Network anomaly detection method and device based on GMD visualization and improved ResNeXt

Abstract

To address the weakness of feature extraction in network anomaly detection, this invention transforms the one-dimensional input feature attribute data into a two-dimensional RGB image, thus converting the network anomaly detection problem into an image anomaly detection problem. Furthermore, a spatial attention mechanism is introduced into the ResNeXt network model to improve its feature extraction capability. This invention discloses a dynamic network anomaly detection method based on GMD visualization and an improved ResNeXt. First, an visualization method combining Gram's corner field, Markov transition field, and difference coding is used to transform the input data into a two-dimensional RGB image. Then, the standard convolution in the ResNeXt network structure is replaced with MA-Dilated convolutions that dynamically adjust the receptive field. The improved ResNeXt network is used for feature extraction, and finally, an extreme learning machine is used to complete the classification, achieving efficient and accurate detection of anomaly data.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence information security technology, and in particular to a network anomaly detection method and apparatus based on GMD visualization and improved ResNeXt. Background Technology

[0002] Network anomaly detection, as an important security technology in the field of network security, extracts valuable traffic features from network data and uses these features to build a binary classification model to better identify abnormal network traffic. This effectively prevents network attacks, protects critical data such as personal information and assets from theft and damage, improves the security of computer systems, and maintains the information security of the internet environment. Compared with traditional intrusion detection technologies, network anomaly detection technology not only has lower model training costs but also can more effectively detect abnormal behavior in the network, making it an important protective measure in the field of network security today.

[0003] Currently, network anomaly detection technologies are classified into five categories: statistical learning-based, machine learning-based, deep learning-based, ensemble learning-based, and protocol analysis-based network anomaly detection. Statistical learning-based network anomaly detection is an early technique that captures historical network traffic data, analyzes the relationships between data points, uses statistical knowledge to build a normal network model, and then performs detection based on this model. Machine learning-based network anomaly detection trains a model based on the correlation mapping between input and output data, and then performs detection based on this model. Deep learning-based network anomaly detection builds upon machine learning by employing neural networks with deep learning capabilities. Ensemble learning-based network anomaly detection uses multiple learners to train the overall data and perform subsequent detection. Protocol analysis-based network anomaly detection constructs a training model of normal behavior and compares observed activities to this model to determine if they deviate from the normal behavior pattern.

[0004] Current network anomaly detection technologies have weak feature extraction capabilities, and the extracted features cannot contain all the important information in the original data, leading to problems such as low detection accuracy and high false positive rates. Furthermore, in real-world network scenarios, traffic often contains a large amount of useless information. This "damaged data" containing useless information hinders network anomaly detection and reduces the anomaly detection performance of the model. Summary of the Invention

[0005] This invention addresses the shortcomings of existing technologies by providing a network-based anomaly detection method based on GMD image visualization and an improved ResNeXt, focusing on enhancing feature extraction capabilities and improving robustness. This method transforms the one-dimensional input raw data into a two-dimensional image and uses a ResNeXt network structure incorporating a spatial attention mechanism for feature extraction, thereby improving feature extraction capabilities. Furthermore, this method adds Gaussian white noise to the raw data before model training, thus improving the robustness of the detection method in noisy environments.

[0006] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0007] The first aspect provides a network anomaly detection method based on GMD visualization and improved ResNeXt, including:

[0008] S1: Preprocess the raw network traffic data. Preprocessing includes encoding, standardization, and dividing the data into training sample sets and test sample sets. The data contained in the training sample sets and test sample sets are one-dimensional data.

[0009] S2: Use a GMD-based visualization method to perform two-dimensional visualization on the one-dimensional data obtained in step S1;

[0010] S3: The improved ResNeXt is used to extract features from the transformed two-dimensional data. The improved ResNeXt is a ResNeXt network with embedded spatial attention mechanism. The improved ResNeXt replaces the standard convolution in the original ResNeXt network structure with an expanded convolution that can dynamically adjust the size of the receptive field according to the features, and extracts the differential features between different regions in a targeted and selective manner.

[0011] S4: Input the training data after feature extraction in step S3 into the kernel extreme learning machine classifier for training to obtain the trained model. Gaussian white noise is added to the training data before it is input into the kernel extreme learning machine classifier.

[0012] S5: Input the test data, which has also undergone feature extraction in step S3, into the trained model to perform network anomaly detection.

[0013] In one implementation, the encoding and standardization in step S1 includes:

[0014] The character features in the original network traffic data are converted into binary vectors using OneHot encoding, and the numerical features are scaled to the range of [-1, 1] using the Min-Max normalization method.

[0015] In one implementation, step S2 includes:

[0016] S2.1: The Gram angle field matrix of the training sample set is calculated using the Gram angle field method and used as the R channel matrix of the final image. The Gram angle field matrix is ​​calculated by using the cos function of the sum of the angles φ corresponding to two different features in the training sample set.

[0017] S2.2: The Markov transition field matrix of the training sample set is calculated using the Markov transition field method and used as the G-channel matrix of the final image;

[0018] S2.3: The difference coding matrix of the training sample set is calculated using the difference coding method and used as the B-channel matrix of the final image;

[0019] S2.4: Perform numerical transformation on the R channel matrix, G channel matrix, and B channel matrix. Use the three transformed matrices as pixel matrices for the R, G, and B channels. Stack the three two-dimensional matrices to obtain a three-dimensional matrix with 3 channels, forming the final image sample.

[0020] In one implementation, step S2.1 includes:

[0021] The training sample set data sequence is converted into a polar coordinate time series, and the calculation formula is as follows:

[0022]

[0023] Where i represents the image index, φ is the angle of the time series feature in polar coordinates, and v i It is the general coordinate representation of the time series feature of the i-th data or image in the training sample set, where V is the time series feature set, and r is the coordinate representation of the time series feature set. i It is the radius of the time series in polar coordinates, t i It is the index of the current time series in the time series set, and N is the total number of records in the time series;

[0024] The Gram angular field matrix M is calculated using the cosine function of the sum of angles φ corresponding to two different features in the training sample set. GAF The calculation formula is as follows:

[0025]

[0026] Among them, φ1, φ2, φ n These are the angles corresponding to different features.

[0027] In one implementation, step S2.2 includes:

[0028] All data in the training sample set are classified into Q quantiles;

[0029] The transition between quantiles is analyzed using the form of a first-order Markov chain, and the Markov transition field matrix M is constructed. MTF The calculation formula is as follows:

[0030]

[0031] Where k and l represent two arbitrary states, W k,l The counting matrix representing states k to l, x1, x2, ..., x n It is time series data, q k It is x k The partition bucket, q l It is x l The partition bucket.

[0032] In one implementation, step S2.3 includes:

[0033] For the training sample set V = {v1, v2, ..., v...} n When i = j, 1 ≤ i, j ≤ n, retain the original data, i.e., v. i When i ≠ j, 1 ≤ i, j ≤ n, calculate the difference between two different features in the training sample set, i.e., v i -v j The calculation formula is as follows:

[0034]

[0035] Among them, v1, v2 and v n The general coordinate representation of the time series features of the first, second, and nth data points in the training sample set.

[0036] In one implementation, step S3 includes:

[0037] S3.1: For the input feature map, three feature maps with different receptive fields are obtained by using three grouped convolutions with kernel size of 3×3 and dilation rates of 1, 2 and 3, respectively, and the batch normalized ReLU activation function.

[0038] S3.2: Add the three feature maps obtained in step S3.1, calculate the global information vector using the global average pooling layer and the global max pooling layer respectively, and fuse them to form a vector;

[0039] S3.3: The weight vectors of the three feature maps with different receptive fields are calculated by using the Softmax method, and then the weight vectors are used to fuse the three feature maps to obtain the output feature map.

[0040] In one implementation, step S4 includes:

[0041] S4.1: Input training data into the classifier. The training data includes data features and sample label categories.

[0042] S4.2: Select the Gaussian kernel function as the kernel function for the kernel limit learning machine, and set the kernel parameters to (2... 0 ,1e 5 );

[0043] S4.3: The input-output relationship matrix β of the extreme learning machine is calculated using the kernel function;

[0044] S4.4: Use the relation matrix β analysis to obtain the classification results.

[0045] Based on the same inventive concept, a second aspect of the present invention provides a network anomaly detection device based on GMD image processing and improved ResNeXt, comprising:

[0046] The preprocessing module is used to preprocess the raw network traffic data. The preprocessing includes encoding, standardization, and dividing the data into training sample sets and test sample sets, where the data in the training sample sets and test sample sets are one-dimensional data.

[0047] The image conversion module is used to perform two-dimensional image conversion on the one-dimensional data obtained by the preprocessing module using a GMD-based image conversion method;

[0048] The feature extraction module is used to extract features from the transformed two-dimensional data using an improved ResNeXt. The improved ResNeXt is a ResNeXt network with an embedded spatial attention mechanism. The improved ResNeXt replaces the standard convolution in the original ResNeXt network structure with an expanded convolution that can dynamically adjust the receptive field size according to the features, and extracts the differential features between different regions in a targeted and selective manner.

[0049] The training module is used to input the training data after feature extraction by the feature extraction module into the kernel extreme learning machine classifier for training to obtain a trained model. Gaussian white noise is added to the training data before it is input into the kernel extreme learning machine classifier.

[0050] The anomaly detection module is used to input the test data, which has also undergone feature extraction by the feature extraction module, into the trained model to perform network anomaly detection.

[0051] Based on the same inventive concept, a third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described in the first aspect.

[0052] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0053] This invention discloses a network anomaly detection method based on GMD image visualization and an improved ResNeXt. It uses a GMD-based image visualization method to transform one-dimensional input raw data into a two-dimensional image, replaces the standard convolution in the ResNeXt network structure with MA-Dilated convolution (dilated convolution) with dynamic receptive field adjustment function, uses the improved ResNeXt network for feature extraction, and finally uses an extreme learning machine to complete the classification work, which can achieve efficient and accurate detection of anomalous data. Attached Figure Description

[0054] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0055] Figure 1 This is a flowchart of the data processing in the method disclosed in the embodiments of the present invention;

[0056] Figure 2 This is a flowchart of model training in an embodiment of the present invention;

[0057] Figure 3 This is a flowchart illustrating network anomaly detection using test data input into a trained model, as described in an embodiment of the present invention. Detailed Implementation

[0058] To address the weakness of feature extraction in network anomaly detection, this invention transforms the one-dimensional input feature attribute data into a two-dimensional RGB image, thus converting the network anomaly detection problem into an image anomaly detection problem. Furthermore, a spatial attention mechanism is introduced into the ResNeXt network model to improve its feature extraction capability. Specifically, the dynamic network anomaly detection method based on GMD visualization and improved ResNeXt disclosed in this invention first transforms the input data into a two-dimensional RGB image using a visualization method combining Gram's angle field, Markov transition field, and difference coding (GMD). Then, the standard convolution in the ResNeXt network structure is replaced with MA-Dilated convolutions that dynamically adjust the receptive field. The improved ResNeXt network is then used for feature extraction, and finally, an extreme learning machine is used to complete the classification, enabling efficient and accurate detection of anomaly data.

[0059] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0060] Example 1

[0061] This embodiment discloses a network anomaly detection method based on GMD visualization and improved ResNeXt, including:

[0062] S1: Preprocess the raw network traffic data. Preprocessing includes encoding, standardization, and dividing the data into training sample sets and test sample sets. The data contained in the training sample sets and test sample sets are one-dimensional data.

[0063] S2: Use a GMD-based visualization method to perform two-dimensional visualization on the one-dimensional data obtained in step S1;

[0064] S3: The improved ResNeXt is used to extract features from the transformed two-dimensional data. The improved ResNeXt is a ResNeXt network with embedded spatial attention mechanism. The improved ResNeXt replaces the standard convolution in the original ResNeXt network structure with an expanded convolution that can dynamically adjust the size of the receptive field according to the features, and extracts the differential features between different regions in a targeted and selective manner.

[0065] S4: Input the training data after feature extraction in step S3 into the kernel extreme learning machine classifier for training to obtain the trained model. Gaussian white noise is added to the training data before it is input into the kernel extreme learning machine classifier.

[0066] S5: Input the test data, which has also undergone feature extraction in step S3, into the trained model to perform network anomaly detection.

[0067] Specifically, step S1 preprocesses the raw network traffic data and divides the dataset to ensure that the neural network model can accurately identify data in a specific format, and adds Gaussian white noise to the training data to improve the robustness of the detection model.

[0068] Step S2 designs a novel visualization method based on Gramian angular field, Markov transition field, and difference coding (GMD) to perform two-dimensional visualization transformation on the one-dimensional data obtained in step S1. This method is called GMD visualization method. It ensures that the feature size of the preprocessed data meets the input requirements of the convolutional neural network, and does not lose some of the original data while ensuring simple implementation.

[0069] Step S3 uses a ResNeXt network with embedded spatial attention mechanism for feature extraction.

[0070] Step S4 is model training. Step S5 is to input the test sample set, which has also undergone feature extraction in step S3, into the model to perform network anomaly detection, thereby verifying whether the performance of network anomaly detection has been improved.

[0071] The network anomaly detection method based on GMD image processing and improved ResNeXt proposed in this invention can solve the problems of weak feature extraction ability and poor robustness in noisy environments of existing network anomaly detection models, thereby achieving the technical effect of improving detection accuracy.

[0072] In one implementation, step S1 encoding and standardization includes:

[0073] The character features in the original network traffic data are converted into binary vectors using OneHot encoding, and the numerical features are scaled to the range of [-1, 1] using the Min-Max normalization method.

[0074] The above processing of the raw network traffic data facilitates subsequent model training. Gaussian white noise is added to the training sample set before it is used for model training, while no processing is performed on the test sample set.

[0075] In one implementation, step S2 includes:

[0076] S2.1: The Gram angle field matrix of the training sample set is calculated using the Gram angle field method and used as the R channel matrix of the final image. The Gram angle field matrix is ​​calculated by using the cos function of the sum of the angles φ corresponding to two different features in the training sample set.

[0077] S2.2: The Markov transition field matrix of the training sample set is calculated using the Markov transition field method and used as the G-channel matrix of the final image;

[0078] S2.3: The difference coding matrix of the training sample set is calculated using the difference coding method and used as the B-channel matrix of the final image;

[0079] S2.4: Perform numerical transformation on the R channel matrix, G channel matrix, and B channel matrix. Use the three transformed matrices as pixel matrices for the R, G, and B channels. Stack the three two-dimensional matrices to obtain a three-dimensional matrix with 3 channels, forming the final image sample.

[0080] In one implementation, step S2.1 includes:

[0081] The training sample set data sequence is converted into a polar coordinate time series, and the calculation formula is as follows:

[0082]

[0083] Where i represents the image index, φ is the angle of the time series feature in polar coordinates, and v i It is the general coordinate representation of the time series feature of the i-th data or image in the training sample set, where V is the time series feature set, and r is the coordinate representation of the time series feature set. i It is the radius of the time series in polar coordinates, t i It is the index of the current time series in the time series set, and N is the total number of records in the time series;

[0084] The Gram angular field matrix M is calculated using the cosine function of the sum of angles φ corresponding to two different features in the training sample set. GAF The calculation formula is as follows:

[0085]

[0086] Among them, φ1, φ2, φ n These are the angles corresponding to different features.

[0087] In one implementation, step S2.2 includes:

[0088] All data in the training sample set are classified into Q quantiles;

[0089] The transition between quantiles is analyzed using the form of a first-order Markov chain, and the Markov transition field matrix M is constructed. MTF The calculation formula is as follows:

[0090]

[0091] Where k and l represent two arbitrary states, W k，l The counting matrix representing states k to l, x1, x2, ..., x n It is time series data, q k It is xk The partition bucket, q l It is x l The partition bucket.

[0092] In one implementation, step S2.3 includes:

[0093] For the training sample set V = {v1, v2, ..., v...} n When i = j, 1 ≤ i, j ≤ n, retain the original data, i.e., v. i When i ≠ j, 1 ≤ i, j ≤ n, calculate the difference between two distinct features in the training sample set, i.e., v i -v j The calculation formula is as follows:

[0094]

[0095] Among them, v1, v2 and v n The general coordinate representation of the time series features of the first, second, and nth data points in the training sample set, M. diff This is the difference encoding matrix.

[0096] In the specific implementation process, for the matrices on the three channels calculated in steps 2.1, 2.2, and 2.3, step S2.4 uses the following formula to perform numerical transformation, thereby eliminating negative values ​​in the original matrices. The three transformed matrices are then used as pixel matrices for the R, G, and B channels, and the three two-dimensional matrices are stacked to obtain a three-dimensional matrix with three channels, forming the final image sample.

[0097]

[0098] Among them, M max M represents the maximum value in M. min Let M represent the minimum value in M, and I be the identity matrix.

[0099] In one implementation, step S3 includes:

[0100] S3.1: For the input feature map, three feature maps with different receptive fields are obtained by using three grouped convolutions with kernel size of 3×3 and dilation rates of 1, 2 and 3, respectively, and the batch normalized ReLU activation function.

[0101] S3.2: Add the three feature maps obtained in step S3.1, calculate the global information vector using the global average pooling layer and the global max pooling layer respectively, and fuse them to form a vector;

[0102] S3.3: The weight vectors of the three feature maps with different receptive fields are calculated by using the Softmax method, and then the weight vectors are used to fuse the three feature maps to obtain the output feature map.

[0103] Specifically, in step S3.1, for the input feature map X∈R H+W+C H, W, and C represent the height, width, and number of channels of the feature map, respectively. Three feature maps U1∈R with different receptive fields are obtained through three grouped convolutions with kernel sizes of 3×3 and dilation rates of 1, 2, and 3, followed by a batch normalized ReLU activation function. H+W+C U2∈R H+W+C U3∈R H+W+C .

[0104] Step S3.2 is implemented in the following manner:

[0105] First, add the three feature maps obtained in step S3.1 together:

[0106] U = U1 + U2 + U3

[0107] Then, the global information vectors s1 and s2 are calculated using the global average pooling layer and the global max pooling layer respectively, and then fused to form vector s.

[0108]

[0109]

[0110] s = s1 + s2

[0111] Where h represents the horizontal index of the feature map, w represents the vertical index of the feature map, and U(h, w) represents the feature value of the feature map at position (h, w).

[0112] Step S3.3 is implemented in the following manner:

[0113] First, the weight vectors of different receptive field feature maps are calculated using the Softmax method. The calculation of the i-th row of the feature map is shown below.

[0114]

[0115]

[0116]

[0117] Among them, a i Let b represent the i-th sequence value of the weight vector a. i c represents the i-th sequence value of the weight vector b. i A represents the i-th sequence value of the weight vector c;i B represents the i-th row of feature map U1. i C represents the i-th row of feature map U2. i This represents the i-th row of feature map U3.

[0118] Then, the three feature maps are fused using a weight vector to obtain the output feature map Y∈R. H+W+C :

[0119] Y = a × U1 + b × U2 + c × U3

[0120] Where a, b, and c are the weight vectors of feature maps U1, U2, and U3, respectively.

[0121] In one implementation, step S4 includes:

[0122] S4.1: Input training data into the classifier. The training data includes data features and sample label categories.

[0123] S4.2: Select the Gaussian kernel function as the kernel function for the kernel limit learning machine, and set the kernel parameters as follows: 2 0, 1e 5 );

[0124] S4.3: The input-output relationship matrix β of the extreme learning machine is calculated using the kernel function;

[0125] S4.4: Use the relation matrix β analysis to obtain the classification results.

[0126] The technical solution of the present invention will be further described in detail below through specific embodiments and in conjunction with the accompanying drawings.

[0127] The input raw network traffic data in this invention uses a network intrusion detection dataset. The initial input data undergoes data preprocessing before training and testing the network anomaly detection model. See [link / reference] Figure 1 First, when character features exist in the input data, they are converted into numerical features using OneHot encoding. Then, the data is scaled to the range [-1, 1] using Min-Max normalization. Finally, the data is evaluated as a training set; if it is a training set, Gaussian white noise is added before model training; otherwise, anomaly detection is performed.

[0128] Figure 2 This is the model training process of the present invention, which will Figure 1The predefined test sample set is input into the model. Let c% be the accuracy required to meet the network anomaly detection standard. The model is determined by judging the results of the most recent ten training iterations. If the average detection accuracy of the ten experiments is greater than or equal to c%, the model meets the network anomaly detection standard, training ends, and network anomaly detection is performed. Otherwise, training continues until the model reaches the expected accuracy.

[0129] Figure 3 This is the network anomaly detection process of the present invention, which will Figure 1 The predefined test sample set is input into the model. Using a GMD-based image processing method and an improved ResNeXt network structure, feature vectors are extracted. The feature vectors are then input into a kernel extreme learning machine classifier to predict the traffic classification of the input samples. If the input traffic belongs to attack traffic, it indicates that there is an anomaly in the network; otherwise, it indicates that there is no anomaly in the network.

[0130] Example 2

[0131] Based on the same inventive concept, this embodiment discloses a network anomaly detection device based on GMD image visualization and improved ResNeXt, including:

[0132] The preprocessing module is used to preprocess the raw network traffic data. The preprocessing includes encoding, standardization, and dividing the data into training sample sets and test sample sets, where the data in the training sample sets and test sample sets are one-dimensional data.

[0133] The image conversion module is used to perform two-dimensional image conversion on the one-dimensional data obtained by the preprocessing module using a GMD-based image conversion method;

[0134] The feature extraction module is used to extract features from the transformed two-dimensional data using an improved ResNeXt. The improved ResNeXt is a ResNeXt network with an embedded spatial attention mechanism. The improved ResNeXt replaces the standard convolution in the original ResNeXt network structure with an expanded convolution that can dynamically adjust the receptive field size according to the features, and extracts the differential features between different regions in a targeted and selective manner.

[0135] The training module is used to input the training data after feature extraction by the feature extraction module into the kernel extreme learning machine classifier for training to obtain a trained model. Gaussian white noise is added to the training data before it is input into the kernel extreme learning machine classifier.

[0136] The anomaly detection module is used to input the test data, which has also undergone feature extraction by the feature extraction module, into the trained model to perform network anomaly detection.

[0137] Since the apparatus described in Embodiment 2 of this invention is the same apparatus used to implement the network anomaly detection method based on GMD image processing and improved ResNeXt in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this apparatus based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All apparatuses used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0138] Example 3

[0139] Based on the same inventive concept, the present invention also provides a computer-readable storage medium having a computer program stored thereon, which, when executed, implements the method described in Embodiment 1.

[0140] Since the computer-readable storage medium described in Embodiment 3 of this invention is the same computer-readable storage medium used in implementing the network anomaly detection method based on GMD image processing and improved ResNeXt in Embodiment 1 of this invention, those skilled in the art can understand the specific structure and variations of this computer-readable storage medium based on the method described in Embodiment 1 of this invention, and therefore will not be repeated here. All computer-readable storage media used in the method of Embodiment 1 of this invention fall within the scope of protection of this invention.

[0141] It will be understood by those skilled in the art that embodiments of the present invention may be provided as methods, systems, or computer program products. Thus, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Furthermore, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0142] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0143] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention. Clearly, those skilled in the art can make various modifications and variations to the embodiments of the invention without departing from the spirit and scope of the invention. Thus, if these modifications and variations of the embodiments of the invention fall within the scope of the claims of the invention and their equivalents, the invention also intends to include these modifications and variations.

Claims

1. A network anomaly detection method based on GMD image visualization and improved ResNeXt, characterized in that, include: S1: Preprocess the raw network traffic data. Preprocessing includes encoding, standardization, and dividing the data into training sample sets and test sample sets. The data contained in the training sample sets and test sample sets are one-dimensional data. S2: Use a GMD-based visualization method to perform two-dimensional visualization on the one-dimensional data obtained in step S1; S3: The improved ResNeXt is used to extract features from the transformed two-dimensional data. The improved ResNeXt is a ResNeXt network with embedded spatial attention mechanism. The improved ResNeXt replaces the standard convolution in the original ResNeXt network structure with an expanded convolution that can dynamically adjust the size of the receptive field according to the features, and extracts the differential features between different regions in a targeted and selective manner. S4: Input the training data after feature extraction in step S3 into the kernel extreme learning machine classifier for training to obtain the trained model. Gaussian white noise is added to the training data before it is input into the kernel extreme learning machine classifier. S5: Input the test data, which has also undergone feature extraction in step S3, into the trained model to perform network anomaly detection. Step S3 includes: S3.1: For the input feature map, respectively, through convolution kernels with a size of... Three grouped convolutions with dilation rates of 1, 2, and 3, along with a batch normalized ReLU activation function, yield three feature maps with different receptive fields. S3.2: Add the three feature maps obtained in step S3.1, calculate the global information vector using the global average pooling layer and the global max pooling layer respectively, and fuse them to form a vector; S3.3: The weight vectors of the three feature maps with different receptive fields are calculated by using the Softmax method, and then the weight vectors are used to fuse the three feature maps to obtain the output feature map.

2. The network anomaly detection method based on GMD image processing and improved ResNeXt as described in claim 1, characterized in that, The encoding and standardization in step S1 include: The character features in the original network traffic data are converted into binary vectors using OneHot encoding, and the numerical features are scaled to the range of [-1, 1] using the Min-Max normalization method.

3. The network anomaly detection method based on GMD image processing and improved ResNeXt as described in claim 1, characterized in that, Step S2 includes: S2.1: Based on the training sample set, the Gram angle field matrix of the training sample set is calculated using the Gram angle field method and used as the R-channel matrix of the final image. This is achieved by using the angles corresponding to two different features in the training sample set. The Gram angular field matrix is ​​obtained by calculating the cosine function of the sum. S2.2: The Markov transition field matrix of the training sample set is calculated using the Markov transition field method and used as the G-channel matrix of the final image. S2.3: The difference coding matrix of the training sample set is calculated using the difference coding method and used as the B-channel matrix of the final image; S2.4: Perform numerical transformation on the R channel matrix, G channel matrix, and B channel matrix. Use the three transformed matrices as pixel matrices for the R, G, and B channels. Stack the three two-dimensional matrices to obtain a three-dimensional matrix with 3 channels, forming the final image sample.

4. The network anomaly detection method based on GMD image processing and improved ResNeXt as described in claim 3, characterized in that, Step S2.1 includes: The training sample set data sequence is converted into a polar coordinate time series, and the calculation formula is as follows: in, Indicates the image sequence number. It is the angle of the time series feature in polar coordinates. It is the general coordinate representation of the time series feature of the i-th data or image in the training sample set. It is a set of time series features. It is the radius of the time series in polar coordinates. It is the index of the current time series in the time series collection. It is the total number of records in the time series; By using the angles corresponding to two different features in the training sample set sum of cos The Gram angular field matrix is ​​obtained by function calculation. The calculation formula is as follows: in, , , These are the angles corresponding to different features.

5. The network anomaly detection method based on GMD image processing and improved ResNeXt as described in claim 3, characterized in that, Step S2.2 includes: Classify all data in the training sample set into quantiles; The transition between quantiles is analyzed using the form of a first-order Markov chain, and the Markov transition field matrix is ​​constructed. The calculation formula is as follows: in, and Represents two arbitrary states, Representing state arrive The counting matrix, It is time series data. yes The partition bucket, yes The partition bucket.

6. The network anomaly detection method based on GMD image processing and improved ResNeXt as described in claim 3, characterized in that, Step S2.3 includes: For the training sample set ,when At that time, retain the original data, that is ;when At that time, the difference between two different features in the training samples is calculated, i.e. The calculation formula is as follows: in, , and It is a general coordinate representation of the time series features of the first, second, and nth data points in the training sample set.

7. The network anomaly detection method based on GMD image processing and improved ResNeXt as described in claim 1, characterized in that, Step S4 includes: S4.1: Input training data into the classifier. The training data includes data features and sample label categories. S4.2: Select the Gaussian kernel function as the kernel function for the kernel limit learning machine, and set the kernel parameters as follows: ); S4.3: The input-output relationship matrix of the extreme learning machine is calculated using the kernel function. ; S4.4: Using a relational matrix The classification results are obtained by analyzing the test sample set.

8. A network anomaly detection device based on GMD image processing and improved ResNeXt, characterized in that, include: The preprocessing module is used to preprocess the raw network traffic data. The preprocessing includes encoding, standardization, and dividing the data into training sample sets and test sample sets, where the data in the training sample sets and test sample sets are one-dimensional data. The image conversion module is used to perform two-dimensional image conversion on the one-dimensional data obtained by the preprocessing module using a GMD-based image conversion method; The feature extraction module is used to extract features from the transformed two-dimensional data using an improved ResNeXt. The improved ResNeXt is a ResNeXt network with an embedded spatial attention mechanism. The improved ResNeXt replaces the standard convolution in the original ResNeXt network structure with an expanded convolution that can dynamically adjust the receptive field size according to the features, and extracts the differential features between different regions in a targeted and selective manner. The training module is used to input the training data after feature extraction by the feature extraction module into the kernel extreme learning machine classifier for training to obtain a trained model. Gaussian white noise is added to the training data before it is input into the kernel extreme learning machine classifier. The anomaly detection module is used to input the test data, which has also undergone feature extraction by the feature extraction module, into the trained model to perform network anomaly detection. Specifically, the feature extraction module performs the following steps: S3.1: For the input feature map, respectively, through convolution kernels with a size of... Three grouped convolutions with dilation rates of 1, 2, and 3, along with a batch normalized ReLU activation function, yield three feature maps with different receptive fields. S3.2: Add the three feature maps obtained in step S3.1, calculate the global information vector using the global average pooling layer and the global max pooling layer respectively, and fuse them to form a vector; S3.3: The weight vectors of the three feature maps with different receptive fields are calculated by using the Softmax method, and then the weight vectors are used to fuse the three feature maps to obtain the output feature map.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed, it implements the method as described in any one of claims 1 to 7.

Images