Intrusion detection algorithm based on diffusion generative adversarial network and improved Beluga optimization

Abstract

The present invention discloses a fused neural network intrusion detection algorithm based on a diffusion generative adversarial network and improved Beluga optimization, belonging to the field of information security technology. The algorithm comprises the following steps: Step S1, training a diffusion generative adversarial network using an unbalanced dataset to generate samples of minority categories; Step S2, combining the generated samples with the unbalanced dataset to obtain a balanced dataset; Step S3, performing feature selection and data dimensionality reduction on the balanced dataset using the improved Beluga optimization algorithm; and Step S4, training a fused neural network intrusion detection model, Transformer-BiLSTM, to detect network attacks. The present invention solves the problem of unstable training of traditional generative adversarial networks, enabling the generative adversarial network to stably generate samples that approximate real samples, thus resolving the data imbalance problem.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a fusion neural network intrusion detection algorithm based on a diffusion generative adversarial network and improved Beluga optimization. Background Art

[0002] Network intrusion detection systems (IDS) monitor network traffic, perceive the security situation of the system's environment, and promptly detect suspicious activities and known threats. They are currently the most widely used and effective proactive security defense strategy. However, in real networks, abnormal traffic is far less than normal traffic. Rapid network development has made network traffic data massive, high-dimensional, complex, and class-imbalanced. This results in traditional intrusion detection systems experiencing high false positive and false negative rates and low detection efficiency when detecting abnormal traffic. In real networks, malicious traffic generated by abnormal behaviors such as malicious attacks is far less than normal traffic, indicating a serious class imbalance in network traffic data. Researchers have proposed various data augmentation methods to synthesize minority class sample data, such as SMOTE, ADASYN, and RFMSE, to minimize overfitting while improving detection efficiency for minority class samples. However, these methods suffer from various drawbacks.

[0003] Current network traffic data is massive, high-dimensional, complex, and class-imbalanced. This results in high false positive and false negative rates and low detection efficiency in traditional intrusion detection systems when detecting anomalous traffic. Common approaches to address data imbalance include undersampling, oversampling, and a mixture of the two to alter the ratio of majority and minority classes, thereby reducing data imbalance. However, these approaches are prone to overfitting and offer limited improvement in model classification performance. Generative adversarial networks (GANs) encounter various problems in practice, ranging from non-convergence, unstable training, to mode collapse. Traditional feature selection algorithms suffer from blind search and low optimization accuracy. Furthermore, the original algorithms lack optimization optimization, failing to perform global search effectively and easily falling into local optima. Their optimization capabilities need improvement. Feature selection algorithms also fail to effectively eliminate redundant and irrelevant features from the raw data. In intrusion detection models, deep neural network architectures based on deep learning offer stronger learning capabilities and can mine deeper data features. However, deep learning models are not comprehensive in their understanding of traffic characteristics and fail to account for the differential contributions of different features. These problems reduce the detection efficiency and accuracy of the intrusion detection system and increase resource consumption. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to provide

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0006] An intrusion detection algorithm based on diffusion generative adversarial network and improved Beluga optimization includes the following steps:

[0007] Step S1: Use the imbalanced dataset to train the diffusion generative adversarial network to generate samples of the minority class;

[0008] Step S2: generate samples and combine them with the unbalanced dataset to obtain a balanced dataset;

[0009] Step S3: Use the improved Beluga optimization algorithm to perform feature selection and data dimensionality reduction on the balanced data set; Step S4: Train the fusion neural network intrusion detection model Transformer-BiLSTM to detect network attacks.

[0010] A further improvement of the technical solution of the present invention is that: the diffusion generative adversarial network described in step S1 includes a data noise addition part based on a diffusion model and a data generation part based on a generative adversarial network, and the diffusion generative adversarial network is used to process data imbalance. By combining the diffusion model with the generative adversarial network, the diffusion model is used to add noise to the generated data and real data, and the generative adversarial network is used to generate minority category sample data and combine it with the original data set to obtain a balanced data set.

[0011] A further improvement of the technical solution of the present invention is that the diffusion model data denoising process uses the diffusion model to perform the same forward diffusion process on the original data and the data generated by the generative adversarial network, thereby obtaining real samples with different degrees of noise and noisy versions of the generated samples.

[0012] A further improvement of the technical solution of the present invention is that the data generation process of the generative adversarial network distinguishes real samples from generated noise samples through a discriminator, learns the data distribution of the original data and uses the learned data distribution to generate samples of minority categories.

[0013] A further improvement of the technical solution of the present invention is that the diffusion model is combined with the generative adversarial network (CGAN) to obtain a Diffusion-CGAN model for data imbalance processing. The process of Diffusion-CGAN for data imbalance processing is as follows:

[0014] 1) Divide the training set and test set, and input the training set, category labels, and random noise into the generator G of Diffusion-CGAN respectively;

[0015] 2) Generator G generates forged samples for the first time, and performs the same forward diffusion process on the forged samples and real samples to obtain noise samples of real samples and generated samples with different degrees of noise;

[0016] 3) Input real samples and generated samples with different degrees of noise into the discriminator D. The generator G competes with the discriminator D, and the objective function of Diffusion-CGAN is minimized to obtain the optimal generator G.

[0017] 4) Input the minority class labels and random noise in the training set into the trained optimal generator G;

[0018] 5) Generator G generates different numbers of minority class samples according to the input category labels;

[0019] 6) Add the generated minority class samples to the training set to obtain a new training set;

[0020] The objective function of Diffusion-CGAN is shown in the following formula:

[0021]

[0022] The further improvement of the technical solution of the present invention is that the improved beluga whale optimization algorithm in step S3 uses binary encoding for beluga whale individuals, and each beluga whale X i By an m-dimensional binary vector X i =(X i,1 ,X i,2 ,X i,3 ,……,X i,m ) represents, where m is the characteristic dimension, if X i,j =1, it means selecting the j-th dimension feature. If X i,j = 0, it means that the j-th dimension feature is not selected, and the vector X i represents a feasible solution for feature selection.

[0023] A further improvement of the technical solution of the present invention is that: the improved Beluga optimization algorithm uses Tent chaos mapping and elite reverse learning to initialize the population, then the individuals in the population perform global search and local search in the search space, adjusts the population search stage by a nonlinear balance factor, and finally obtains the optimal feature subset, performs feature dimensionality reduction on the balanced data set, and uses the improved BWO algorithm for feature selection. The improved BWO includes four stages: initialization, exploration, development, and whale fall, which correspond to initializing feasible solutions, global search, local search, and re-updating feasible solutions, respectively.

[0024] The further improvement of the technical solution of the present invention is that: the initial population X is obtained through tent mapping, wherein the initial population is optimized based on elite reverse learning, and the process is as follows: first, the initial population is calculated for each individual X i The reverse solution of Then compare the original population individuals X i The corresponding inverse solution The fitness function value of , select individuals with better fitness values ​​as the initial population individuals, as shown in formula (12) and formula (13), and use elite reverse learning to optimize the initial population,

[0025]

[0026]

[0027] Among them, X i Represents the initial population individual, L is the minimum value of the feasible solution, U is the maximum value of the feasible solution, and K is a random number between (0, 1).

[0028] A further improvement of the technical solution of the present invention is that after the population is initialized, it enters the exploration phase. In the exploration phase, each beluga whale continuously explores and changes its position, and the corresponding feature selection feasible solution is continuously updated. In the exploration phase, the beluga whales conduct a global search. Every two beluga whales form a pair and move in a mirror image in the search space to search for the optimal feasible solution. The position of the beluga whale is updated as shown in formula (14):

[0029]

[0030] Where T is the current iteration number, is the new position of the i-th beluga whale in the j-th dimension, p j (j=1, 2, . . . , d) is a random integer selected from the d-dimensional space, The i-th white whale is at p j Position in dimension, and are the current positions of the first and rth beluga whales, respectively. r is a randomly selected beluga whale. The random numbers r1 and r2 are used to enhance the random operators in the exploration phase. r1 and r2 are random numbers in (0, 1). sin(2πr2) and cos(2πr2) indicate that the two beluga whales in a pair move in a mirrored manner in the search space.

[0031] In the development stage, the white whale switches from global search to local search. The white whale can update its own position based on the positions of other white whales nearby in the search space. The white whale performs local search by sharing each other's position information. The Lévy flight strategy is introduced in the development stage to enhance convergence. The mathematical model is shown in formulas (15)-(17):

[0032]

[0033]

[0034]

[0035] Where T is the current iteration number, and are the current positions of the i-th beluga whale and the random beluga whale, is the new position of the i-th beluga whale, is the optimal position in the beluga whale population, r3 and r4 are random numbers between (0, 1), C1=2r4(1-T / T max ) is the random jump intensity that measures the intensity of Lévy flight. u and v are normally distributed random numbers, and β is the default constant equal to 1.5;

[0036] In the process of searching for the optimal solution, each beluga whale has a certain probability of falling while searching and moving. In order to ensure the constant number of beluga whales in the population, the falling beluga whale updates its position information through formula (18). The updated beluga whale represents a new individual. The new beluga whale continues to search for the optimal solution in the search space. That is, each feasible solution selected by the feature in the search space has a certain probability of being updated according to the formula. The mathematical model formulas (18)-(21) are shown as follows:

[0037]

[0038]

[0039] C2=2W f ×n (20)

[0040]

[0041] Among them, r5, r6 and r7 are random numbers between (0, 1), X step is the step size of beluga whale fall, C2 is the step factor related to the probability of beluga whale fall and population size, W f is the probability of beluga whale falling, U b and L b are the upper and lower limits of the variable respectively;

[0042] Finally, in order to balance global search and local search, a nonlinear balance factor is proposed. When Beluga is in the exploration phase, it performs global search, and when it is in the development phase, it performs local search. The transition from the exploration phase to the development phase is actually the transition between global search and local search. The transition process depends on the balance factor B. r , as shown in formula (22):

[0043]

[0044] Among them, T is the current iteration, T max is the maximum number of iterations, Bo changes randomly between (0, 1) in each iteration, and the exploration phase occurs at the balance factor B r >0.5, and the development phase occurs at B r <0.5. As the number of iterations T increases, B r The fluctuation range of decreases nonlinearly from (0, 1) to (0, 0.5), indicating that the probabilities of the development and exploration stages have changed significantly, and the probability of the development stage increases with the continuous increase of the number of iterations T. The balance factor can effectively balance the global search and local search capabilities of the algorithm.

[0045] A further improvement of the technical solution of the present invention is that: Step S4 uses a deep learning network model fused with Transformer and BiLSTM for intrusion detection, specifically: first

[0046] The first half of the Transformer-BiLSTM model is composed of multiple Transformer-Encoders. The model uses the Transformer-Encoder part to learn the local and global features of the data, explore the connections between different features, and pay attention to the differences in different contributions. Secondly, the second half of the model is composed of BiLSTM. After learning the local and global feature information of network traffic, the model uses BiLSTM to learn the temporal characteristics of network traffic, further enriching the feature information extracted by the model, thereby improving the model's detection efficiency.

[0047] Due to the adoption of the above technical solution, the technical advancements achieved by the present invention are:

[0048] The present invention applies diffusion-based generative adversarial networks to data imbalance processing. By combining the diffusion model with the generative adversarial network, the diffusion model is used to add noise to the generated data and real data, increasing the overlap between the distribution of the generated data and the distribution of the real data. This solves the problem of unstable training of traditional generative adversarial networks, enabling the generative adversarial network to stably generate generated samples that are close to real samples, thereby solving the data imbalance problem.

[0049] Based on the traditional Beluga optimization algorithm, this paper proposes an improved Beluga optimization algorithm. By using tent chaos mapping and elite reverse learning for initialization and using a nonlinear balance factor to balance global search and local search, the improved Beluga optimization algorithm can perform feature selection more quickly and efficiently, effectively reducing the detection time of the model and improving the detection performance of the model.

[0050] This paper uses an intrusion detection model that integrates neural networks. The model utilizes the Transformer-Encoder component to learn both local and global features of the data, exploring the connections between different features while focusing on their contributions. The second half of the model, comprised of a BiLSTM, further enriches the model's extracted features by learning both local and global features of network traffic, thereby improving its detection efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Figure 1 It is the overall flow chart of the present invention;

[0052] Figure 2 is the confusion matrix of the classification results of the KDD99 dataset;

[0053] Figure 3 This is a comparison chart of Accuracy, PR, Recall, and F1 values ​​of the ablation experiment;

[0054] Figure 4 This is the comparison chart of FPR and FNR values ​​of the ablation experiment;

[0055] Figure 5 This is a comparison chart of MCC and Kappa values ​​of the ablation experiment. DETAILED DESCRIPTION

[0056] The present invention is described in further detail below in conjunction with the embodiments:

[0057] (1) Train the diffusion generative adversarial network to obtain a balanced dataset

[0058] The diffusion generative adversarial network is used to deal with data imbalance. By combining the diffusion model with the generative adversarial network, the diffusion model is used to add noise to the generated data and real data, and the generative adversarial network is used to generate minority category sample data and combine it with the original data set to obtain a balanced data set.

[0059] (2) Using feature selection to reduce data dimensionality

[0060] The improved Beluga optimization algorithm is used to perform feature dimensionality reduction on the balanced dataset obtained in (1). The population is initialized by combining tent chaotic mapping with elite reverse learning. The nonlinear balance factor is used to balance the global search and local search to obtain the optimal feature subset for feature dimensionality reduction.

[0061] (3) Training the fusion neural network model

[0062] We use a fusion neural network based on the Transformer and BiLSTM networks to train an intrusion detection model. The Transformer learns the local and global features of the data, while the BiLSTM extracts the temporal characteristics of network traffic. We then use the trained intrusion detection model to detect network attacks and predict the correct attack category.

[0063] In summary, the present invention balances the data category distribution through Diffusion-CGAN, thereby improving the model's learning ability for minority classes. An improved optimal feature subset selection method for Beluga optimization is proposed, which selects the optimal feature subset by searching the feature space to reduce the dimensionality of high-dimensional data. An intrusion detection model that integrates the proposed Transformer and bidirectional long short-term memory neural network is used. Ablation experiments are conducted on the KDD99 dataset and the UNSW-NB15 dataset, and the overall performance is compared with other similar algorithms. The algorithm is compared with other algorithms based on evaluation indicators such as accuracy, Matthews correlation coefficient (MCC) and Kappa coefficient, proving its superiority.

[0064] 1. Data imbalance processing

[0065] 1.1 Generative Adversarial Networks

[0066] Generative Adversarial Network (GAN) is a generative model proposed by Goodfellow. It can learn the intrinsic distribution of existing data and build a model that conforms to the data distribution, thereby generating new sample data. As a data augmentation technology, generative adversarial network can be used to deal with data imbalance in intrusion detection datasets. Traditional GAN ​​has some shortcomings. The generator G can only generate data through random noise input, and the category of the generated data cannot be known. Therefore, conditional generative adversarial network (CGAN) is usually used to generate samples of a specified category. CGAN is based on the original GAN ​​and implements conditional generative adversarial network by adding additional conditions to the generator G and the discriminator D. The additional conditions are usually category labels. The objective function of CGAN is shown in formula (2).

[0067]

[0068] CGAN, as a data augmentation technique, can be used to address class imbalance in intrusion detection datasets. However, because the CGAN generator inputs low-dimensional, completely random noise, the generated data distribution initially appears random, significantly different from the true data distribution. Consequently, the generated data distribution has a low overlap with the true data distribution, leading to unstable training and prone to pattern collapse.

[0069] The diffusion model provides a systematic process of adding noise. By adding noise to the generated data and real data through the diffusion model, and then feeding the noisy data into the discriminator, the distance between the generated data distribution and the real data distribution is reduced, and the overlap between the generated data distribution and the real data distribution is increased. This can effectively solve the problem of CGAN being unable to train and unstable training.

[0070] 1.2 Diffusion Model

[0071] A diffusion model is a generative model consisting of a forward process and a backward process. In the forward process, the diffusion model gradually adds noise to the original data until the original data is corrupted and transformed into pure Gaussian noise. In the backward process, the model then learns how to restore the original data from Gaussian noise. The distribution of the data in both the forward and backward processes is modeled as a Gaussian distribution. The basic idea of ​​the diffusion model is to systematically perturb the distribution of the data through a forward diffusion process and then restore the data distribution through learning a backward diffusion process, thereby producing a highly flexible and computationally easy generative model. The forward process is shown in Equations (3) and (4).

[0072]

[0073]

[0074] Where x0 represents the original data, x t represents the noise data after t steps of noise addition to the original data, β t is the hyperparameter of the Gaussian distribution variance.

[0075] In the forward phase, noise is gradually added to the original data x0, and the noise data x obtained at each step is t Only the result x of the previous step t-1 Related, until the noise data x in step t t The reverse process is shown in formula (5), formula (6) and formula (7).

[0076]

[0077] α t =1-β t (6)

[0078]

[0079] The reverse stage is the process of continuously removing noise. First, given the Gaussian noise x t By gradually denoising, the original data x0 is finally restored.

[0080] 1.3 Diffusion Generation Model

[0081] Diffusion is used to perform the same forward diffusion process on the original data and the data generated by GAN, so as to obtain real samples with different degrees of noise and noisy versions of the generated samples. The discriminator is then used to distinguish the real samples from the generated noise samples. Formula (8) and Formula (9) respectively represent the forward diffusion process of the original data and the generated data.

[0082]

[0083]

[0084] where π t represents the mixing weight matrix, x and x g Represents the original data and generated data, x t and x gt They represent the original data and the noise data obtained by adding noise to the generated data in t steps.

[0085] Since GAN cannot know the type of generated data, we combine Diffusion with CGAN to obtain the Diffusion-CGAN model to handle data imbalance. The process of Diffusion-CGAN for data imbalance handling is as follows.

[0086] 1) Divide the training set and test set, and input the training set, category labels, and random noise into the generator G of Diffusion-CGAN respectively;

[0087] 2) The generator G generates a forged sample for the first time, and performs the same forward diffusion process on the forged sample and the real sample to obtain noise samples of the real sample and the generated sample with different degrees of noise.

[0088] 3) Input real samples and generated samples with different degrees of noise into the discriminator D. The generator G competes with the discriminator D, and the objective function of Diffusion-CGAN is minimized to obtain the optimal generator G.

[0089] 4) Input the minority class labels and random noise in the training set into the trained optimal generator G;

[0090] 5) Generator G generates different numbers of minority class samples according to the input category labels;

[0091] 6) Add the generated minority class samples to the training set to obtain a new training set.

[0092] The objective function of Diffusion-CGAN is shown in formula (10).

[0093]

[0094] The Diffusion-CGAN model can effectively solve the problem of GAN training instability and the problem that the original GAN ​​cannot know the category of generated data. It can stably and effectively generate data of specific categories and handle class imbalance of data.

[0095] 2. Feature Selection

[0096] The Beluga Whale Optimization (BWO) algorithm, proposed by Zhong et al. by simulating the predation behavior of beluga whales, is a swarm intelligence optimization algorithm used to solve various optimization problems. In feature selection, BWO can be used to select the most relevant feature subsets and optimize classifier parameters. However, the Beluga Whale Optimization algorithm suffers from many issues, such as a lack of diversity and a tendency to converge prematurely and become trapped in local optima when seeking the optimal solution. To address these issues with the traditional BWO, this paper proposes an improved BWO algorithm and utilizes it for feature selection. The improved BWO algorithm consists of four phases: initialization, exploration, exploitation, and whale crash, corresponding to initializing a feasible solution, global search, local search, and re-updating the feasible solution.

[0097] Since the traditional Beluga optimization algorithm is used to solve continuous space problems and cannot be used for feature selection in discrete space combination optimization, the improved algorithm proposed in this paper uses binary encoding of Beluga individuals to enable it to be used to solve feature selection problems. In the swarm intelligence algorithm, the position information of each Beluga in the search space can be regarded as a feasible solution, and the movement of the Beluga represents the self-optimization process of the solution. After binary encoding, each Beluga X i By an m-dimensional binary vector

[0098] X i =(X i,1 ,X i,2 ,X i,3 ,……,X i,m ) represents, where m is the characteristic dimension, if X i,j =1, it means selecting the j-th dimension feature. If X i,j = 0, it means that the j-th dimension feature is not selected, and the vector X i represents a feasible solution for feature selection.

[0099] The initial spatial distribution of the population significantly impacts both the optimization speed and the algorithm's results. Traditional BWO algorithms use a random number strategy for population initialization, which makes it difficult to achieve a uniform distribution of the population across the target space and reduces algorithmic efficiency. This paper employs chaotic mapping and elite reverse learning for population initialization, improving both population diversity and quality, and enhancing the algorithm's global optimization performance and convergence accuracy.

[0100] Chaotic mapping is a method for generating random sequences from simple deterministic systems. Tent chaotic mapping has a simpler structure, faster convergence speed, and better ergodic uniformity. The population is initialized using Tent mapping, as shown in formula (11).

[0101]

[0102] where x n It represents the initialization position of the nth beluga whale, that is, the nth initial feature selection feasible solution. The value range of parameter α is (0, 1), and the default value of α is 0.5.

[0103] After the tent mapping, the initial population X is obtained. The initial population is optimized based on elite reverse learning. The process is as follows: First, the initial population is calculated for each individual X i The reverse solution of Then compare the original population individuals X i The corresponding inverse solution The fitness function value of is used to select individuals with better fitness values ​​as the initial population individuals. As shown in formula (12) and formula (13), the initial population is optimized using elite reverse learning.

[0104]

[0105]

[0106] Among them, X i Represents the initial population individuals, L is the minimum value of the feasible solution, U is the maximum value of the feasible solution, and K is a random number between (0, 1).

[0107] After population initialization, the population enters the exploration phase. During the exploration phase, each beluga whale continuously explores and changes its position, which means that the corresponding feature selection feasible solution is continuously updated. During the exploration phase, the beluga whales conduct a global search. Each pair of beluga whales moves in a mirror image in the search space to search for the optimal feasible solution. The position of the beluga whale is updated as shown in formula (14):

[0108]

[0109] Where T is the current iteration number, is the new position of the i-th beluga whale in the j-th dimension, p j (j=1, 2, . . . , d) is a random integer selected from the d-dimensional space, The i-th white whale is at p j Position in dimension, and are the current positions of the 1st and rth beluga whales respectively (r is a randomly selected beluga whale), the random numbers r1 and r2 are used to enhance the random operator in the exploration phase, r1 and r2 are random numbers in (0, 1), sin(2πr2) and cos(2πr2) indicate that the two beluga whales in pairs move in a mirrored manner in the search space.

[0110] During the development phase, the Beluga whale switches from global search to local search. The Beluga whale can update its own position based on the positions of other nearby Beluga whales in the search space. Therefore, the Beluga whales perform local search by sharing each other's position information. The Levy flight strategy was introduced during the development phase to enhance convergence. The Levy flight strategy is a random search method that effectively expands the algorithm's search range by searching in a small range near the optimal position, allowing the population to escape the local optimum. The mathematical model is shown in formulas (15)-(17):

[0111]

[0112]

[0113]

[0114] Where T is the current iteration number, and are the current positions of the i-th beluga whale and the random beluga whale, is the new position of the i-th beluga whale, is the optimal position in the beluga whale population, r3 and r4 are random numbers between (0, 1), C1=2r4(1-T / T max ) is the random jump intensity that measures the strength of Lévy flight. u and v are normally distributed random numbers, and β is the default constant equal to 1.5.

[0115] To simulate the behavior of whales falling in each iteration, each beluga whale has a certain probability of falling while searching for the optimal solution. At the same time, to ensure the constant number of beluga whales in the population, the falling beluga whales update their position information using formula (18). The updated position of the beluga whale represents a new individual, and the new beluga whale continues to search for the optimal solution in the search space. In other words, each feasible solution selected by feature in the search space has a certain probability of being updated according to the formula. The mathematical model formulas (18)-(21) are shown as follows:

[0116]

[0117]

[0118] C2=2W f ×n (20)

[0119]

[0120] Among them, r5, r6 and r7 are random numbers between (0, 1), X step is the step size of beluga whale fall, C2 is the step factor related to the probability of beluga whale fall and population size, W f is the probability of beluga whale falling, U b and L b are the upper and lower limits of the variable respectively.

[0121] Finally, in order to balance global search and local search, a nonlinear balance factor is proposed. When Beluga is in the exploration phase, it performs global search, and when it is in the development phase, it performs local search. The transition from the exploration phase to the development phase is actually the transition between global search and local search, and the transition process depends on the balance factor B. r , as shown in formula (22):

[0122]

[0123] Among them, T is the current iteration, T max is the maximum number of iterations, and Bo changes randomly between (0, 1) in each iteration. The exploration phase occurs when the balance factor B r >0.5, and the development phase occurs at B r <0.5. As the number of iterations T increases, B r The fluctuation range of decreases nonlinearly from (0, 1) to (0, 0.5), indicating that the probabilities of the development and exploration phases have changed significantly, and the probability of the development phase increases with the continuous increase of the number of iterations T. The balance factor can effectively balance the global search and local search capabilities of the algorithm.

[0124] 3. Fusion Neural Network

[0125] 3.1 Transformer

[0126] The original Transformer consists of an encoding part and a decoding part. Due to the specific needs of the intrusion detection task and the fixed length of each data in the dataset, the improved model proposed in this paper only uses the encoding part of the Transformer. The encoding part consists of a multi-head self-attention mechanism and a feedforward neural network. The self-attention mechanism uses dot product attention, which includes three inputs: the query vector matrix (Query), the key vector matrix (Key), and the value vector matrix (Value). The query vector matrix and the key vector matrix are used to calculate the weight score assigned to each value, and then the weight is calculated with the value vector matrix to obtain the output. By using dot product attention for parallel operation, the training time is reduced. The self-attention calculation is shown in formula (23)

[0127]

[0128] Where Q, K, and V represent the query vector matrix, key vector matrix, and value vector matrix, respectively. k The dimension of the key.

[0129] The multi-head self-attention mechanism allows the model to notice the subspaces of different representations at different positions. The use of the multi-head self-attention structure can extract richer features. The multi-head self-attention calculation is shown in formula (24) and formula (25).

[0130] Multihead(Q,K,V)=Concat(head1,…,head h )W O (twenty four)

[0131] head i =Attention(QW Q ,KW K ,VW V ) (25)

[0132] Where h is the number of heads, head i represents a single-head attention unit, W Q ,W K ,W V Represents the different weight matrices of multi-head self-attention for Q, K, V, W O It represents the multi-head self-attention score obtained by linearly transforming the splicing result.

[0133] The feedforward neural network consists of a single hidden layer perceptron with the same input and output dimensions. The computational complexity and mapping capability of the model can be balanced by setting the number of hidden layer neurons. The feedforward neural network selects GeLU as the activation function.

[0134] 3.2 BiLSTM

[0135] The Long Short-Term Memory (LSTM) network is a variant of the RNN (Recurrent Neural Network) that addresses the problem of long-range information loss in long sequences. It can process time series information while addressing the vanishing and exploding gradient problems of traditional RNNs. Compared to the LSTM architecture, the BiLSTM adds a hidden layer to the LSTM. Composed of a forward LSTM and a backward LSTM, it leverages forward and backward information to mine the connections between past and future information in a time series, improving data utilization and enhancing model generalization. The calculation method is shown in formulas (26-31).

[0136] f t =σ(w xf x t +w hf h t-1 +b f ) (26)

[0137] i t =σ(w xi x t +w hi h t-1 +b i ) (27)

[0138]

[0139]

[0140] o t = σ(w xo x t + w ho h t-1 + b o ) (30)

[0141] h t = o t ·tanh(c t ) (31)

[0142] Among them, at time t, f t is the forget gate, c t is the memory unit, i t is the input gate, o t is the output gate, x t is the input data, h t represents the hidden layer. w and b represent the weight and bias respectively. σ represents the Sigmoid activation function. 3.3 Transformer—BiLSTM

[0143] This paper proposes a deep learning network model that fuses Transformer and BiLSTM for intrusion detection. The first half of the model consists of multiple Transformer-Encoders. The model uses the Transformer-Encoder layer to learn local and global features of the data, exploring the connections between different features while focusing on the differences in their contributions. The second half of the model consists of a BiLSTM layer. After learning local and global features of network traffic, the BiLSTM layer then learns the temporal characteristics of network traffic, further enriching the feature information extracted by the model and improving its detection efficiency.

[0144] 4. Algorithm Evaluation

[0145] To demonstrate the superiority of our proposed algorithm, we conducted ablation experiments on the KDD99 and UNSW-NB15 datasets, comparing their overall performance with other similar algorithms. We first conducted ablation experiments to verify the effectiveness of the Diffusion-CGAN approach to addressing data imbalance, the feature selection method of our proposed improved Beluga optimization algorithm, and the Transformer-BiLSTM fusion neural network intrusion detection model. Given the differences in attributes and class labels between the KDD99 and UNSW-NB15 datasets, this further demonstrates the strong generalization and adaptability of our proposed algorithm.

[0146] 4.1 Experimental Environment and Dataset

[0147] The experimental environment for this article is a 64-bit Windows 11 operating system, an AMD R7-5800H processor, a computer with 16GB of memory, and an NVIDIA GeForce RTX 3060 graphics card. This experiment uses the Python machine learning library Scikit-Learn and the deep learning library TensorFlow.

[0148] The KDD99 and UNSW-NB15 datasets used in this paper are public datasets commonly used in the field of intrusion detection. The KDD99 dataset contains 41 features and 5 categories. The 5 categories include four attack categories: DoS, R2U, U2R, and Probing, and one normal category: Normal. The distribution of its category samples is shown in Table 1. The UNSW-NB15 dataset contains 49 features and 10 categories. The 10 categories include nine attack categories: Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms, and one normal category: Normal. The distribution of its category samples is shown in Table 2.

[0149] Table 1 Class sample distribution of KDD99 dataset

[0150] ID Class Size Distribution(%) 1 Normal 157,871 19.61 2 Probe 8,273 1.02 3 DoS 621,311 77.17 4 U2R 280 0.03 5 R2L 17,315 2.15 Totals 805,050 100

[0151] Table 2 Class sample distribution of UNSW-NB15 dataset

[0152] ID Class Size Distribution(%) 1 Normal 56,000 31.94 2 Generic 40,000 22.81 3 Exploits 33,393 19.04 4 Fuzzers 18,184 10.37 5 DoS 12,264 6.99 6 Reconnaissance 10,491 5.98 7 Analysis 2,000 1.14 8 Backdoor 1,746 1 9 Shellcode 1,133 0.65 10 Worms 130 0.07 Totals 175,341 100

[0153] 4.2 Evaluation indicators

[0154] This paper uses accuracy (Accuracy), precision rate (PR), recall rate (Recall), F1 value (F1-measure), false positive rate (FPR), false negative rate (FNR), MCC, Kappa and confusion matrix as evaluation indicators to verify the effectiveness of the algorithm proposed in this paper. Among them, Kappa and MCC focus more on the evaluation of the overall classification performance of the model and are sensitive to data imbalance problems. Therefore, they are used in ablation experiments and overall performance comparison experiments of the algorithm in this paper and other algorithms. The confusion matrix is ​​shown in Table 3. The calculation methods of various evaluation indicators are shown in formulas (33)-(44).

[0155] Table 3 Confusion matrix

[0156]

[0157] Among them, TN (True Negative) indicates that the data is of the normal category and is predicted to be of the normal category, TP (True Positive) indicates that the data is of the attack category and is predicted to be of the attack category, FN (False Negative) indicates that the data is of the attack type but is predicted to be of the normal category, and FP (False Positive) indicates that the data is of the normal category but is predicted to be of the attack category.

[0158]

[0159]

[0160]

[0161]

[0162]

[0163]

[0164]

[0165]

[0166] Obsolute = Accuracy (41)

[0167]

[0168]

[0169]

[0170] The higher the accuracy, precision, recall, and F1 values, the better. The lower the false positive and false negative rates, the better. The Matthews correlation coefficient (MCC) ranges from -1 to 1. A value of 1 indicates perfect prediction of the test object, a value of 0 indicates a prediction worse than random chance, and -1 indicates a complete discrepancy between the predicted and actual classifications. The Kappa coefficient ranges from -1 to 1. In classification problems, the number of samples per class is often unbalanced. If this imbalanced dataset is not adjusted, the model can easily favor large classes over small ones. Consequently, even if the overall accuracy is high, the performance of some minority classes may be poor. Therefore, the Kappa coefficient can be used to penalize this bias and provide a more objective model score. Larger values ​​for the Matthews correlation coefficient (MCC) and Kappa coefficient are preferred.

[0171] To further evaluate the overall performance of our proposed algorithm, we compared it with similar algorithms such as CFS-ANN, ELM-PT, RGB-GS-CNN, Rmsprop-LSTM, Conv-LSTM, HAST-IDS, and OCNN-HMLSTM on multiple metrics. The experimental results are shown in Table 4.

[0172] Table 4 Overall performance comparison of the proposed algorithm on the KDD99 dataset

[0173]

[0174]

[0175] As can be seen from Table 4, the performance of the algorithm proposed in this paper exceeds that of other comparison algorithms in all indicators. Among them, the MCC coefficient and Kappa coefficient of the algorithm proposed in this paper are higher than those of other comparison algorithms, and both values ​​are 0.9823. The higher the MCC coefficient, the superiority of the algorithm in category prediction, and the Kappa coefficient can further reflect the superiority of the algorithm in classification performance for class imbalanced data sets.

[0176] In order to prove that the algorithm proposed in this paper has good classification performance on small classes, Figure 2Table 5 shows the confusion matrix for each category of the proposed algorithm. It can be seen that for the majority classes DoS, Normal, and Probe, the classification accuracy is 99.1%, 97.3%, and 97.7%, respectively. In the original KDD99 dataset, the number of R2L and U2R samples is very small. U2R has only 52 samples in the KDD99 training set, resulting in significant class imbalance and very low classification accuracy for R2L and U2R. Class imbalance severely impacts data classification performance. However, by utilizing Diffusion-CGAN to address data imbalance, this paper achieves classification accuracy of 100% for R2L and 97.3% for U2R, demonstrating the superiority of the proposed algorithm in classification for small classes.

[0177] Table 5 Index values ​​of various categories of the algorithm proposed in this paper on the KDD99 dataset

[0178]

[0179]

[0180] To verify the contributions of the data imbalance processing method Diffusion-CGAN, the improved feature selection method of White Whale optimization, and the improved Transformer-BiLSTM neural network model to the algorithm proposed in this paper, the following experiments were conducted in the same experimental environment:

[0181] Experiment 1: Using only the improved Transformer-BiLSTM model

[0182] Experiment 2: Diffusion-CGAN+Transformer-BiLSTM Model

[0183] Experiment 3: Feature Selection Method + Transformer-BiLSTM Model

[0184] Experiment 4: Diffusion-CGAN + Feature Selection Method + CNN-BiLSTM

[0185] Experiment 5: This paper proposes an algorithm, namely Diffusion-CGAN+feature selection method+

[0186] Transformer—BiLSTM, the experimental results are shown in the figure.

[0187] This paper uses the same experimental environment and the same dataset KDD99 to conduct the above five experiments, respectively verifying the contribution of Diffusion-CGAN, the improved Beluga optimization feature selection method, and the fusion neural network Transformer-BiLSTM to the algorithm proposed in this paper. Figure 3-5 The experimental results of five different experiments are shown below. First, the results of Experiments 1 and 2 show that, since the intrusion detection datasets are all imbalanced, the Diffusion-CGAN method is introduced to address the data imbalance, allowing the model to more fully learn the minority class, thereby achieving better classification results. Second, the comparison results of Experiments 1 and 3 show that the improved Beluga optimized feature selection method proposed in this paper, introduced on the basis of the Transformer-BiLSTM model, improves the classification results of the model. This is because the improved Beluga feature selection algorithm performs feature selection on the original high-dimensional data to achieve data dimensionality reduction, and the optimal feature subset selected can effectively improve the classification results. Finally, the results of Experiments 4 and 5 show that the proposed Transformer-BiLSTM model achieves higher classification accuracy for the dataset than other models such as CNN-BiLSTM. This is because the Transformer can effectively learn local and global features of the data, explore the relationship between local and global features, and thus better utilize features for data classification. The accuracy and precision of the algorithm proposed in this paper can reach 98.40%, with a false positive rate of 0.40% and a false negative rate of 1.60%. The MCC and Kappa can reach 98%.

Claims

1. An intrusion detection method based on diffusion generative adversarial network and improved Beluga optimization, characterized by The following steps are involved: Step S1: Use the imbalanced dataset to train the diffusion generative adversarial network to generate samples of the minority class; Step S2: generate samples and combine them with the unbalanced dataset to obtain a balanced dataset; Step S3: Using the improved Beluga optimization algorithm to perform feature selection and data dimensionality reduction on the balanced data set; Step S4: training the fusion neural network intrusion detection model Transformer-BiLSTM to detect network attacks; The diffusion generative adversarial network described in step S1 includes a data noise addition part based on a diffusion model and a data generation part based on a generative adversarial network. The diffusion generative adversarial network is used to process data imbalance. By combining the diffusion model with the generative adversarial network, the diffusion model is used to add noise to the generated data and the real data, and the minority class sample data generated by the generative adversarial network is combined with the original data set to obtain a balanced data set; The improved Beluga optimization algorithm in step S3 uses binary encoding for Beluga individuals. By an m-dimensional binary vector , where m is the characteristic dimension, if , it means selecting the j-th dimension feature, if , it means that the j-th dimension feature is not selected, the vector represents a feasible solution for feature selection; The improved Beluga optimization algorithm uses Tent chaos mapping and elite reverse learning to initialize the population. After that, the individuals in the population perform global and local searches in the search space. The population search phase is adjusted by a nonlinear balance factor. Finally, the optimal feature subset is obtained, and feature dimensionality reduction is performed on the balanced data set. The improved BWO algorithm is used for feature selection. The improved BWO includes four stages: initialization, exploration, development, and whale fall, which correspond to initializing feasible solutions, global search, local search, and re-updating feasible solutions. Step S4 uses a deep learning network model that integrates Transformer and BiLSTM for intrusion detection. Specifically, the first half of the Transformer-BiLSTM model is composed of multiple Transformer-Encoders. The model uses the Transformer-Encoder part to learn the local and global features of the data, explore the connections between different features, and pay attention to the differences in different contributions. Secondly, the second half of the model is composed of BiLSTM. After learning the local and global feature information of the network traffic, the model uses BiLSTM to learn the temporal features of the network traffic.

2. The intrusion detection method based on diffusion generative adversarial network and improved Beluga optimization according to claim 1, characterized in that: The diffusion model data denoising process uses the diffusion model to perform the same forward diffusion process on the original data and the data generated by the generative adversarial network, thereby obtaining noisy versions of real samples and generated samples with different degrees of noise.

3. The intrusion detection method based on diffusion generative adversarial network and improved Beluga optimization according to claim 1, characterized in that: The data generation process of the generative adversarial network distinguishes real samples from generated noise samples through a discriminator, learns the data distribution of the original data and uses the learned data distribution to generate samples of the minority category.

4. The intrusion detection method based on diffusion generative adversarial network and improved Beluga optimization according to claim 1, characterized in that: The diffusion model Diffusion is combined with the generative adversarial network CGAN to obtain the Diffusion-CGAN model for data imbalance processing. The process of Diffusion-CGAN for data imbalance processing is as follows: 1) Divide the training set and test set, and input the training set, category label and random noise into the generator of Diffusion-CGAN respectively middle; 2) Generator Generate a forged sample for the first time, and subject the forged sample and the real sample to the same forward diffusion process to obtain real samples and noise samples with different degrees of noise; 3) Input real samples and generated samples with different degrees of noise into the discriminator In the generator and the discriminator Compete against each other, minimize Diffusion-CGAN's objective function, and obtain the optimal generator ; 4) Input the minority category labels and random noise in the training set into the trained optimal generator middle; 5) Generator Generate different numbers of minority class samples according to the input category label; 6) Add the generated minority class samples to the training set to obtain a new training set; The objective function of Diffusion-CGAN is shown in the following formula: 。 5. The intrusion detection method based on diffusion generative adversarial network and improved Beluga optimization according to claim 1, characterized in that: The initialized population is obtained through Tent mapping , where the initial population is optimized based on elite reverse learning. The process is as follows: First, calculate the initial population for each individual The reverse solution of , and then compare the original population individuals The corresponding inverse solution The fitness function value of , select individuals with better fitness values ​​as the initial population individuals, as shown in formula (12) and formula (13), and use elite reverse learning to optimize the initial population, (12) (13) in, represents the initial population individuals, is the minimum value of the feasible solution, is the maximum feasible solution, is a random number between (0, 1).

6. The intrusion detection method based on diffusion generative adversarial network and improved Beluga optimization according to claim 5, characterized in that: After the population is initialized, it enters the exploration phase. Each beluga whale continuously explores and changes its position, representing the corresponding feature selection. The feasible solution is continuously updated. In the exploration phase, the beluga whales conduct a global search. Every two beluga whales form a pair and move in a mirror image in the search space to search for the optimal feasible solution. The position of the beluga whale is updated as shown in formula (14): (14) Where T is the current iteration number, is the new position of the i-th beluga whale in the j-th dimension, (j=1, 2, ···, d) is a random integer selected from the d-dimensional space, The i-th beluga whale is Position in dimension, and are the current positions of the first and rth beluga whales, r is a randomly selected beluga whale, and the random number and Random operators used to enhance the exploration phase, and is a random number from (0, 1), and It represents a pair of two beluga whales moving in mirror-image fashion in the search space; In the development phase, Beluga whales switch from global search to local search. Beluga whales can update their own positions based on the positions of other nearby Beluga whales in the search space. Beluga whales perform local search by sharing each other's position information. In the development phase, the Levy flight strategy is introduced to enhance convergence. The mathematical model is shown in formulas (15)-(17): (15) (16) (17) Where T is the current iteration number, and are the current positions of the i-th beluga whale and the random beluga whale, is the new position of the i-th beluga whale, It is the best position among the beluga whale population. and is a random number between (0, 1), is the random jump intensity that measures the intensity of Lévy flight, u and v are normally distributed random numbers, and β is the default constant equal to 1.5; In the process of searching for the optimal solution, each beluga whale has a certain probability of falling while searching and moving. In order to ensure the constant number of beluga whales in the population, the falling beluga whale updates its position information through formula (18). The updated beluga whale represents a new individual. The new beluga whale continues to search for the optimal solution in the search space. That is, each feasible solution selected by the feature in the search space has a certain probability of being updated according to the formula. The mathematical model formulas (18)-(21) are shown as follows: (18) (19) ＝ (20) (21) in, 、 and is a random number between (0, 1), It is the step length of the white whale's fall, is a step factor related to the probability of beluga decline and population size, is the probability of beluga whale falling, and are the upper and lower limits of the variable respectively; When White Whale is in the exploration phase, it performs global search. When in the development phase, it performs local search. The transition from the exploration phase to the development phase is actually the transition between global search and local search. The transition process depends on the balance factor. , as shown in formula (22): ； Where T is the current iteration, is the maximum number of iterations, Bo changes randomly between (0, 1) in each iteration, and the exploration phase occurs when the balance factor > 0.5, while the development phase occurs < 0.5, as the number of iterations T increases, The fluctuation range decreases nonlinearly from (0, 1) to (0, 0.5).

Images