order is determined as the target feature data.

5. The method according to claim 1, characterized in that, The step involves performing principal component analysis on the multiple extended feature data based on the label data, and determining multiple first feature data from the multiple extended feature data according to the processing results of the principal component analysis, including: Principal component analysis is performed on the multiple extended feature data based on the label data, and the importance of the multiple extended features relative to the label data is determined based on the principal component analysis results. Obtain the second selection parameter, and calculate the second quantity based on the second selection parameter and the quantity of the extended feature data; The extended feature data are sorted in descending order of importance, and the second number of extended feature data that are ranked first are selected to obtain multiple first feature data.

6. The method according to claim 5, characterized in that, The step of performing correlation analysis on the plurality of first feature data based on the label data, and determining a plurality of second feature data from the plurality of first feature data according to the processing results of the correlation analysis, includes: Based on the label data, a correlation analysis is performed on the plurality of first feature data, and the correlation between the plurality of first feature data and the label data is determined according to the processing results of the correlation analysis. The third quantity is calculated based on the second selection parameter and the quantity of the first feature data; The multiple first feature data are sorted in descending order of relevance, and the third number of first feature data at the top of the sort is selected to obtain multiple second feature data.

7. The method according to claim 1, characterized in that, The step of determining multiple candidate feature data from the multiple second feature data based on the correlation between the multiple second feature data to obtain a candidate feature data set corresponding to the intrusion detection sample includes: Calculate the mutual information between the plurality of second feature data respectively, and construct a mutual information set corresponding to the second feature data based on the mutual information; Calculate the sum of multiple mutual information in the mutual information set corresponding to the second feature data to obtain the target mutual information corresponding to the second feature data; Based on the target mutual information, multiple candidate feature data are determined from the multiple second feature data to obtain a set of candidate feature data corresponding to the intrusion detection sample.

8. The method according to claim 7, characterized in that, The step of determining multiple candidate feature data from the multiple second feature data based on the target mutual information to obtain a candidate feature data set corresponding to the intrusion detection sample includes: Obtain a third selection parameter, and calculate a fourth quantity based on the third selection parameter and the quantity of the second feature data; The multiple second feature data are sorted in descending order of target mutual information, and the fourth number of second feature data at the top of the sort is selected to obtain a candidate feature data set containing multiple candidate feature data.

9. A network intrusion detection method, characterized in that, The method includes: Obtain network data packets to be detected, wherein the network data packets have the same data structure as the intrusion detection data in any of the feature rule extraction methods of claims 1 to 8; Feature extraction is performed on the network data packets to obtain multiple features to be detected; The feature processing rule is obtained, wherein the feature processing rule is the target feature extension rule extracted by any one of the feature rule extraction methods in claims 1 to 8; The target detection features are obtained by performing feature processing on the multiple features to be detected using the aforementioned feature processing rules. A preset neural network model is used to perform network intrusion detection on the target detection features to obtain the detection results.

10. A feature rule extraction device, characterized in that, The device includes: The first acquisition module is used to acquire multiple intrusion detection samples, the intrusion detection samples including intrusion detection data and tag data, the intrusion detection data including multiple feature data; The extension module is used to extend the multiple feature data according to various feature extension rules to obtain multiple extended feature data. The selection module is used to select multiple candidate feature data from the multiple extended feature data according to the importance of the extended feature data to the tag data and the correlation between the extended feature data, so as to obtain a set of candidate feature data corresponding to the intrusion detection sample. The clustering module is used to perform clustering processing on the multiple candidate feature data sets corresponding to the multiple intrusion detection samples to obtain multiple cluster centers; The calculation module is used to calculate the center offset value of the candidate feature data in the candidate feature data set. The center offset value is positively correlated with the offset distance, which is the distance between the candidate feature data and the corresponding cluster center. The determination module is used to determine the target feature data in the candidate feature data set based on the center offset value; The second acquisition module is used to acquire the feature expansion rule corresponding to the target feature data as the target feature expansion rule, and the target feature expansion rule is used to expand the features of the network data packet to be detected. The selection module is specifically used for: Principal component analysis is performed on the multiple extended feature data based on the label data, and multiple first feature data are determined from the multiple extended feature data according to the processing results of the principal component analysis. Based on the label data, a correlation analysis is performed on the plurality of first feature data, and a plurality of second feature data are determined from the plurality of first feature data according to the processing results of the correlation analysis. Based on the correlation between the multiple second feature data, multiple candidate feature data are determined from the multiple second feature data to obtain a set of candidate feature data corresponding to the intrusion detection sample.

11. A network intrusion detection device, characterized in that, The device includes: The third acquisition module is used to acquire network data packets to be detected, wherein the network data packets have the same data structure as the intrusion detection data in any of the feature rule extraction methods of claims 1 to 8; The extraction module is used to extract features from the network data packets to obtain multiple features to be detected; The fourth acquisition module is used to acquire feature processing rules, wherein the feature processing rules are target feature extension rules extracted by any one of the feature rule extraction methods in claims 1 to 8; The processing module is used to perform feature processing on the plurality of features to be detected using the feature processing rules to obtain target detection features; The detection module is used to perform network intrusion detection on the target detection features using a preset neural network model, and obtain the detection results.

12. A computer device, characterized in that, The computer device includes a memory and a processor. The memory stores a computer program, and when the processor executes the computer program, it implements the feature rule extraction method of any one of claims 1 to 8 or the network intrusion detection method of claim 9.

13. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the feature rule extraction method according to any one of claims 1 to 8 or the network intrusion detection method according to claim 9.

Images