An intrusion detection method and system for capturing spatio-temporal information for feature learning

Abstract

The application discloses an intrusion detection method and system for capturing space-time information for feature learning, and relates to the technical field of information security, comprising: acquiring original network data; preprocessing the original network data to obtain network flow; processing the network flow to obtain two-dimensional network flow blocks; converting the two-dimensional network flow blocks into fixed-length vectors through linear function vector dimension change; constructing an artificial neural network model; adding position information and label information to the fixed-length vectors and inputting the fixed-length vectors into the artificial neural network model for training; after the training is completed, saving model parameter information and outputting the trained artificial neural network model; and judging whether it is a network intrusion behavior through the trained artificial neural network model. The application can effectively analyze network traffic and identify real security threats, while minimizing false positives to ensure the effectiveness and feasibility of IDS.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and more specifically to an intrusion detection method and system for capturing spatiotemporal information and performing feature learning. Background Technology

[0002] Currently, Intrusion Detection Systems (IDS) play a crucial role in ensuring network security by identifying malicious activities that may compromise the integrity and confidentiality of critical systems. As digitalization permeates all sectors, the need for robust intrusion detection mechanisms becomes even more critical. When considering the use of IDS, accuracy and reliability are paramount, while minimizing false positives is also essential. False positives occur when a system incorrectly identifies normal network activity as malicious, leading to unnecessary outages and wasted resources. High false positive rates can disrupt normal system operation and increase operational costs.

[0003] On the other hand, the increasing complexity and scale of detection models place a heavy burden on computing resources, making their deployment challenging in real-world scenarios with limited processing power. Large models require high-performance computing power, memory, and storage space, hindering their practicality and scalability.

[0004] Therefore, how to provide an intrusion detection method and system that captures spatiotemporal information for feature learning and achieves a balance between minimizing false alarms and developing a lightweight detection model is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of this, the present invention provides an intrusion detection method and system that captures spatiotemporal information for feature learning, which can effectively analyze network traffic and identify real security threats, while minimizing false alarms and ensuring the effectiveness and feasibility of IDS.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: an intrusion detection method for capturing spatiotemporal information and performing feature learning, comprising:

[0007] Obtain raw network data;

[0008] The raw network data is preprocessed to obtain the network flow;

[0009] The network flow is processed to obtain a two-dimensional network flow block;

[0010] The two-dimensional network flow block is transformed into a fixed-length vector by changing the vector dimension through a linear function.

[0011] Constructing artificial neural network models;

[0012] The location information and label information are added to a fixed-length vector and input into the artificial neural network model for training.

[0013] After training, save the model parameter information and output the trained artificial neural network model;

[0014] A trained artificial neural network model is used to determine whether a network intrusion has occurred.

[0015] Preferably, the original network data includes n data packets P = {p 1 , ..., p n Each data packet is represented as p. i =(x i b i , t i );

[0016] Where i = 1, 2, ..., n; x i Let b represent a 5-tuple. i Indicates the data packet size b i ∈[0, ∞); t i Indicates the start time t of traffic transmission i ∈[0, ∞).

[0017] The 5-tuple consists of the source port, source IP, destination port, destination IP, and transport layer protocol.

[0018] Preferably, processing the network stream includes: encoding the network stream data into fixed-length network stream blocks, wherein the fixed-length network stream blocks are sub-network graphs of the same size obtained by segmenting the network image.

[0019] Preferably, the step of converting network stream data into fixed-length network stream blocks through encoding includes: presetting the network stream length and adjusting the network stream to a consistent length;

[0020] If the network flow exceeds the preset length, it will be pruned.

[0021] If the network flow is less than the preset length, it will be padded.

[0022] If the network stream is equal to the preset length, then it is directly converted.

[0023] Ensure that network stream lengths are consistent.

[0024] Preferably, it also includes: setting the length of each network flow to m*n;

[0025] The adjusted network flow is placed in the form of an image, resulting in a grayscale image with a width of m and a height of n, which is called the network flow graph;

[0026] The grayscale image is divided into N fixed-length network stream blocks.

[0027] Preferably, location information and label information are added to a fixed-length vector, including:

[0028] A standard learnable one-dimensional vector is added as position information to a fixed-length vector, and its elements are added one by one to the elements of the fixed-length vector.

[0029] The learned encoding is added as label information to the beginning of a fixed-length vector sequence to mark different subsystems, thus improving classification accuracy.

[0030] Preferably, the artificial neural network model includes an encoder and a classifier;

[0031] The classifier consists of alternating multi-head self-attention layers (MSA) and a multi-level programming language (MLP), with the classification head implemented by the MLP.

[0032] The classifier is trained based on the encoder's output and the extracted feature vectors.

[0033] During training, the cross-entropy loss function is used as the loss function for the classification task by one-hot encoding of the predicted probabilities and label information.

[0034] Preferably, an intrusion detection system that captures spatiotemporal information for feature learning is characterized by comprising:

[0035] The data acquisition module is used to acquire raw network data;

[0036] The preprocessing module is used to preprocess the raw network data to obtain the network stream;

[0037] The network stream processing module is used to process network streams to obtain two-dimensional network stream blocks;

[0038] The transformation module is used to transform the two-dimensional network flow block into a fixed-length vector by changing the vector dimension through a linear function;

[0039] The model building module is used to build artificial neural network models;

[0040] The training module is used to add location information and label information to a fixed-length vector and input it into the artificial neural network model for training.

[0041] The output module is used to save the model parameter information and output the trained artificial neural network model after training is completed.

[0042] The judgment module is used to determine whether a network intrusion behavior is committed based on a trained artificial neural network model.

[0043] As can be seen from the above technical solution, compared with the prior art, this invention discloses an intrusion detection method and system for capturing spatiotemporal information and performing feature learning, including: acquiring raw network data; preprocessing the raw network data to obtain a network flow; processing the network flow to obtain a two-dimensional network flow block; transforming the two-dimensional network flow block into a fixed-length vector through a linear function; constructing an artificial neural network model; adding location information and label information to the fixed-length vector and inputting it into the artificial neural network model for training; after training, saving the model parameter information and outputting the trained artificial neural network model; and determining whether it is a network intrusion behavior through the trained artificial neural network model. This invention, through preprocessing the network flow, ensures that raw network data containing more information can be input into the artificial neural network for feature extraction, and improves the accuracy of classification by adding label information and location information. It also reduces the model size while maintaining high accuracy and low false positive rate, enhancing the usability of this invention. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0045] Figure 1 A flowchart of network stream processing provided for an embodiment of the present invention.

[0046] Figure 2 This is a flowchart of an intrusion detection method provided in an embodiment of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0048] This invention discloses an intrusion detection method that captures spatiotemporal information for feature learning, such as... Figure 2 As shown, it includes:

[0049] Obtain raw network data;

[0050] The raw network data is preprocessed to obtain the network flow;

[0051] The network flow is processed to obtain a two-dimensional network flow block;

[0052] The two-dimensional network flow block is transformed into a fixed-length vector by changing the vector dimension through a linear function.

[0053] Constructing artificial neural network models;

[0054] The location information and label information are added to a fixed-length vector and input into the artificial neural network model for training.

[0055] After training, save the model parameter information and output the trained artificial neural network model;

[0056] A trained artificial neural network model is used to determine whether a network intrusion has occurred.

[0057] Specifically, the original network data includes n data packets P = {p 1 , ..., p n Each data packet is represented as p. i =(x i b i , t i );

[0058] Where i = 1, 2, ..., n; x i Let b represent a 5-tuple. i Indicates the data packet size b i ∈[0, ∞); t i Indicates the start time t of traffic transmission i ∈[0, ∞).

[0059] The 5-tuple consists of the source port, source IP, destination port, destination IP, and transport layer protocol.

[0060] In one specific embodiment of the present invention, such as Figure 1 As shown, S1: Network traffic at the flow granularity level is captured as data samples. The range of network traffic includes various granularity levels. In this invention, the focus is on the utilization of flows because it can aggregate network traffic, reduce data volume, provide contextual information, and support real-time analysis. It achieves a balance between capturing relevant information and reducing computational complexity, thus being highly efficient in detecting and responding to security events. Specifically, flows, as a group of data packets, share the same 5-tuple, consisting of source port, source IP, destination port, destination IP, and transport layer protocol.

[0061] Specifically, the raw network data: given n data packets P = {p 1 , ..., p n Each data packet is represented as p. i =(x i bi , t i ), where i = 1, 2, ..., n, x i Let b represent a 5-tuple. i Indicates the data packet size b i ∈[0, ∞) (in bytes), t i Indicates the start time t of traffic transmission i ∈[0, ∞).

[0062] Network Flow: Given a set of original network data P, multiple subsets can be obtained by splitting the flow. Data packets are ordered by time relevance, for example, {p} i =(x i b i , t i ), ..., p n =(x n b n , t n )}, where t 1 <t 2 <...<t n .

[0063] Here, the flow is a subset defined as f = (x, b, d) t (t). x represents a 5-tuple of the original flow, for example, x = x1 = ... = x n b represents the total size of the data packets, d t d represents the duration of the flow. t =t n -t 1 t represents the time of data packet transmission. Therefore, the stream is derived from the raw traffic and can be represented as F = {f 1 , ..., f n}

[0064] Specifically, processing the network stream includes: encoding the network stream data into fixed-length network stream blocks, wherein the fixed-length network stream blocks are sub-network graphs of the same size obtained by segmenting the network image.

[0065] Specifically, the process of converting network stream data into fixed-length network stream blocks through encoding includes: setting a preset network stream length and adjusting the network stream to a consistent length; trimming the network stream if it is longer than the preset length; padding the network stream if it is shorter than the preset length; and directly converting the network stream if it is equal to the preset length. This ensures that the network stream length is uniform.

[0066] Specifically, it also includes: setting the length of each network flow to m*n; placing the adjusted network flow in the form of an image to obtain a grayscale image with a width of m and a height of n, called a network flow graph; and dividing the grayscale image into N fixed-length network flow blocks.

[0067] Specifically, location information and label information are added to a fixed-length vector, including:

[0068] A standard learnable one-dimensional vector is added as position information to a fixed-length vector, and its elements are added one by one to the elements of the fixed-length vector.

[0069] The learned encoding is added as label information to the beginning of a fixed-length vector sequence to mark different subsystems, thus improving classification accuracy.

[0070] In one specific embodiment of the present invention, such as Figure 1 As shown, S2: Transforms the network stream into a vector that can be input to the artificial neural network model. Since the network stream is collected as variable-length data, while artificial neural networks can only accept fixed-length vectors, it is necessary to map the network stream onto a vector space to make the data meet the requirements.

[0071] S21: First, the collected network flow data is converted into fixed-length network flow blocks through encoding. A network flow block is a sub-network graph of the same size obtained after segmenting the network image.

[0072] S211: Adjusts network streams to a consistent length. If a file size exceeds or falls below a defined size, it will be trimmed or padded with 0x00 to ensure uniform length.

[0073] S212: Define the length of each network flow as m*n, and place the network flow in the form of an image to obtain a grayscale image with a width of m and a height of n, called a network flow graph. A network flow graph has a total of m*n pixels, and the value of each pixel ranges from 0 to 255.

[0074] S213: Convert the grayscale image x∈R at this point. m×n Dividing the network into N flow blocks, denoted as I 2 This represents the number of pixels in each network block, with each pixel ranging from 0 to 255. The number of pixels in a network block is (I, I), and the number of network blocks is N = m·n / I. 2 It is also the effective input sequence length of the artificial neural network model.

[0075] S22: The artificial neural network model used in this invention has a fixed-length vector D. Therefore, the two-dimensional network block (i.e., grayscale image) x needs to be flattened and linearly mapped to a D-dimensional vector by transforming its vector dimension through a linear function. The result of the linear mapping is called the block embedding. Before being input into the artificial neural network, positional and label information needs to be added to the fixed-length vector; specifically, positional embedding and category label are added to the block embedding. In this invention, to preserve positional information, a standard learnable one-dimensional vector is added to the block embedding as the positional embedding, and its elements are added one by one to the elements in the block embedding. Learnable encoding is added. The preceding part of the stream block embedding sequence indicates the labels of the different subsystems marked during data collection, as shown in Equation (1):

[0076]

[0077] Among them, E pos Indicates the location information to be added; x class This indicates the added tag information; z0 indicates the added location information E. pos and tag information x class A fixed-length vector.

[0078] Specifically, the artificial neural network model includes an encoder and a classifier;

[0079] The classifier consists of alternating multi-head self-attention layers (MSA) and a multi-level programming language (MLP), with the classification head implemented by the MLP.

[0080] The classifier is trained based on the encoder's output and the extracted feature vectors.

[0081] During training, the cross-entropy loss function is used as the loss function for the classification task by one-hot encoding of the predicted probabilities and label information.

[0082] In a specific embodiment of the present invention, S3: the location information E is added. pos and tag information x class The z0 is input into the encoder of the L artificial neural network model for training. After processing by the artificial neural network encoder and the SOFIMAX classifier, the image representation y is obtained, as shown in formula (2):

[0083]

[0084] Here, LN represents the LN layer normalization algorithm. y represents the result of training z0 through the encoder of an L-person artificial neural network model; y represents the predicted probability.

[0085] In a specific embodiment of the present invention, the classification head is implemented by an MLP. The VisionTransformer used in the present invention consists of alternating multi-head self-attention layers (MSA) and MLP, as shown in formulas (3) and (4).

[0086] z′ l =MSA(LN(Z) l-1 ))+Z l-1 (3)

[0087] z l =MLP(LN(z′) l ))+z′ l (4)

[0088] Among them, z L Let z be the feature vector extracted from the original data, representing the set of features output by each encoder. l z represents the output of the first encoder. l-1 This represents the output of the (1-1)th encoder; z′ l This represents the result after processing via the self-attention mechanism. Where z... l and z′ l This represents the staged output within the same encoder, z′ l The result will be calculated in formula (4).

[0089] The predicted probability y obtained from Formula 2 is then used during training in conjunction with the one-hot encoding X of the true label. class The cross-entropy loss function can be used as the loss function for classification tasks, as shown in Equation (5):

[0090]

[0091] After training is complete, save the model parameters.

[0092] In one specific embodiment of the present invention, when a traffic sample is input, the original traffic data is used, and after network flow preprocessing, adding classification labels and adding location embedding steps, it is input into a trained artificial neural network model. The softmax classifier is used to obtain the class probability y, thereby determining whether it is a network intrusion behavior.

[0093] Specifically, an intrusion detection system that captures spatiotemporal information for feature learning is characterized by comprising:

[0094] The data acquisition module is used to acquire raw network data;

[0095] The preprocessing module is used to preprocess the raw network data to obtain the network stream;

[0096] The network stream processing module is used to process network streams to obtain two-dimensional network stream blocks;

[0097] The transformation module is used to transform the two-dimensional network flow block into a fixed-length vector by changing the vector dimension through a linear function;

[0098] The model building module is used to build artificial neural network models;

[0099] The training module is used to add location information and label information to a fixed-length vector and input it into the artificial neural network model for training.

[0100] The output module is used to save the model parameter information and output the trained artificial neural network model after training is completed.

[0101] The judgment module is used to determine whether a network intrusion behavior is committed based on a trained artificial neural network model.

[0102] Compared with existing technologies, this invention provides an intrusion detection method and system that captures spatiotemporal information for feature learning. An artificial neural network model is constructed, employing Vision Transformer and self-attention mechanisms, which can effectively analyze network traffic and identify genuine security threats while minimizing false positives. Preprocessing of network flows ensures that raw data containing more information can be input into the artificial neural network for feature extraction, and adding label and location information during flow block embedding improves classification accuracy. The model size is kept lightweight while maintaining high accuracy and low false positive rate, enhancing the usability of this invention.

[0103] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to the method section.

[0104] The above description of the disclosed embodiments enables those skilled in the art to make or use the invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the invention. Therefore, the invention is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An intrusion detection method for capturing spatiotemporal information and performing feature learning, characterized in that, include: Obtain raw network data; The raw network data is preprocessed to obtain the network flow; The network flow is processed to obtain a two-dimensional network flow block; The two-dimensional network flow block is transformed into a fixed-length vector by changing the vector dimension through a linear function. Constructing artificial neural network models; The location information and label information are added to a fixed-length vector and input into the artificial neural network model for training. After training, save the model parameter information and output the trained artificial neural network model; The trained artificial neural network model is used to determine whether a network intrusion has occurred. Add location and label information to a fixed-length vector, including: A standard learnable one-dimensional vector is added as position information to a fixed-length vector, and its elements are added one by one to the elements of the fixed-length vector. The learnable encoding is added as label information to the beginning of a fixed-length vector sequence, serving as labels for different subsystems during data collection, as shown in the following expression: ； in, This indicates the location information to be added; This indicates the added tag information; This indicates that location information has been added. and tag information A fixed-length vector; m is the width of the network graph, n is the height of the network graph; N is the number of fixed-length network blocks; D represents a fixed-length size vector; Location information has been added. and tag information of The input is trained on the encoder of L artificial neural network models. After processing by the artificial neural network encoder and softmax classifier, the image representation is obtained. : ； in, express Layer normalization algorithm, express The result of training the encoder of the L artificial neural network model is y, which represents the predicted probability. The classification head is implemented by an MLP, and the Vision Transformer consists of alternating multi-head self-attention layers (MSA) and an MLP. ； ； in, The feature vector extracted from the original data, This represents the output of the l-th encoder. This represents the output of the (l-1)th encoder; This indicates the result after processing via the self-attention mechanism; The predicted probability y is combined with the one-hot encoding of the true label during training. Use the cross-entropy loss function as the loss function for classification tasks: ； After training is complete, save the model parameters.

2. The intrusion detection method for capturing spatiotemporal information and performing feature learning according to claim 1, characterized in that, The raw network data includes Data packets Each data packet is represented as ; in ; To represent a 5-tuple, Indicates data packet size ; Indicates the start time of traffic transmission .

3. The intrusion detection method for capturing spatiotemporal information and performing feature learning according to claim 1, characterized in that, Processing the network stream includes: encoding the network stream data into fixed-length network stream blocks, wherein the fixed-length network stream blocks are sub-network graphs of the same size obtained by segmenting the network image.

4. The intrusion detection method for capturing spatiotemporal information and performing feature learning according to claim 3, characterized in that, The step of converting network stream data into fixed-length network stream blocks through encoding includes: presetting the network stream length and adjusting the network stream to a consistent length; If the network flow exceeds the preset length, it will be pruned. If the network flow is less than the preset length, it will be padded. If the network stream is equal to the preset length, then it is directly converted.

5. The intrusion detection method for capturing spatiotemporal information and performing feature learning according to claim 4, characterized in that, Also includes The default length of each network stream is 1. ; The adjusted network stream is then placed as an image, resulting in a width of [missing information]. The height is The grayscale image is called a network flow graph; Divide the grayscale image into a number of... Fixed-length network flow blocks.

6. The intrusion detection method for capturing spatiotemporal information and performing feature learning according to claim 1, characterized in that, The artificial neural network model includes an encoder and a classifier; The classifier consists of alternating multi-head self-attention layers (MSA) and a multi-level programming language (MLP), with the classification head implemented by the MLP. The classifier is trained based on the encoder's output and the extracted feature vectors. During training, the cross-entropy loss function is used as the loss function for the classification task by one-hot encoding of the predicted probabilities and label information.

7. An intrusion detection system for capturing spatiotemporal information and performing feature learning, employing the intrusion detection method for capturing spatiotemporal information and performing feature learning as described in any one of claims 1-6, characterized in that, include: The data acquisition module is used to acquire raw network data; The preprocessing module is used to preprocess the raw network data to obtain the network stream; The network stream processing module is used to process network streams to obtain two-dimensional network stream blocks; The transformation module is used to transform the two-dimensional network flow block into a fixed-length vector by changing the vector dimension through a linear function; The model building module is used to build artificial neural network models; The training module is used to add location information and label information to a fixed-length vector and input it into the artificial neural network model for training. The output module is used to save the model parameter information and output the trained artificial neural network model after training is completed. The judgment module is used to determine whether a network intrusion behavior is committed based on a trained artificial neural network model.

Images