Convolutional bidirectional long short-term memory network intrusion detection method based on data enhancement

Abstract

The application discloses a data enhancement-based convolutional bidirectional long short-term memory network intrusion detection method, which comprises the following steps: acquiring an intrusion detection data set; performing sample expansion processing on the preprocessed intrusion detection data set by means of an improved DBSCAN clustering algorithm and an improved WGAN; performing feature selection processing on the expanded intrusion detection data set by means of a random forest algorithm combined with Pearson correlation coefficient analysis, and then performing feature extraction processing; performing weight processing on the feature vectors of the intrusion detection data set by means of a feature attention enhancement model; and performing classification processing on the feature of the intrusion detection data set after weight processing by means of a CNN-BiLSTM. The application improves the multi-classification accuracy of the model and the detection accuracy of rare-class attack samples by constructing a data enhancement and convolutional bidirectional long short-term memory network. The application can be widely applied to the field of information security technology.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to an intrusion detection method based on data augmentation convolutional bidirectional long short-term memory networks. Background Technology

[0002] Cyberattacks have become a significant challenge for internet security. More and more organizations and enterprises need to take measures to protect their information systems and network resources from attacks. Intrusion detection technology (IDT), as an important cybersecurity technology, can monitor and analyze abnormal network traffic in real time, helping organizations and enterprises to promptly detect and respond to cyberattacks. The development of IDT can be traced back to the 1980s, when it was primarily rule-based. This technology mainly identifies and reports attack behaviors by pre-defining rules; however, it can only detect known attack types and cannot effectively deal with unknown attacks. With the rapid increase in the number of internet users and the booming development of various emerging internet applications, network traffic has exploded, making the current network environment complex and volatile. Relying on traditional methods and rule-based data warehouse updates is insufficient to adapt to this changing network environment and cannot guarantee network security.

[0003] Traditional machine learning and deep learning are the two main techniques in the field of intrusion detection. Both can be used to analyze network traffic and system logs to identify abnormal network traffic and discover potential attacks. Traditional machine learning typically employs classic classifier algorithms such as KNN, Bayesian network models, support vector machines, artificial neural networks, random forests, and decision trees. These algorithms require training on historical data to build models, which are then used to classify new data. In intrusion detection, these algorithms often require data preprocessing techniques to extract features from network traffic and system logs, such as packet size, protocol type, and source address. Using these features, machine learning algorithms can distinguish between normal and abnormal traffic, classifying abnormal traffic as attacking or non-attacking. However, traditional machine learning algorithms have limited effectiveness in handling high-dimensional and complex data and require extensive manual feature engineering, resulting in problems with feature selection and model generalization ability. Deep learning, on the other hand, learns complex feature representations by constructing multi-layered neural networks, offering strong automation. In intrusion detection, deep learning's feature learning capability allows it to directly process raw network traffic and system log data. Through multi-layered convolutional neural networks, recurrent neural networks, and other models, it learns and classifies data to identify potential attack behaviors. Deep learning technology overcomes the problem of manually designing features required in traditional machine learning algorithms, significantly reducing the complexity and labor costs of feature engineering. Many researchers have introduced it into the field of intrusion detection, with models including recurrent neural networks, autoencoders, deep neural networks, deep belief networks, convolutional neural networks, and long short-term memory. Despite significant progress in intrusion detection using deep learning, existing deep learning technologies also have the following problems: First, feature redundancy—more feature dimensions not only increase model training time but also reduce detection performance. Second, the datasets used to evaluate model effectiveness suffer from imbalanced positive and negative class samples. Third, current models are often too simplistic, making it difficult to extract features from various attack types, leading to low accuracy in multi-class intrusion detection. Fourth, low accuracy in detecting rare attack samples. Summary of the Invention

[0004] To address the aforementioned technical problems, the present invention aims to provide an intrusion detection method based on data augmentation and a convolutional bidirectional long short-term memory network. By constructing a method that integrates data augmentation and a convolutional bidirectional long short-term memory network, the accuracy of the model in multi-class classification and the detection accuracy for rare class attack samples are improved.

[0005] The first technical solution adopted in this invention is: an intrusion detection method based on data augmentation convolutional bidirectional long short-term memory networks, comprising the following steps:

[0006] Obtain the intrusion detection dataset, convert non-numerical features to numerical features, and perform one-hot encoding and minimum-maximum normalization to obtain the preprocessed intrusion detection dataset.

[0007] An improved density-based noise-based spatial clustering algorithm and an improved generative adversarial network are used to augment the preprocessed intrusion detection dataset, resulting in an augmented intrusion detection dataset.

[0008] The feature vector of the intrusion detection dataset is obtained by performing feature selection processing on the expanded intrusion detection dataset using the random forest algorithm combined with Pearson correlation coefficient analysis and then performing feature extraction processing.

[0009] An improved DBSCAN module is introduced, which assigns weights to the feature vectors of the intrusion detection dataset through a feature attention enhancement model, resulting in weighted features of the intrusion detection dataset.

[0010] The features of the intrusion detection dataset after weighting are classified by a convolutional bidirectional long short-term memory network to obtain classification results, which include normal traffic samples and attack type traffic samples.

[0011] Furthermore, the step of augmenting the preprocessed intrusion detection dataset with an improved density-based noise-based spatial clustering algorithm and an improved generative adversarial network to obtain an augmented intrusion detection dataset specifically includes:

[0012] We introduce weighted Manhattan distance, construct an improved density-based noise-based spatial clustering algorithm, and perform computation on the preprocessed intrusion detection dataset to obtain the clusters and outliers corresponding to the preprocessed intrusion detection dataset.

[0013] The clusters in the preprocessed intrusion detection dataset include minority cluster samples and majority cluster samples;

[0014] The minority cluster samples in the preprocessed intrusion detection dataset are oversampled by an improved generative adversarial network WGAN, and the distance between the generator and discriminator in WGAN is measured by the Wasserstein distance to obtain the expanded minority cluster samples.

[0015] The expanded minority cluster samples are added to the preprocessed intrusion detection dataset to obtain the expanded intrusion detection dataset.

[0016] Furthermore, the step of introducing weighted Manhattan distance, constructing an improved density-based noise-based spatial clustering algorithm, and performing computational processing on the preprocessed intrusion detection dataset to obtain the clusters and outliers corresponding to the preprocessed intrusion detection dataset specifically includes:

[0017] For each feature in the preprocessed intrusion detection dataset, calculate its Pearson correlation coefficient with the target variable, which is the attack traffic sample.

[0018] The obtained Pearson correlation coefficients are subjected to min-max normalization and mapped to the range of [0,1] to obtain normalized correlation coefficients;

[0019] The normalized correlation coefficient is used as the feature weight in the preprocessed intrusion detection dataset;

[0020] The weighted Manhattan distance between traffic data is calculated based on the feature weights in the preprocessed intrusion detection dataset. Traffic data with distance values ​​greater than a preset threshold are discarded, and the distance values ​​corresponding to traffic data that meet the preset distance values ​​are stored to obtain a distance matrix.

[0021] Determine the neighborhood radius, calculate the number of traffic data samples within the neighborhood radius in the distance matrix, and define the traffic data sample as the core point if the calculated number of traffic data samples is greater than or equal to the preset number.

[0022] Repeat the above steps to determine the core points until all traffic data samples have been traversed. Classify the obtained core points to obtain clusters.

[0023] Non-core points are marked as noise points and classified as outliers.

[0024] Furthermore, the step of performing feature selection processing on the expanded intrusion detection dataset using the random forest algorithm combined with Pearson correlation coefficient analysis, followed by feature extraction processing to obtain the feature vector of the intrusion detection dataset, specifically includes:

[0025] The expanded intrusion detection dataset was selected to obtain the feature set and target variables;

[0026] Calculate the Pearson coefficient between each feature in the feature set and the target variable, and sort them in descending order of absolute value to obtain the sorted sequence;

[0027] The K features most strongly correlated with the target variable are selected as the candidate feature set based on the sorting sequence, where K is a pre-defined condition number.

[0028] The candidate feature set is input into the random forest model for training, and the importance score of each feature in the random forest model is obtained.

[0029] The top N features with the highest importance scores are selected as the final feature set to train the random forest model, and the performance of the trained random forest model is evaluated.

[0030] If the performance of the trained random forest model does not meet the preset requirements, the K value is reset and the random forest model training steps are repeated until the performance of the random forest model meets the preset requirements, and the final random forest model is output.

[0031] Based on the final random forest model, feature selection is performed on the expanded intrusion detection dataset to obtain the feature data of the intrusion detection dataset.

[0032] The feature data of the intrusion detection dataset is preprocessed to obtain the feature vector of the intrusion detection dataset.

[0033] Furthermore, the step of preprocessing the feature data of the intrusion detection dataset to obtain the feature vector of the intrusion detection dataset specifically includes:

[0034] The feature data of the intrusion detection dataset is converted to grayscale to obtain the feature data of the converted intrusion detection dataset.

[0035] Spatial features of the intrusion detection dataset are extracted from the feature data of the transformed intrusion detection dataset using a two-dimensional convolutional neural network.

[0036] The spatial features of the intrusion detection dataset are integrated using a max pooling layer to obtain the feature vector of the intrusion detection dataset.

[0037] Furthermore, the step of introducing the improved DBSCAN module, which assigns weights to the feature vectors of the intrusion detection dataset through a feature attention enhancement model to obtain the weighted features of the intrusion detection dataset, specifically includes:

[0038] An improved DBSCAN module is introduced to construct a feature attention enhancement model, which includes convolutional layers, pooling layers, an improved DBSCAN module, fully connected layers, reshaping layers, channel attention modules, and spatial attention modules.

[0039] Based on the convolutional and pooling layers of the feature attention enhancement model, the feature vectors of the intrusion detection dataset are processed by convolutional pooling to obtain the feature map of the intrusion detection data.

[0040] The improved DBSCAN module, based on the feature attention enhancement model, performs cluster attention calculation on the feature map of intrusion detection data to obtain the cluster attention vector matrix.

[0041] Based on the fully connected layer and reshaping layer of the feature attention enhancement model, the cluster attention vector matrix is ​​processed by fully connected layer and reshaping layer in sequence to obtain the first attention vector and the second attention vector.

[0042] The first attention vector and the second attention vector are input into the channel attention module and the spatial attention module, respectively, to obtain the corresponding channel attention vector and spatial attention vector;

[0043] Multiply the channel attention vector and spatial attention vector together, and then multiply them together with the cluster attention vector matrix to obtain the weighted features of the intrusion detection dataset.

[0044] Furthermore, the improved DBSCAN module specifically includes an adaptive weighted average pooling layer, an adaptive weighted max pooling layer, a fully connected layer, a convolutional layer, a spatial attention layer, and skip connections, wherein:

[0045] Based on the improved DBSCAN module, an adaptive weighted average pooling layer and an adaptive weighted max pooling layer are used to perform weighted average pooling and weighted max pooling operations on the input data, respectively.

[0046] Based on the fully connected layer of the improved DBSCAN module, the weighted average pooling operation result and the weighted max pooling operation result are weighted and concatenated to obtain the weighted result;

[0047] The weighted results are convolutionally processed by the convolutional layer based on the improved DBSCAN module to obtain the corresponding convolutional results.

[0048] The skip connection based on the improved DBSCAN module directly weights the input data with the corresponding convolution results to obtain the final weighted result;

[0049] Feature extraction is performed on the final weighted result using a spatial attention layer based on the improved DBSCAN module.

[0050] Furthermore, the step of classifying the weighted features of the intrusion detection dataset using a convolutional bidirectional long short-term memory network to obtain the classification result specifically includes:

[0051] The weighted features of the intrusion detection dataset are input into a convolutional bidirectional long short-term memory network, which includes a CNN neural network, a bidirectional long short-term memory neural network, and a softmax function.

[0052] Based on the CNN neural network of the convolutional bidirectional long short-term memory network, spatial extraction processing of data traffic features is performed on the features of the intrusion detection dataset after weighting to obtain the spatial features of the intrusion detection dataset.

[0053] Based on the convolutional bidirectional long short-term memory network, the bidirectional long short-term memory neural network performs time-based data flow feature extraction processing on the weighted features of the intrusion detection dataset to obtain the time features of the intrusion detection dataset.

[0054] The spatial features of the intrusion detection dataset are combined with the temporal features of the intrusion detection dataset, and the classification is performed using the softmax function to obtain the classification result.

[0055] The beneficial effects of the method of this invention are as follows: This invention uses a density-based noise-applied spatial clustering algorithm and an improved generative adversarial network to augment the intra-cluster samples in each rare class of data samples, ultimately achieving a balanced dataset and solving the problem of imbalance between positive and negative class samples in the dataset. It introduces a random forest algorithm combined with Pearson correlation coefficient analysis for feature selection, solving the feature redundancy problem. Furthermore, it uses a convolutional neural network to extract spatial features from network data traffic, leveraging its weight-sharing characteristic to improve speed. It introduces a bidirectional long short-term memory network to extract temporal features, learn the dependencies between features, avoid overfitting, and improve the multi-class classification accuracy of the model. It introduces an improved attention mechanism, CBAM-AS, to assign different weights to features, thereby reducing overhead and improving model performance, enhancing detection accuracy and generalization ability. This invention solves the problems of imbalance between positive and negative class samples, feature redundancy, low multi-class classification accuracy, and low detection accuracy for rare class attack samples in existing datasets. It also alleviates the gradient vanishing problem, has higher computational efficiency, and enhances the model's generalization ability and robustness. Attached Figure Description

[0056] Figure 1 This is a flowchart of the steps of the intrusion detection method based on data augmentation convolutional bidirectional long short-term memory network of the present invention;

[0057] Figure 2 This is a flowchart of the steps involved in generating data samples using the DB-WGANS algorithm of this invention;

[0058] Figure 3 This is a schematic diagram of the existing DBSCAN algorithm steps;

[0059] Figure 4 This is a schematic diagram of the existing attention module structure;

[0060] Figure 5 This is a schematic diagram of the existing spatial attention module;

[0061] Figure 6 This is a schematic diagram of the improved spatial attention module of the present invention;

[0062] Figure 7 This is a schematic diagram of the CBAMAS-DBSCAN model structure constructed in this invention;

[0063] Figure 8 This is a schematic diagram of the CNN neural network structure of the present invention;

[0064] Figure 9 This is a schematic diagram of the LSTM unit of the present invention;

[0065] Figure 10 This is a schematic diagram of the bidirectional long short-term memory neural network of the present invention. Detailed Implementation

[0066] The present invention will now be described in further detail with reference to the accompanying drawings and specific embodiments. The step numbers in the following embodiments are only for ease of explanation and do not limit the order of the steps. The execution order of each step in the embodiments can be adapted according to the understanding of those skilled in the art.

[0067] Reference Figure 1 This invention provides an intrusion detection method based on data augmentation convolutional bidirectional long short-term memory networks, which includes the following steps:

[0068] S1. For the original dataset, convert non-numerical features into numerical features and perform one-hot encoding and minimum-maximum normalization.

[0069] S2. The proposed DB-WGAN method is used to generate samples for the minority class in the preprocessed dataset, and a new dataset is obtained after data augmentation.

[0070] Specifically, current intrusion detection datasets such as KDD99, NSL-KDD, UNSW-NB15, and CIC-IDS 2017 contain far more normal traffic than abnormal traffic, resulting in an extremely imbalanced data sample classification, which can easily lead to overfitting.

[0071] This invention uses density-based noise applied spatial clustering (DBSCAN) and an improved generative adversarial network (WGAN) to augment samples, generate rare class attack samples, and balance the dataset.

[0072] DBSCAN is a density-based clustering algorithm that can automatically identify data points with high-density regions and divide them into clusters. DBSCAN can handle clusters of arbitrary shapes and can effectively identify and filter out noise points.

[0073] In DBSCAN, density is defined by two parameters: Eps and the minimum number of points (MinPts). Eps represents the neighborhood radius. If the number of points within the radius is greater than or equal to MinPts, the data point is a core point; if the number of points within the radius is less than MinPts, the data point is a noise point; if the number of points within the radius is greater than or equal to MinPts, but the point is not a core point, the point is a boundary point.

[0074] The existing DBSCAN algorithm process is as follows, refer to Figure 3 :

[0075] (1) Randomly select an unvisited data point p;

[0076] (2) Calculate all points in the neighborhood of data point p. If the number of points in the neighborhood is greater than or equal to MinPts;

[0077] (3) Then mark it as the core point and add all points in the neighborhood to a new cluster;

[0078] (4) If the number of points in the neighborhood is less than MinPts, then p is marked as a noise point; if the number of points in the neighborhood is greater than or equal to MinPts, but p is not a core point, then p is marked as a boundary point.

[0079] (5) For a new cluster, continue to expand the cluster until all points in the neighborhood have been visited;

[0080] (6) Repeat the above steps until all data points have been accessed.

[0081] The improved DBSCAN algorithm of this invention is as follows;

[0082] We use weighted Manhattan distance to calculate the distance between each sample and other samples, and then prune the samples based on the weighted distance and store them in the distance matrix. We determine whether a sample is a core point by calculating the number of samples within the radius of eps. This avoids repeated neighborhood search for each sample, thereby improving computational efficiency.

[0083] Traditional distance calculation formulas typically use Euclidean distance or Manhattan distance. This invention, by introducing weights for each feature when calculating the Manhattan distance, effectively avoids the impact of noise on clustering accuracy. The feature weights are obtained by calculating and normalizing the Pearson coefficients. The specific steps are as follows:

[0084] (1) For each feature in the dataset, calculate its Pearson correlation coefficient ρ with the target variable (i.e., whether it is an attack);

[0085]

[0086] (2) Map the correlation coefficients to the range [0,1] using min-max normalization, and use each normalized correlation coefficient as the weight W of that feature. i ;

[0087]

[0088] (3) Calculate the weighted Manhattan distance between each sample and other samples. By setting a distance threshold, data points with distances greater than the threshold will be removed. Finally, the distances will be stored in a distance matrix.

[0089] The formula for weighted Manhattan distance is:

[0090]

[0091] In the above formula, W i Let |x| be the weight of the i-th feature. i -y i | is the absolute value of the difference between two samples on the i-th feature;

[0092] (4) For each sample, count the number of samples within the radius of eps from the distance matrix. If the number is greater than or equal to Minpts, then the sample is marked as a core point.

[0093] (5) For each core point, find all samples within the radius of eps and add them to the neighborhood of the core point. All samples located in the neighborhood of the core point are classified into the same cluster.

[0094] (6) Repeat step (5) until no new sample can be added to the neighborhood;

[0095] (7) Non-core points are marked as noise points.

[0096] The improved DBSCAN algorithm of this invention can better reflect the similarity between data points compared with the traditional DBSCAN method. Traditional distance calculation does not take into account the weight difference between different samples. Using weighted Manhattan distance can introduce different weight coefficients for different samples, better consider the importance between different features, and effectively avoid the impact of noise on clustering accuracy. Each cluster is composed of samples with high correlation, which improves the accuracy of clustering.

[0097] Traditional DBSCAN methods require calculating every core point and searching all points to determine if they are within the neighborhood. Each time a core point is found, all points need to be recalculated, resulting in low efficiency and wasted computing resources. This method calculates distances, prunes them, and stores the results in a matrix. A sample is considered a neighbor only when its weighted distance to other samples is less than a threshold, improving efficiency and accuracy. Determining whether a sample is a core point only requires finding the sample in the distance matrix and counting its number; there's no need to recalculate and search for neighboring points. This allows for rapid core point identification, avoiding the need for a neighborhood search for every sample in traditional methods. This effectively reduces computational load and increases clustering speed. Furthermore, for samples with identified core points, only samples within the neighborhood need to be considered during the neighborhood search, further accelerating computation, reducing resource waste, and improving clustering efficiency.

[0098] The improved DBSCAN algorithm of this invention uses weighted Manhattan distance to calculate distances, which can improve the accuracy of clustering. By pruning based on a distance threshold and storing the results in a distance matrix, it reduces related distance calculations, speeds up clustering convergence time, and thus improves clustering efficiency.

[0099] Generative Adversarial Networks (GANs) are a powerful class of generative models that transform generative modeling into a game between two networks: a generator (G) network produces synthetic data from a given noise source, while a discriminator (D) network distinguishes the generator's output from the real data. The game between the generator and the discriminator serves as the model's objective function, expressed as follows:

[0100] min G max D V(D,G)=E x～pdata(x) [logD(x)]-E z～pz(z) [log(1-D(G(z)))]

[0101] In the above formula, P_data(x) represents the distribution of the real sample, P_z represents the distribution of the noise variable, G(z) represents the function that maps the noise to the data space, x ~ G(z), and D(x) represents the probability that sample x is real data;

[0102] This invention uses WGAN, or Wasserstein GAN, which is an improved version of Generative Adversarial Network (GAN) designed to overcome some of the problems existing in traditional GAN. WGAN improves the training and performance of GAN by introducing a new objective function, namely Wasserstein distance.

[0103] In traditional GANs, the training between the generator and the discriminator is accomplished by minimizing the Jensen-Shannon divergence (JS divergence). However, JS divergence has some problems during training, such as gradient vanishing and mode collapse. In contrast, Wasserstein distance is more stable and can avoid these problems.

[0104] Wasserstein distance is a distance metric used to measure the difference between two distributions. It can better describe the geometric features between distributions. Therefore, using Wasserstein distance in GAN can more accurately measure the distance between the generator and the discriminator, thereby improving the training stability and generation quality of GAN.

[0105] The training process of WGAN is similar to that of traditional GANs, but it uses Wasserstein distance to measure the distance between the generator and the discriminator. In WGAN, the discriminator no longer outputs a probability value between 0 and 1, but instead outputs a real number representing the distance between the samples generated by the generator and the real data. Then, the generator is updated to minimize this distance, rather than minimizing the JS divergence. Wasserstein distance is also called Earth-Mover (EM) distance, and is defined as follows:

[0106] min G max D V(D,G)=E x～pdata(x) [D(x)]-E z～pz(z) [D(G(z))]-λ·penalty

[0107] In the above formula, D(x) represents the output of the discriminator to the real sample, D(G(z)) represents the output of the discriminator to the sample G(z) generated by the generator, penalty represents the gradient penalty term, and λ is a hyperparameter used to control the degree of influence of the gradient penalty term;

[0108] The goal of the discriminator is to maximize the output value of D(x) while minimizing the output value of D(G(z)) to accurately distinguish between real and generated samples. The gradient penalty term is used to force the output function of the discriminator to satisfy the Lipschitz continuity condition, thereby ensuring the differentiability and boundedness of the Wasserstein distance.

[0109] Reference Figure 2 The specific steps for generating data samples using the DB-WGANS algorithm are as follows:

[0110] (1) First, the original dataset needs to be preprocessed, including one-hot encoding, minimum-maximum normalization and other operations;

[0111] (2) Apply the DBSCAN algorithm to the preprocessed dataset to obtain clusters and outliers;

[0112] (3) For samples in the minority class, WGAN is used for oversampling to generate more minority class samples. WGAN uses a generator network to generate new data samples;

[0113] (4) Add the generated new data samples to the original dataset to expand and balance the dataset.

[0114] S3. Use the PRF algorithm, the random forest algorithm combined with Pearson correlation coefficient analysis to calculate the importance of features and perform feature selection. Then convert the obtained feature data into grayscale images.

[0115] Specifically, feature selection refers to selecting the most representative subset of features from the original data in order to build an efficient machine learning model. This invention uses the random forest algorithm combined with Pearson correlation coefficient analysis for feature selection, which reduces data dimensionality, solves the problem of feature redundancy, improves the generalization ability and prediction performance of the model, and at the same time reduces the computational load and storage space of the model, and reduces the training time of the model.

[0116] The Pearson correlation coefficient measures the correlation between two variables X and Y, with a value ranging from -1 to 1. It is calculated by taking the covariance and standard deviation between the two eigenvalues ​​and using the following formula:

[0117]

[0118] The Pearson correlation coefficient varies between -1 and 1. If the Pearson correlation coefficient is close to ±1, it indicates that the correlation between the two features is very high and this relationship can be well represented by a linear equation. If the Pearson correlation coefficient is close to zero, it indicates that there is no linear relationship between the two features.

[0119] Random Forest (RF) is an ensemble learning algorithm that uses decision trees as the base learner. In feature engineering, RF can identify important features from a large number of sample features. The essence of this algorithm is to analyze and calculate the contribution of each feature of a sample in the tree, then calculate their average and compare the contributions between features to identify important features. This invention uses out-of-bag error rate as the evaluation metric.

[0120] The steps of the random forest algorithm are as follows:

[0121] (1) For each basic learner, select the corresponding out-of-bag data (some remaining unselected samples), calculate its error, and denot it as error_a;

[0122] (2) Randomly add perturbation to the full sample of out-of-bag data, calculate its error, and denot it as error_b;

[0123] (3) Assuming there are M trees in the forest, the Importance value of a certain feature is as follows:

[0124]

[0125] Therefore, the specific steps for feature selection in this invention are as follows:

[0126] (1) Select the feature set and target variable from the original data;

[0127] (2) Calculate the Pearson coefficient between each feature in the feature set and the target variable, and sort them in descending order of absolute value;

[0128] (3) Select the top K features that are most strongly correlated with the target variable as the candidate feature set, where K can be set according to the actual situation;

[0129] (4) Train a random forest model using the candidate feature set and calculate the importance score of each feature in the model;

[0130] (5) Sort the features from highest to lowest importance score and select the top N features as the final feature set, where N can be set according to the actual situation;

[0131] (6) Train the model using the final feature set and evaluate its performance. If the performance is still not good enough, return to step (3), adjust the K value, and reselect the candidate feature set;

[0132] S4. Spatial features are extracted from the input data through a two-dimensional convolutional neural network, and then the spatial features are integrated through a max pooling layer. After the data is processed by this layer, the amount of data computation is greatly reduced and the efficiency of the model is improved.

[0133] S5 and DB-CBAM-AS use more efficient and accurate clustering data to further extract key spatial features, making the feature representation more accurate. This allows the model to focus more on important clusters and reduce the attention weight of noisy points or smaller clusters, thus making the model's attention more refined and alleviating the gradient vanishing problem.

[0134] Specifically, CBAM is an attention mechanism that can be added to convolutional neural networks (CNNs) to improve their performance on image recognition tasks. The CBAM module includes two types of attention mechanisms: spatial attention and channel attention. Spatial attention focuses on which regions of the input image are important for prediction, while channel attention focuses on which channels of the feature map are important for prediction, such as... Figure 4 and Figure 5 The image shows a traditional attention module;

[0135] Reference Figure 6 The improved spatial attention module of this invention is expressed as follows:

[0136]

[0137] Among them, skip connection is a technique that connects directly from one layer to the next, which can pass information from the previous layer and help alleviate the problems of gradient vanishing or gradient exploding; adaptive pooling is a pooling operation that can weight features at different positions according to the importance of the input feature map at different positions.

[0138] This invention proposes applying adaptive weighted pooling and skip connections to the spatial attention channel of CBAM (Concurrently Continuous Learning Aspect-Oriented Model), better adapting to inputs of different dimensions. Adaptive weighted average pooling and adaptive weighted max pooling are used to calculate the weights of each channel. Specifically, in the spatial attention module: during forward propagation, adaptive average pooling and adaptive max pooling are first performed on the input feature map. Then, appropriate weights are applied in the fully connected layer for weighting. Finally, the weighted results are concatenated and output to the convolutional layer for convolution and weighting operations. Skip connections are introduced at the end to make the network deeper, enabling it to capture more abstract and complex features, improving feature extraction capabilities, thereby increasing the model's accuracy and robustness, and alleviating the gradient vanishing problem that occurs during training in traditional CBAM. Weighted adaptive pooling can better capture spatial features and further improve model performance, achieving higher computational efficiency and enhancing the model's generalization ability.

[0139] This invention creatively proposes a method for enhancing the model through feature attention: DB-CBAM-AS. It improves the CBAM-AS model by adding an improved DBSCAN module to process the input features. After passing through a fully connected layer, the weights of each cluster are obtained and transformed into a vector matrix. This weight matrix is ​​then used as the attention input for CBAM. In channel attention, the cluster weights are weighted as global weights with the input feature map, thereby changing the importance of each channel. In spatial attention, the cluster weights are weighted as spatial attention weights with the input feature map, reflecting the importance of different spatial locations. This achieves better feature extraction and parallel computation of channel and spatial attention. Figure 7 This is a schematic diagram of the DB-CBAM-AS model of the present invention;

[0140] The control method of the DB-CBAM-AS model of the present invention is as follows:

[0141] (1) The input feature map is processed through convolutional and pooling layers to obtain feature map F;

[0142] (2) Input F into the improved DBSCAN clustering module to calculate the attention vector A for each cluster. i The cluster attention vector can be viewed as the attention weights of the cluster, and all cluster attention vectors A are considered. i Connecting these matrices yields a cluster attention vector matrix A, as shown in the following formula:

[0143]

[0144]

[0145]

[0146] Assume the i-th cluster has n i There are data points, with feature dimensions d and x. ij c represents the feature vector of the j-th data point in the i-th cluster. i Let s represent the eigenvector of the i-th cluster. ij A represents the cosine similarity between the j-th data point in the cluster and the feature vector. i This represents the attention vector of the i-th cluster, where softmax is used to normalize the vector, and the normalized similarity vector is used as the attention vector of the cluster.

[0147] (3) Input A into a fully connected layer, and according to the order of the clusters, match it with the order of the input data to obtain an attention vector A′. Then, after passing through the reshaping layer, it is reshaped into A′_c and A′_s.

[0148] (4) Input A′_c and A′_s into the channel attention module and the spatial attention module respectively to obtain the corresponding channel attention vector C and spatial attention vector S, the expression of which is:

[0149]

[0150]

[0151] In the above formula, The plus sign indicates element-wise multiplication, and the plus sign indicates feature addition.

[0152] (5) Multiply C and S to obtain the final attention vector f, which is expressed as:

[0153]

[0154] (6) Multiply the attention weights obtained from the improved DBSCAN with the attention weights f obtained from CBAM-AS to obtain the weighted feature map F′, the expression of which is:

[0155]

[0156] In the final input data, data points from different clusters are assigned different weights. Simultaneously, the attention mechanism in the CBAM-AS model also weights the input data. This method offers better feature representation, and the improved DBSCAN clusters data more efficiently and accurately. Combining improved spatial attention within CBAM further extracts key spatial features, resulting in more accurate feature representation. This allows the model to focus more on important clusters while reducing the attention weight for noisy points or smaller clusters, thus refining the model's attention and improving the accuracy and robustness of intrusion detection. Furthermore, this model structure can adaptively adjust clustering parameters, effectively clustering different datasets, making the model more adaptable and mitigating the gradient vanishing problem.

[0157] S6. After the MaxPooling layer comes the Batch Normalization layer, which normalizes the parameters between intermediate layers to prevent training time from slowing down.

[0158] S7. Next, the Bi-LSTM layer is used to extract the temporal features of the data. The CNN structure is more effective in extracting the spatial features of data flow, but its ability to extract long-distance related information is generally limited. The BiLSMT structure is more effective in extracting long-distance dependency information. Combining the two can improve the model's ability to learn features and fully extract features from both spatial and temporal dimensions, thereby achieving higher classification and detection accuracy.

[0159] Specifically, Convolutional Neural Network (CNN) is a commonly used neural network structure, particularly suitable for processing image and video data. The main idea of ​​CNN is to extract features from images through convolution operations, then reduce the size of the feature maps through pooling operations, and finally achieve tasks such as classification or regression through fully connected layers. CNN has the characteristics of local connectivity and weight sharing, which can greatly reduce the number of network parameters and improve the training speed and generalization ability of the network. In recent years, CNN has achieved many successful applications in fields such as image classification, object detection, face recognition, and natural language processing.

[0160] Reference Figure 8 The advantages of using Conv2D layers in this invention are as follows: First, parameter sharing. In convolutional neural networks, the weights of each convolutional kernel are shared with every part of the entire image. This parameter sharing reduces the number of parameters that need to be learned and effectively improves the generalization ability of the model. Second, Conv2D layers can share information between different regions of the input image, preserving the spatial structure of the input image rather than treating it as one-dimensional data. This preservation of spatial information helps convolutional neural networks capture local patterns and features in the image. The convolutional operations used by Conv2D layers have locality, meaning that each element in the output depends only on the corresponding local region in the input. This locality allows the computation of Conv2D layers to be highly parallelized, thereby improving the speed of model training and inference. Finally, data augmentation. Conv2D layers are often used in conjunction with other layers (such as pooling layers and normalization layers). These layers can increase the diversity of training data through random scaling, rotation, and translation, thereby preventing overfitting and improving the generalization ability of the model.

[0161] Pooling refers to the max pooling layer, a common layer type in neural networks. It typically follows a convolutional layer and is used to downsample the feature map output by the convolutional layer. The main function of the pooling layer is to reduce the size of the feature map and extract its main features. Common pooling operations include max pooling and average pooling, which respectively take the maximum or average value of each small region in the feature map as the output. This invention uses max pooling.

[0162] Fully connected layers are a common type of layer in neural networks. They connect all neurons in the previous layer to all neurons in the current layer, with each connection having a learnable weight parameter. The main function of a fully connected layer is to transform the feature information from the previous layer into a higher-level feature representation in the current layer, thereby extracting more abstract and complex feature information. During training, the weight parameters of the fully connected layer are backpropagated according to the loss function, enabling the model to adaptively learn appropriate feature representations.

[0163] Dropout is a common regularization method in neural networks. During each training session, some neurons are randomly dropped with a certain probability. Dropout can help reduce the risk of overfitting, improve the model's generalization ability, and does not require additional parameters or computation.

[0164] A typical LSTM unit consists of three gated units: a forget gate, an input gate, and an output gate, as well as a memory unit. The forget gate and input gate determine which information to forget or input into the memory unit based on the current input and the hidden state from the previous time step. The output gate calculates the output value based on the current input and the memory unit. The entire process can be represented as follows: Figure 9 As shown;

[0165] Its expression is:

[0166] f t =(W f ·[h t-1 ,x t ]+b f )

[0167] i t =tanh(W i ·[h t-1 ,x t ]+b i )

[0168] C t =tanh(W C ·[h t-1 ,x t ]+b C )

[0169] C t =f t *C t-1 +i t *C t o t =(W o [h t-1 ,x t ]+b o )

[0170] h t =o t *tanh(C t )

[0171] In the above formula, f, i, t, o, h, C, W, and b represent forgetting, input, time step, output layer, hidden layer, cell state, weight matrix, and bias, respectively.

[0172] Reference Figure 10Bidirectional Long Short-Term Memory (BiLSTM) is a commonly used recurrent neural network architecture, particularly suitable for processing sequential data. It adds a backward-facing layer to the LSTM, allowing the network to consider both past and future information of the sequence simultaneously. In traditional LSTM, information flow is unidirectional, from the input sequence forward to backward. BiLSTM, however, processes a sequence in both forward-backward and backward-forward directions, concatenating the outputs from both directions as the final output. This allows for a more comprehensive capture of the sequence's information. The main idea of ​​BiLSTM is to capture long-term dependencies in sequential data through the information flow in both forward and backward directions of the LSTM. LSTM uses gating mechanisms (forget gate, input gate, and output gate) to remember and forget sequential data, effectively addressing the long-term dependency problem. By connecting the outputs of the forward and backward LSTMs to form a global representation, BiLSTM can better capture the semantic information in sequential data, improving its modeling capabilities.

[0173] S8. Finally, the softmax function is used as the activation function to classify the attack types. Softmax classification is suitable for multi-class classification problems and can classify multiple categories.

[0174] In summary, this invention provides a network anomaly traffic detection method that integrates data augmentation and a convolutional bidirectional long short-term memory network (CNN-BiLSTM). It augments the intra-cluster samples in each rare class of data samples by combining density-based noise-applied spatial clustering (DBSCAN) with an improved generative adversarial network (WGAN), ultimately achieving a balanced dataset and addressing the problem of imbalanced positive and negative class samples. A random forest algorithm combined with Pearson correlation coefficient analysis is introduced for feature selection to address feature redundancy. This invention uses a convolutional neural network (CNN) to extract spatial features from network data traffic, leveraging its weight-sharing characteristic to improve speed. A bidirectional long short-term memory network (BiLSTM) is introduced to extract temporal features, learning the dependencies between features to avoid overfitting and improve the model's multi-class classification accuracy. An improved attention mechanism, CBAM-AS, is introduced to assign different weights to features, thereby reducing overhead and improving model performance, detection accuracy, and generalization ability.

[0175] Compared with existing technologies, this invention solves the problems of imbalance between positive and negative class samples in the dataset, feature redundancy, improves the accuracy of multi-class classification and the low detection accuracy of rare class attack samples, alleviates the gradient vanishing problem, has higher computational efficiency, and enhances the generalization ability and robustness of the model.

[0176] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments described. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of this application.

Claims

1. An intrusion detection method based on data augmentation convolutional bidirectional long short-term memory networks, characterized in that, Includes the following steps: Obtain the intrusion detection dataset, convert non-numerical features to numerical features, and perform one-hot encoding and minimum-maximum normalization to obtain the preprocessed intrusion detection dataset. An improved density-based noise-based spatial clustering algorithm and an improved generative adversarial network are used to augment the preprocessed intrusion detection dataset, resulting in an augmented intrusion detection dataset. The feature vector of the intrusion detection dataset is obtained by performing feature selection processing on the expanded intrusion detection dataset using the random forest algorithm combined with Pearson correlation coefficient analysis and then performing feature extraction processing. An improved density-based noise-based spatial clustering module, DBSCAN, is introduced. The feature vectors of the intrusion detection dataset are weighted by a feature attention enhancement model to obtain the weighted features of the intrusion detection dataset. The intrusion detection dataset features with weights are classified using a convolutional bidirectional long short-term memory network to obtain classification results, which include normal traffic samples and attack type traffic samples. The step of augmenting the preprocessed intrusion detection dataset with an improved density-based noise-based spatial clustering algorithm and an improved generative adversarial network to obtain an augmented intrusion detection dataset specifically includes: We introduce weighted Manhattan distance, construct an improved density-based noise-based spatial clustering algorithm, and perform computation on the preprocessed intrusion detection dataset to obtain the clusters and outliers corresponding to the preprocessed intrusion detection dataset. The clusters in the preprocessed intrusion detection dataset include minority cluster samples and majority cluster samples; The minority cluster samples in the preprocessed intrusion detection dataset are oversampled by an improved generative adversarial network WGAN, and the distance between the generator and discriminator in WGAN is measured by the Wasserstein distance to obtain the expanded minority cluster samples. WGAN introduces Wasserstein distance on top of Generative Adversarial Networks (GANs); The expanded minority cluster samples are added to the preprocessed intrusion detection dataset to obtain the expanded intrusion detection dataset; The step of introducing weighted Manhattan distance, constructing an improved density-based noise-based spatial clustering algorithm, and processing the preprocessed intrusion detection dataset to obtain the clusters and outliers corresponding to the preprocessed intrusion detection dataset specifically includes: For each feature in the preprocessed intrusion detection dataset, calculate its Pearson correlation coefficient with the target variable, which is the attack traffic sample. The obtained Pearson correlation coefficient is subjected to min-max normalization and mapped to the range of [0,1] to obtain the normalized correlation coefficient; The normalized correlation coefficient is used as the feature weight in the preprocessed intrusion detection dataset; The weighted Manhattan distance between traffic data is calculated based on the feature weights in the preprocessed intrusion detection dataset. Traffic data with distance values ​​greater than a preset threshold are discarded, and the distance values ​​corresponding to traffic data that meet the preset distance values ​​are stored to obtain a distance matrix. Determine the neighborhood radius, calculate the number of traffic data samples within the neighborhood radius in the distance matrix, and define the traffic data sample as the core point if the calculated number of traffic data samples is greater than or equal to the preset number. Repeat the above steps to determine the core points until all traffic data samples have been traversed. Classify the obtained core points to obtain clusters. Non-core points are marked as noise points and classified as outliers; The improved DBSCAN module specifically includes an adaptive weighted average pooling layer, an adaptive weighted max pooling layer, a fully connected layer, a convolutional layer, a spatial attention layer, and skip connections, wherein: Based on the improved DBSCAN module, an adaptive weighted average pooling layer and an adaptive weighted max pooling layer are used to perform weighted average pooling and weighted max pooling operations on the input data, respectively. Based on the fully connected layer of the improved DBSCAN module, the weighted average pooling operation result and the weighted max pooling operation result are weighted and concatenated to obtain the weighted result; The weighted results are convolutionally processed by the convolutional layer based on the improved DBSCAN module to obtain the corresponding convolutional results. The skip connection based on the improved DBSCAN module directly weights the input data with the corresponding convolution results to obtain the final weighted result; Feature extraction is performed on the final weighted result using a spatial attention layer based on the improved DBSCAN module.

2. The intrusion detection method based on data augmentation convolutional bidirectional long short-term memory network according to claim 1, characterized in that, The step of performing feature selection processing on the expanded intrusion detection dataset using the random forest algorithm combined with Pearson correlation coefficient analysis, followed by feature extraction processing to obtain the feature vector of the intrusion detection dataset, specifically includes: The expanded intrusion detection dataset was selected to obtain the feature set and target variables; Calculate the Pearson coefficient between each feature in the feature set and the target variable, and sort them in descending order of absolute value to obtain the sorted sequence; The K features most strongly correlated with the target variable are selected as the candidate feature set based on the sorting sequence, where K is a pre-defined condition number. The candidate feature set is input into the random forest model for training, and the importance score of each feature in the random forest model is obtained. The top N features with the highest importance scores are selected as the final feature set to train the random forest model, and the performance of the trained random forest model is evaluated. If the performance of the trained random forest model does not meet the preset requirements, the K value is reset and the random forest model training steps are repeated until the performance of the random forest model meets the preset requirements, and the final random forest model is output. Based on the final random forest model, feature selection is performed on the expanded intrusion detection dataset to obtain the feature data of the intrusion detection dataset. The feature data of the intrusion detection dataset is preprocessed to obtain the feature vector of the intrusion detection dataset.

3. The intrusion detection method based on data augmentation convolutional bidirectional long short-term memory network according to claim 2, characterized in that, The step of preprocessing the feature data of the intrusion detection dataset to obtain the feature vector of the intrusion detection dataset specifically includes: The feature data of the intrusion detection dataset is converted to grayscale to obtain the feature data of the converted intrusion detection dataset. Spatial features of the intrusion detection dataset are extracted from the feature data of the transformed intrusion detection dataset using a two-dimensional convolutional neural network. The spatial features of the intrusion detection dataset are integrated using a max pooling layer to obtain the feature vector of the intrusion detection dataset.

4. The intrusion detection method based on data augmentation convolutional bidirectional long short-term memory network according to claim 3, characterized in that, The step of introducing the improved DBSCAN module, which assigns weights to the feature vectors of the intrusion detection dataset through a feature attention enhancement model to obtain the weighted features of the intrusion detection dataset, specifically includes: An improved DBSCAN module is introduced to construct a feature attention enhancement model, which includes convolutional layers, pooling layers, an improved DBSCAN module, fully connected layers, reshaping layers, channel attention modules, and spatial attention modules. Based on the convolutional and pooling layers of the feature attention enhancement model, the feature vectors of the intrusion detection dataset are processed by convolutional pooling to obtain the feature map of the intrusion detection data. The improved DBSCAN module, based on the feature attention enhancement model, performs cluster attention calculation on the feature map of intrusion detection data to obtain the cluster attention vector matrix. Based on the fully connected layer and reshaping layer of the feature attention enhancement model, the cluster attention vector matrix is ​​processed by fully connected layer and reshaping layer in sequence to obtain the first attention vector and the second attention vector. The first attention vector and the second attention vector are input into the channel attention module and the spatial attention module, respectively, to obtain the corresponding channel attention vector and spatial attention vector; Multiply the channel attention vector and spatial attention vector together, and then multiply them together with the cluster attention vector matrix to obtain the weighted features of the intrusion detection dataset.

5. The intrusion detection method based on data augmentation convolutional bidirectional long short-term memory network according to claim 1, characterized in that, The step of classifying the weighted features of the intrusion detection dataset using a convolutional bidirectional long short-term memory network to obtain the classification result specifically includes: The weighted features of the intrusion detection dataset are input into a convolutional bidirectional long short-term memory network, which includes a convolutional neural network (CNN), a bidirectional long short-term memory network, and a normalized exponential function. Based on the convolutional bidirectional long short-term memory network, the convolutional neural network (CNN) performs spatial extraction processing on the data flow features of the weighted intrusion detection dataset to obtain the spatial features of the intrusion detection dataset. Based on the convolutional bidirectional long short-term memory network, the bidirectional long short-term memory neural network performs time-based data flow feature extraction processing on the weighted features of the intrusion detection dataset to obtain the time features of the intrusion detection dataset. The spatial features of the intrusion detection dataset are combined with the temporal features of the intrusion detection dataset, and the classification is performed using the softmax function to obtain the classification result.

Images