A method for detecting network traffic intrusion

Abstract

This invention belongs to the field of network security, specifically relating to a network traffic intrusion detection method. The method includes: acquiring a training dataset and dividing it into a training set and a test set; preprocessing the training set, and addressing the imbalance problem by using a feature selection algorithm based on density clustering and importance measurement (DBIM) to reduce the dimensionality of the dataset, obtaining training feature vectors; inputting the training feature vectors into a network traffic intrusion detection model, and using a particle swarm optimization algorithm to fine-tune the parameters of the network traffic intrusion detection model, obtaining a trained network traffic intrusion detection model; and using the trained network traffic intrusion detection model to process the test set to obtain intrusion detection results. This invention achieves fast network traffic intrusion detection with high accuracy.

Description

Technical Field

[0001] This invention belongs to the field of network security, and specifically relates to a method for detecting network traffic intrusion. Background Technology

[0002] Network intrusion detection refers to the process of detecting and identifying abnormal traffic and unauthorized access in a computer network. It is one of the important means of protecting computer network security. Network intrusion detection systems (NIDS) can monitor and analyze traffic packets transmitted over the network to identify malicious traffic and network attacks. Current network intrusion detection methods can be divided into feature-based detection methods and anomaly-based detection methods.

[0003] Traditional feature-based intrusion detection systems classify and identify network traffic by defining predefined rules or patterns to determine whether abnormal or attacking behavior exists. This method is easy to understand and interpret, but it requires manually defined rules and is less effective at detecting novel network attacks, such as zero-day attacks.

[0004] To improve the detection effectiveness against attacks targeting unknown vulnerabilities, anomaly-based intrusion detection algorithms have become a focus of research, primarily based on machine learning algorithms. The most commonly used traditional machine learning algorithms include Random Forest and Support Vector Machine (SVM). However, traditional machine learning algorithms also have drawbacks. For example, while Random Forest has fast training speed and can balance errors in imbalanced datasets, it can overfit in noisy classifications. While Support Vector Machines avoid local optima, they only solve small sample problems. With the increasing diversification of network attacks and the growing complexity of network data features, traditional intrusion detection techniques are unable to effectively extract data features to obtain useful information, leading to a decrease in detection rate and an increase in false positive rate.

[0005] In the context of massive and complex network traffic in the Internet age, there is an urgent need for a lightweight, high-performance intrusion detection method that is fast and accurate, so as to achieve threat detection of network attack traffic with low time and space costs. Summary of the Invention

[0006] To address the shortcomings of existing technologies, this invention proposes a network traffic intrusion detection method, which includes:

[0007] S1: Obtain the training dataset and divide it into training and test sets;

[0008] S2: Preprocess the training set to obtain training feature vectors;

[0009] S3: Input the training feature vector into the network traffic intrusion detection model, and use the particle swarm optimization algorithm to fine-tune the parameters of the network traffic intrusion detection model to obtain the trained network traffic intrusion detection model.

[0010] S4: The test set is processed using a trained network traffic intrusion detection model to obtain intrusion detection results.

[0011] Preferably, the preprocessing of the training set includes:

[0012] S21: Use a two-dimensional matrix to store the feature information of the training set to obtain the first feature matrix;

[0013] S22: Normalize the first feature matrix to obtain the second feature matrix;

[0014] S23: Perform one-hot encoding on the character-type features in the second feature matrix to obtain the first data features;

[0015] S24: Perform dimensionality reduction on the numerical features in the second feature matrix to obtain the second data features;

[0016] S25: Combine the first data feature and the second data feature to obtain the training feature vector.

[0017] Preferably, the process of dimensionality reduction of the numerical features in the second feature matrix includes:

[0018] The numerical features in the second feature matrix are divided into majority class samples S according to the label distribution. - and minority class samples S + , will the majority class S - According to minority class S + The sample size is divided into n equal-sized samples, and each of these equal-sized samples is then compared with the minority class S. + Generate n combined samples;

[0019] Density clustering of the combined samples is performed using the DBSCAN algorithm to obtain cluster sets and boundary point sets. In each combined sample, the inverse k nearest neighbor sample set of the boundary point is found based on the boundary point set. The radial distance between the boundary point and its inverse k nearest neighbor sample is calculated.

[0020] The density influence threshold d is calculated based on the radial distance between the boundary point and its k nearest neighbor in the opposite direction. i :

[0021]

[0022] Where, x * The x-coordinate of the boundary point is represented by x. iThis represents the x-coordinate of the i-th nearest neighbor sample. Represents the set of reverse k-nearest neighbors of the boundary points;

[0023] Define the critical threshold α as the value of d for all combined samples. i The mean of d i If the value is greater than the critical threshold α, then the boundary sample points of the combined sample are added. In the set;

[0024] Use the DBSCAN density algorithm to analyze the set The sample points in the data are then subjected to density clustering again to obtain m feature subspaces;

[0025] Fisher discriminant analysis was used to calculate the Fisher values ​​of features in all cluster sets and m feature subspaces, and the features were sorted according to their Fisher values. The top S features were selected as the second data features.

[0026] Preferably, the network traffic intrusion detection model consists of a cascaded input layer, a hidden layer, a Dropout layer, and a fully connected layer.

[0027] Furthermore, the input layer is a one-dimensional convolution, and the hidden layers include a first max pooling layer, a first batch normalization layer, a first BiLSTM layer, a reshape layer, a second max pooling layer, a second batch normalization layer, and a second BiLSTM layer.

[0028] Preferably, the process of using particle swarm optimization algorithm to fine-tune the parameters of the network traffic intrusion detection model includes:

[0029] The number of convolutional kernels, the number of neurons in the first BiLSTM layer, the Dropout value, and the learning rate are represented as particles, and the particle parameters are initialized.

[0030] The model performance metrics are used as fitness to update the particle's velocity and coordinates; the fitness value is then updated based on the particle's velocity and coordinates.

[0031] When the number of iterations or the fitness value between two iterations is minimized, the optimized network traffic intrusion detection model is obtained.

[0032] Furthermore, the formulas for updating the particle's velocity and coordinates are as follows:

[0033]

[0034]

[0035] in, This represents the velocity vector of particle i in the (k+1)th iteration, with dimension d. This represents the velocity vector of particle i in the d-th dimension during the k-th iteration. This represents the historical optimal position of particle i in the d-th dimension during the k-th iteration. This represents the historical best position of the group in the d-th dimension during the k-th iteration. This represents the d-th dimension position vector of particle i in the k-th iteration. Let represent the position vector of particle i in the d-th dimension during the (k+1)-th iteration, w represent the inertia weight, c1 represent the first acceleration factor, c2 represent the second acceleration factor, r1 represent the first random number, and r2 represent the second random number.

[0036] Furthermore, the formula for calculating fitness is:

[0037] fit = PCB(cn, ls, dr, lr)

[0038] Where: fit represents the fitness value, PCB() represents the optimization function of the particle swarm optimization algorithm, cn represents the number of convolution kernels, ls represents the number of neurons in the first layer of BiLSTM, dr represents the Dropout parameter, and lr represents the learning rate.

[0039] The beneficial effects of this invention are as follows:

[0040] This invention proposes a high-efficiency intrusion detection model, PCB. Based on DBIM feature selection of the dataset, it combines and improves the CNN-BiLSTM model proposed by previous researchers, optimizes the overall model construction and resource allocation, and uses the particle swarm optimization algorithm (PSO) to fine-tune the hyperparameters of the model design, minimizing time cost while meeting the requirements of high accuracy and low false positive rate of the intrusion detection model. Attached Figure Description

[0041] Figure 1 This is a schematic diagram of the network traffic intrusion detection process in this invention;

[0042] Figure 2 This is a schematic diagram of the DBSCAN density clustering process;

[0043] Figure 3 This is a schematic diagram showing the layer settings of the network traffic intrusion detection model in this invention. Detailed Implementation

[0044] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0045] This invention proposes a network traffic intrusion detection method, such as... Figure 1 As shown, the method includes the following:

[0046] S1: Obtain the training dataset and divide it into training and test sets.

[0047] Preferably, the KDDCup99 dataset or the NSL-KDD dataset can be used as the training dataset.

[0048] S2: Preprocess the training set to obtain training feature vectors.

[0049] S21: Use a two-dimensional matrix to store the feature information of the training set to obtain the first feature matrix.

[0050] In the first feature matrix, rows represent different data traffic flows, and columns represent the feature information of each network traffic flow.

[0051] S22: Normalize the first characteristic matrix to obtain the second characteristic matrix.

[0052] The purpose of normalization is to improve the speed and performance of model training by reducing the imbalance of data distribution. This invention uses the Min-Max method for normalization, scaling the data range to [0,1]. The calculation formula is as follows:

[0053]

[0054] Where x′ represents the normalized feature, x represents the original feature, and x min x represents the minimum value of the feature. max This represents the maximum value of the feature.

[0055] S23: Perform one-hot encoding on the character features in the second feature matrix to obtain the first data features.

[0056] One-hot encoding can transform discrete features into continuous features, allowing the model to better handle these features. Furthermore, one-hot encoding avoids comparisons and arithmetic operations between discrete features, thus preventing the model from making incorrect assumptions about discrete features.

[0057] The character class features protocol_type, service, and flag in the second feature matrix are one-hot encoded and transformed into feature vectors for training the model, thus obtaining the first data features.

[0058] S24: Perform dimensionality reduction on the numerical features in the second feature matrix to obtain the second data features;

[0059] Firstly, the feature selection algorithm DBIM is used to reduce the dimensionality of the numerical features in the second feature matrix. The feature selection algorithm DBIM mainly consists of two parts: feature integration based on density clustering and feature selection based on importance measurement.

[0060] In terms of feature integration, such as Figure 2 As shown, an optimized DBSCAN algorithm is used to process the data. The traditional DBSCAN algorithm process is as follows: For a dataset S = {x1, x2, ..., x...} n Let x be any point in S. i As a data object, when x i When the number of neighbor samples within the e-neighborhood is greater than the density threshold minpts, then the view x i These are the core sample points. When x i When the core sample is x, find all samples from x. i Density-reachable data object points, i.e., x i All data object points within the e-neighborhood form a cluster. If x i If a data point is not a core sample point, other data object points are selected again until all data object points have been processed. Preferably, the neighborhood parameter e is set to 5 and the density threshold minpts is set to 10.

[0061] The numerical features in the second feature matrix are divided into majority class samples S according to the label distribution. - and minority class samples S + (There are 4 types of tags in total; U2R is the minority tag; Dos, Probe, and R2L are the majority tags.) The majority tag S... - According to minority class S + The sample size is divided into n equal-sized samples (if not divisible, the remaining x majority class samples are evenly distributed among the first x subsets of the divided subsets to balance the sample ratio between the majority and minority classes as much as possible), and the equal-sized samples are then divided with the minority class S. + Generate n combined samples S1, S2, ..., S n .

[0062] For S1, S2, ..., S n Density clustering was performed using the DBSCAN algorithm to obtain cluster sets and boundary point sets; (x * ,y * Let S be the set of boundary points removed by DBSCAN clustering. Find the reverse k-nearest neighbor set of these boundary points, which is represented as:

[0063]

[0064] Calculate boundary points (x) * ,y * ) and its reverse k nearest neighbor sample (x) i ,y i The radial distance between two samples is defined using the radial basis function (RBF):

[0065]

[0066] in, It can be viewed as the squared Euclidean distance between two sample points; σ i It is a variable parameter, which in this invention represents the distance value between the boundary point and its k-th nearest neighbor (the Euclidean distance between the two points).

[0067] Define the threshold d for the effect of density i Used to determine boundary points (x * ,y * The degree of influence on the density of its neighboring points:

[0068]

[0069] Where, x * The x-coordinate of the boundary point is represented by x. i This represents the x-coordinate of the i-th nearest neighbor sample. This represents the set of the reverse k-nearest neighbors of the boundary points.

[0070] Define the critical threshold α as the value of d for all combined samples. i The mean of d i If the value is greater than the critical threshold α, then the boundary sample points of the combined sample are added. In the collection.

[0071] Use the DBSCAN density algorithm to analyze the set The sample points in the data are then subjected to density clustering again, that is, the sample points that are density-connected are traversed and m feature subspaces are formed.

[0072] For feature selection, Fisher Discriminant Analysis (FDA) was used as the feature evaluation criterion. This method is applicable to training datasets X = [x1, x2, ..., x...]. n ],X∈R m×n Assume the sample contains k classes and the feature dimension is D. Fisher discriminant analysis uses S... b Define the inter-class scatter matrix, S w Define the within-class scatter matrix as follows:

[0073]

[0074]

[0075] The Fisher value of feature i is:

[0076]

[0077] Where, n t The category label is K. t The number of training samples; μ t The category label is K. t σ represents the mean of the samples on feature i; μ represents the mean of all training samples on feature i; σ t The population variance of the sample is given.

[0078] For all feature subspaces generated by the feature set, i.e., all cluster sets and m feature subspaces, calculate the Fisher value of each feature (based on the principle that the greater the inter-class dispersion and the smaller the intra-class dispersion, the higher the Fisher value of a feature, the higher its classifiability). Sort the features within their respective groups according to their Fisher values, and select the top S features as the second data features. S can be reasonably selected by obtaining the optimal feature selection result through multiple experiments based on the number of clusters and the classification effect of the model.

[0079] This invention uses Fisher values ​​to test the correlation between features and class labels, and selects features that contribute significantly to the classifier as the result of dimensionality reduction of the dataset according to the principle of importance measurement.

[0080] S25: Combine the first data feature and the second data feature to obtain the training feature vector.

[0081] S3: Input the training feature vector into the network traffic intrusion detection model, and use the particle swarm optimization algorithm to fine-tune the parameters of the network traffic intrusion detection model to obtain the trained network traffic intrusion detection model.

[0082] like Figure 3 As shown, the network traffic intrusion detection model consists of a cascaded input layer, hidden layer, Dropout layer, and fully connected layer; the hidden layer includes a first-layer max pooling layer, a first-layer normalization layer, a first-layer BiLSTM layer, and so on.

[0083] The system consists of a reshape layer, a second max pooling layer, a second batch normalization layer, and a second BiLSTM layer. The input data is then passed through a fully connected layer to output the classification result.

[0084] By inputting training feature vectors into the network and processing them through the model, the intrusion detection results, i.e., the attack type of each intrusion record, can be output.

[0085] The network traffic intrusion detection model proposed in this invention uses one-dimensional convolution as the input layer, and adds a max pooling layer and a batch normalization layer before each BiLSTM layer. Max pooling can effectively eliminate irrelevant features in the input data, and the batch normalization layer is used to normalize the output data of the previous intermediate layer to improve performance and reduce training time.

[0086] The data from the convolutional neural network is then trained through two more BiLSTM layers. The BiLSTM neural network adds a reverse LSTM layer to the LSTM layer. This bidirectional network recursively trains on the hidden states of the start and end points of the sequence, further exploring the relationships between the current data, the previous data, and future data. This allows for further processing of reverse information, optimization of long-term dependencies, and improvement of the model's prediction accuracy. The output value of the BiLSTM is determined by both the forward and reverse hidden layers, and their outputs are given by the following formulas:

[0087]

[0088] in, This represents the output weights of the hidden layer of this unit. This represents the weight of the state quantity from the previous time step to the current time step. Indicates offset, x represents the output value of the hidden layer state at the previous moment. t This represents the feature vector at the t-th time step of the input sequence.

[0089] Dropout can prevent overfitting and improve the accuracy of the basic neural network. This invention uses Dropout to prevent the model from overfitting and outputs the results to a fully connected layer. Softmax is used to obtain the training results and to determine abnormal network traffic and attack types.

[0090] The process of parameter tuning for a network traffic intrusion detection model using the particle swarm optimization algorithm includes:

[0091] The number of convolutional kernels, the number of neurons in the first layer of BiLSTM, the Dropout value, and the learning rate are represented as particles, and the particle parameters are initialized. The particle parameters include: particle swarm size N, particle dimension D, number of iterations, inertia weight, learning factor, iteration step size range, human historical best position, group historical best position, individual historical best fitness value, and group historical best fitness value.

[0092] The initial range for the number of convolution kernels of particles is [1, 80], the initial range for the number of BiLSTM neurons in the first layer is [10, 100], the initial range for the Dropout value is [0.1, 0.8], and the initial range for the learning rate is [0.0001, 0.01].

[0093] The state of any particle i in the population is determined by two quantities: the particle's position and velocity, denoted as X and X, respectively. i =[x i1 x i2 … x iD ] T V i =[v i1 v i2 … v iD ] T Furthermore, during the iteration process, each particle i updates its position and velocity based on its individual and group extreme values. The individual extreme value represents the optimal position found by the i-th particle so far, denoted as P. i =[p i1 p i2 … p iD ] T Its fitness is p besti The population extremum represents the optimal position P found by all particles so far. g =[p g1 p g2 … p gD ] T Its fitness is g besti .

[0094] The model performance index is used as the fitness metric to update the particle's velocity and coordinates; the fitness value is updated based on the particle's velocity and coordinates; preferably, the fitness calculation formula of the present invention is as follows:

[0095] fit = PCB(cn, ls, dr, lr)

[0096] Where: fit represents the fitness value, PCB() represents the optimization function of the particle swarm optimization algorithm, cn represents the number of convolution kernels, ls represents the number of neurons in the first layer of BiLSTM, dr represents the Dropout parameter, and lr represents the learning rate.

[0097] The formula for updating the particle's velocity and coordinates is:

[0098]

[0099]

[0100] in, This represents the velocity vector of particle i in the (k+1)th iteration, with dimension d. This represents the velocity vector of particle i in the d-th dimension during the k-th iteration. This represents the historical optimal position of particle i in the d-th dimension during the k-th iteration. This represents the historical best position of the group in the d-th dimension during the k-th iteration. This represents the d-th dimension position vector of particle i in the k-th iteration. Let represent the position vector of particle i in the (k+1)th iteration in the d-th dimension, w represent the inertia weight, c1 represent the first acceleration factor, c2 represent the second acceleration factor, r1 represent the first random number, and r2 represent the second random number. Generally, the position and velocity of the particle in the d-th dimension are restricted to a certain range, i.e., [-X]. max,d ,X max,d ],[-V max,d V max,d ].

[0101] If the fitness value is better than the individual best value, then the individual best value is updated; if the obtained particle fitness value is better than the population extreme value, then the population extreme value is updated. When the number of iterations or the fitness value between two iterations is minimized, the optimized network traffic intrusion detection model is obtained.

[0102] S4: The test set is processed using a trained network traffic intrusion detection model to obtain intrusion detection results.

[0103] By inputting the test set into the trained network traffic intrusion detection model, the intrusion detection results of the test set can be obtained, that is, the attack type of each traffic record in the test set.

[0104] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting network traffic intrusion, characterized in that, include: S1: Obtain the training dataset and divide it into training and test sets; S2: Preprocess the training set to obtain training feature vectors; The preprocessing of the training set includes: S21: Use a two-dimensional matrix to store the feature information of the training set to obtain the first feature matrix; S22: Normalize the first feature matrix to obtain the second feature matrix; S23: Perform one-hot encoding on the character-type features in the second feature matrix to obtain the first data features; S24: Perform dimensionality reduction on the numerical features in the second feature matrix to obtain the second data features; the process of dimensionality reduction on the numerical features in the second feature matrix includes: The numerical features in the second feature matrix are divided into majority class samples according to the label distribution. and minority class samples , will the majority class According to minority categories The quantity is divided into Each equal-sized sample is then divided into several equal-sized samples, and these samples are then compared with the minority class. Generate n combined samples; right Density clustering was performed using the DBSCAN algorithm to obtain cluster sets and boundary point sets. In each combined sample, the inverse boundary points were found based on the boundary point set. Nearest neighbor sample set; calculate boundary points and their opposite directions. Radial distance between nearest neighbor samples; Based on the boundary point and its opposite direction The radial distance between nearest neighbor samples is used to calculate the density effect threshold. : ； ； in, Represents the x-coordinate of the boundary point. This represents the x-coordinate of the i-th nearest neighbor sample. Indicates the reverse direction of the boundary point Nearest neighbor set Represents radial basis functions. This represents the squared Euclidean distance between two sample points; Indicate the boundary point and its first... The distance value of the nearest neighbor; Define critical threshold Represents all combined samples The mean, if Greater than the critical threshold Then add the boundary sample points of the combined sample. In the set; Use the DBSCAN density algorithm to analyze the set The sample points in the data are then subjected to density clustering again to obtain... A feature subspace; Fisher discriminant analysis was used to calculate all cluster sets and The Fisher values ​​of features in each feature subspace are obtained and sorted according to their Fisher values. The top S features are selected as the second data features. S25: Combine the first data feature and the second data feature to obtain the training feature vector; S3: Input the training feature vector into the network traffic intrusion detection model, and use the particle swarm optimization algorithm to fine-tune the parameters of the network traffic intrusion detection model to obtain the trained network traffic intrusion detection model. S4: The test set is processed using a trained network traffic intrusion detection model to obtain intrusion detection results.

2. The network traffic intrusion detection method according to claim 1, characterized in that, The network traffic intrusion detection model consists of a cascaded input layer, a hidden layer, a Dropout layer, and a fully connected layer.

3. The network traffic intrusion detection method according to claim 2, characterized in that, The input layer is a one-dimensional convolution, and the hidden layers include a first max pooling layer, a first batch normalization layer, a first BiLSTM layer, a reshape layer, a second max pooling layer, a second batch normalization layer, and a second BiLSTM layer.

4. The network traffic intrusion detection method according to claim 3, characterized in that, The process of parameter tuning for a network traffic intrusion detection model using the particle swarm optimization algorithm includes: The number of convolutional kernels, the number of neurons in the first BiLSTM layer, the Dropout value, and the learning rate are represented as particles, and the particle parameters are initialized. The model performance metrics are used as fitness to update the particle's velocity and coordinates; the fitness value is then updated based on the particle's velocity and coordinates. When the number of iterations or the fitness value between two iterations is minimized, the optimized network traffic intrusion detection model is obtained.

5. The network traffic intrusion detection method according to claim 4, characterized in that, The formula for updating the particle's velocity and coordinates is: ； ； in, Represents particles In the In the nth iteration 3D velocity vector Represents particles In the The second 3D velocity vector Represents particles In the In the nth iteration Dimension's historical best position Indicates the group in the th In the nth iteration Dimension's historical best position Represents particles In the In the nth iteration 3D position vector Represents particles In the In the nth iteration 3D position vector Indicates inertia weight, Indicates the first acceleration factor. Indicates the second acceleration factor. Represents the first random number. This represents the second random number.

6. The network traffic intrusion detection method according to claim 4, characterized in that, The formula for calculating fitness is: ； in: Indicates the fitness value. This represents the optimization function of the particle swarm optimization algorithm. Indicates the number of convolution kernels. This indicates the number of neurons in the first layer of the BiLSTM. This represents the Dropout parameter. This represents the learning rate.

Images