A method for constructing an intrusion detection model, an intrusion detection method, and related devices

Abstract

Embodiments of the present application disclose a method for constructing an intrusion detection model, an intrusion detection method and related devices. First, a historical detection data set is obtained, and the historical detection data set is preprocessed to obtain first preprocessed data. Then, the first preprocessed data is initialized to obtain initialization data by using an IHHO optimization algorithm, an adaptive elite learning strategy, a sine-cosine strategy, a chaotic energy strategy and a random dimension quantum rotation gate mutation strategy. The initialization data is iteratively calculated by using a fitness function to obtain an optimal feature subset, and the optimal feature subset is divided into a training set and a test set. Then, the training set and the IHHO optimization algorithm are used to train a model based on a DQN classification algorithm to obtain an intrusion detection model. The intrusion detection model is constructed by combining the IHHO optimization algorithm and the DQN classification algorithm, and the intrusion detection model obtained by the combination has higher accuracy in intrusion detection.

Description

Technical Field

[0001] This application relates to the fields of artificial intelligence and finance, specifically to a method for constructing an intrusion detection model, an intrusion detection method, and related devices. Background Technology

[0002] Industrial control system (ICS) security is indeed a significant challenge. Because ICS systems are often involved in critical national infrastructure, such as power and water treatment, any security breach or attack can have serious consequences for people's lives and the functioning of society.

[0003] Traditional signature-based and anomaly-based intrusion detection systems have some limitations in industrial control networks. Signature-based intrusion detection methods primarily detect malicious behavior by matching the characteristics of known attacks, but this method cannot effectively detect novel attacks that have not been previously seen. Furthermore, anomaly-based intrusion detection methods may generate a large number of false positives and struggle to identify normal behavioral patterns, resulting in a high false positive rate.

[0004] Therefore, how to reduce the false alarm rate of intrusion detection and improve its detection performance is a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a method for constructing an intrusion detection model, an intrusion detection method, and related apparatus, which can reduce the false alarm rate of intrusion detection and improve its detection performance.

[0006] The embodiments of this application disclose the following technical solutions:

[0007] A method for constructing an intrusion detection model, the method comprising:

[0008] Obtain historical detection datasets;

[0009] The historical detection dataset is preprocessed to obtain the first preprocessed data;

[0010] Initialized data is obtained by initializing the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy.

[0011] The optimal feature subset is obtained by iteratively calculating the initial data using the fitness function, and the optimal feature subset is then divided into a training set and a test set.

[0012] The intrusion detection model is obtained by training the model using the training set and the IHHO optimization algorithm based on the Deep Q-Network (DQN) classification algorithm.

[0013] In some possible implementations, the initialization of the first preprocessed data using the IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy includes:

[0014] The first preprocessed data is optimized using the IHHO optimization algorithm to obtain optimized data.

[0015] The adaptive elite learning strategy is used to adaptively learn from the optimized data to obtain adaptive data.

[0016] The Harris Eagle position in the adaptive data is updated using the sine and cosine strategies to obtain updated data;

[0017] The escape energy factor is obtained by performing chaotic mapping on the updated data using the chaotic energy strategy.

[0018] The initialization data is obtained by performing quantum computation on the escape energy factor using the random dimension quantum rotation gate mutation strategy.

[0019] In some possible implementations, the Deep Q-Network (DQN) classification algorithm uses the training set and the IHHO optimization algorithm to train an intrusion detection model, including:

[0020] Construct a preliminary intrusion detection model;

[0021] Within the preliminary intrusion detection model, a Markov process is simulated using the training set to obtain the state-action value function;

[0022] The state-action value function is transformed into a function fitting problem using the DQN classification algorithm.

[0023] The intermediate intrusion detection model is obtained by iteratively training the problem using the aforementioned function fitting;

[0024] The intrusion detection model is obtained by optimizing the intermediate intrusion detection model using the IHHO optimization algorithm.

[0025] In some possible implementations, the method further includes:

[0026] The test set is input into the intrusion detection model to obtain the prediction result;

[0027] When the prediction result matches the true label of the test set, the intrusion detection model is output.

[0028] When the prediction result is inconsistent with the true label of the test set, the intrusion detection model is corrected based on the prediction result.

[0029] An intrusion detection method, the method comprising:

[0030] Obtain the dataset to be detected;

[0031] The dataset to be detected is preprocessed to obtain second preprocessed data;

[0032] The second preprocessed data is input into the intrusion detection model to obtain the intrusion detection result; wherein the intrusion detection model is constructed according to the intrusion detection model construction method described above.

[0033] An apparatus for constructing an intrusion detection model, the apparatus comprising:

[0034] The first acquisition unit is used to acquire historical detection datasets;

[0035] The first preprocessing unit is used to preprocess the historical detection dataset to obtain first preprocessed data;

[0036] The initialization unit is used to initialize the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy and random dimension quantum rotation gate mutation strategy to obtain initialization data;

[0037] A computational partitioning unit is used to iteratively compute the initial data using a fitness function to obtain the optimal feature subset, and then divide the optimal feature subset into a training set and a test set.

[0038] The model training unit is used to train an intrusion detection model based on the Deep Q-Network (DQN) classification algorithm using the training set and the IHHO optimization algorithm.

[0039] An intrusion detection device, the device comprising:

[0040] The second acquisition unit is used to acquire the dataset to be detected;

[0041] The second preprocessing unit is used to preprocess the dataset to be detected to obtain second preprocessed data;

[0042] An input unit is used to input the second preprocessed data into an intrusion detection model to obtain an intrusion detection result; wherein the intrusion detection model is constructed according to the intrusion detection model construction method described above.

[0043] An intrusion detection model construction device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the intrusion detection model construction method as described above.

[0044] An intrusion detection device includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the intrusion detection method as described above.

[0045] A computer-readable storage medium storing instructions that, when executed on a terminal device, cause the terminal device to perform the intrusion detection model construction method as described above, or to perform the intrusion detection method as described above.

[0046] Compared with the prior art, this application has the following advantages:

[0047] This application provides a method for constructing an intrusion detection model, an intrusion detection method, and related apparatus. Specifically, when executing the method for constructing an intrusion detection model provided in this application, historical core bank data, which is bank data that has undergone local clearing, is first obtained through a data interface. Next, the historical core bank data is transformed using the SCHEME message to obtain first message data, and the first message data is preprocessed to obtain a training set. The training set is then input into the ChatGPT underlying model for model training, thereby obtaining the intrusion detection model. This application combines the IHHO optimization algorithm and the DQN classification algorithm to construct the intrusion detection model, resulting in a higher accuracy rate for intrusion detection and thus improving the detection performance of the intrusion detection model.

[0048] The detection performance of intrusion detection models can be evaluated and improved through multiple metrics, such as:

[0049] Improved accuracy: Accuracy is an important indicator of a model's correct classification performance, representing the proportion of samples correctly predicted by the model. When the accuracy of an intrusion detection model improves, meaning the model's correctness increases, false positives and false negatives can be reduced, thus improving the precision and reliability of detection.

[0050] Improved recall: Recall is the proportion of anomalous samples correctly detected by a model, representing the model's ability to identify anomalous samples. When the recall of an intrusion detection model increases, it means that the model's ability to detect anomalies has improved, and it can better capture potential intrusion attacks.

[0051] Improved F1 score: The F1 score combines the model's accuracy and recall, serving as a comprehensive indicator of model performance. An improved F1 score indicates an overall improvement in the model's performance.

[0052] Reduced alarm response time: The response time of an intrusion detection model is also a crucial performance indicator. When a potential intrusion is detected, the model needs to issue an alarm promptly to alert maintenance personnel to take appropriate measures. A shorter response time means the model can respond to and handle intrusion attempts more quickly.

[0053] Enhanced model generalization ability: Model generalization ability refers to a model's ability to handle unknown data, that is, its adaptability to new data. When an intrusion detection model performs well on the test set and has good generalization ability, it can better cope with real-world situations and reduce the possibility of false positives and false negatives.

[0054] In summary, the improved detection performance of intrusion detection models is mainly reflected in multiple aspects such as accuracy, recall, F1 score, alarm response time, and model generalization ability. Improvements in these indicators can enhance the model's performance and reliability, thereby improving the effectiveness of industrial control security protection. Attached Figure Description

[0055] To more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings used in the description of the embodiment or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0056] Figure 1 A flowchart illustrating a method for constructing an intrusion detection model, as provided in an embodiment of this application;

[0057] Figure 2 A flowchart of an intrusion detection method provided in an embodiment of this application;

[0058] Figure 3 A schematic diagram of a device for constructing an intrusion detection model provided in an embodiment of this application;

[0059] Figure 4 This is a schematic diagram of an intrusion detection device provided in an embodiment of this application. Detailed Implementation

[0060] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0061] To facilitate understanding of the technical solutions provided in the embodiments of this application, the background technology involved in the embodiments of this application will be described below.

[0062] Industrial control system (ICS) security is indeed a significant challenge. Because ICS systems are often involved in critical national infrastructure, such as power and water treatment, any security breach or attack can have serious consequences for people's lives and the functioning of society.

[0063] Traditional signature-based and anomaly-based intrusion detection systems have some limitations in industrial control networks. Signature-based intrusion detection methods primarily detect malicious behavior by matching the characteristics of known attacks, but this method cannot effectively detect novel attacks that have not been previously seen. Furthermore, anomaly-based intrusion detection methods may generate a large number of false positives and struggle to identify normal behavioral patterns, resulting in a high false positive rate.

[0064] Industrial Control Systems (ICS) are computer systems used to monitor and control industrial processes. They are primarily applied in various industrial sectors, including manufacturing, energy, transportation, water treatment, and petrochemicals. ICS consists of hardware and software. The hardware includes sensors, actuators, and controllers to collect and control real-time process data; the software includes monitoring software, control algorithms, and communication protocols to achieve the monitoring and control of industrial processes. The main task of ICS is to ensure the safe operation and efficient production of industrial processes. It can monitor the status and operating parameters of industrial equipment in real time, optimize and adjust industrial processes through control algorithms, improve production efficiency and quality, and ensure safety. However, with the widespread application and networking of ICS, it also faces some security risks. Malicious attackers may exploit vulnerabilities and weaknesses to infiltrate ICS systems, disrupt industrial processes, and even threaten personal safety.

[0065] To address this issue, this application provides a method for constructing an intrusion detection model, an intrusion detection method, and related apparatus. First, a historical detection dataset is acquired and preprocessed to obtain first preprocessed data. Then, the first preprocessed data is initialized using the Harris Eagle IHHO optimization algorithm, an adaptive elite learning strategy, a sine / cosine strategy, a chaotic energy strategy, and a random-dimensional quantum rotation gate mutation strategy to obtain initialization data. Next, the fitness function is used to iteratively calculate the initialization data to obtain the optimal feature subset. Finally, the optimal feature subset is divided into a training set and a test set, and the intrusion detection model is trained using the training set and the IHHO optimization algorithm based on the Deep Q-Network (DQN) classification algorithm to obtain the intrusion detection model. This application combines the IHHO optimization algorithm and the DQN classification algorithm to construct an intrusion detection model, resulting in a higher accuracy rate and improved detection performance.

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0067] See Figure 1 The figure is a flowchart of a method for constructing an intrusion detection model according to an embodiment of this application. Figure 1 As shown, the method for constructing this intrusion detection model may include steps S101-S105:

[0068] S101: Obtain historical detection dataset.

[0069] To build an intrusion detection model, the system first needs to obtain historical detection datasets.

[0070] In some possible implementations, the historical detection dataset refers to a historical industrial control system (ICS) intrusion detection dataset. An ICS intrusion detection dataset is a dataset used for researching and developing industrial control system (ICS) security. These datasets typically contain actual ICS network traffic data from real-world or simulated environments for training and evaluating intrusion detection systems. Below are some common ICS intrusion detection datasets:

[0071] CICIDS2017: The CICIDS2017 dataset is a comprehensive intrusion detection dataset for Intrusion Detection Systems (ICS), containing a large amount of normal and malicious network traffic data. This dataset includes several different attack types, such as Denial of Service (DOS), scanning, and remote access. It can be used to evaluate the performance of various intrusion detection algorithms.

[0072] SOTACS: SOTACS is an ICS security dataset based on a simulated environment, containing network traffic data from virtualized ICS systems. This dataset provides multiple scenarios and attack types, such as command injection, data tampering, and logical errors. It can be used to test and validate the robustness and accuracy of ICS intrusion detection systems.

[0073] SWaT: The SWaT dataset contains ICS network traffic data collected from real water treatment systems. It includes network traffic data under normal operation and various attack scenarios, such as sniffing attacks, simulated attacks, and physical attacks. The SWaT dataset can help researchers evaluate and improve the security of industrial control systems.

[0074] WADI: The WADI dataset is an ICS security dataset based on a real-world industrial environment, containing network traffic data from the oil and gas sector. It includes normal operational data and various types of attacks, such as DoS attacks, scans, and anomalous behavior. The WADI dataset can be used to analyze and study intrusion detection and security in ICS networks.

[0075] S102: The historical detection dataset is preprocessed to obtain the first preprocessed data.

[0076] After obtaining the historical detection dataset, the intrusion detection model building system can preprocess the historical detection dataset to obtain the first preprocessed data.

[0077] In some possible implementations, the preprocessing of the historical detection dataset to obtain the first preprocessed data includes:

[0078] Remove feature columns from the historical detection dataset that have more than half of the total missing values, and fill the missing values ​​in the dataset with 0; encode normal packets and attack packets with 0 and 1 respectively; process the dataset in a normalized manner to reduce the influence of data units; and remove features in the dataset that are completely irrelevant to the label columns using mutual information feature selection.

[0079] S103: Initialize the first preprocessed data by using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy and random dimension quantum rotation gate mutation strategy.

[0080] After preprocessing the historical detection dataset to obtain the first preprocessed data, the intrusion detection model construction system also needs to initialize the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotating gate mutation strategy to obtain the initialization data.

[0081] In some possible implementations, the initialization data obtained by initializing the first preprocessed data using the IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy includes A1-A5:

[0082] A1: The first preprocessed data is optimized using the IHHO optimization algorithm to obtain optimized data.

[0083] To initialize the first preprocessed data using the IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotating gate mutation strategy, the intrusion detection model construction system first needs to optimize the first preprocessed data using the IHHO optimization algorithm to obtain optimized data.

[0084] The Harris Hawks Optimization (HHO) algorithm is a swarm intelligence-based optimization algorithm inspired by the behavior of Harris Hawks during foraging. The HHO algorithm utilizes the cooperative and competitive behaviors of Harris Hawks during foraging, searching for the optimal solution in the solution space through a series of steps. The HHO algorithm has the following characteristics:

[0085] Swarm intelligence: The HHO algorithm is based on the idea of ​​swarm intelligence, which treats the problem as a collection of eagles and searches for the optimal solution in the entire solution space.

[0086] Multi-strategy search: The HHO algorithm employs local and global search strategies. Local search is mainly performed through neighborhood search, while global search is performed by randomly selecting a guide eagle to find a better solution.

[0087] Fast convergence: The HHO algorithm has a fast convergence speed and can quickly find a relatively good solution.

[0088] Robustness: The HHO algorithm is resistant to noise and outliers and can adapt to problems of varying complexity.

[0089] A2: Adaptive learning is performed on the optimized data using the aforementioned adaptive elite learning strategy to obtain adaptive data.

[0090] After optimizing the first preprocessed data using the IHHO optimization algorithm to obtain optimized data, the intrusion detection model construction system also needs to use an adaptive elite learning strategy to adaptively learn the optimized data to obtain adaptive data.

[0091] Adaptive elite learning strategy is a type of optimization algorithm designed to improve algorithm performance and convergence speed. It primarily guides the search process by preserving and utilizing information from high-performing individuals (elites), and adaptively adjusts the number of elites and updates the strategy during evolution.

[0092] In some possible implementations, this application introduces a reverse learning strategy (i.e., an adaptive elite learning strategy) into the HHO algorithm. Let the feasible solution be X, and the objective space be [lb, ub], then the reverse solution (X) is generated as shown in the following formula:

[0093]

[0094] A3: Update the Harris Eagle position in the adaptive data using the sine and cosine strategies to obtain updated data.

[0095] After using an adaptive elite learning strategy to adaptively learn the optimized data and obtain adaptive data, the intrusion detection model construction system also needs to use a sine and cosine strategy to update the Harris Hawk position of the adaptive data to obtain updated data.

[0096] The sine / cosine strategy is a technique used in optimization algorithms to explore and utilize the search space. It is commonly used in metaheuristic algorithms, such as genetic algorithms. The basic idea of ​​the sine / cosine strategy is to dynamically adjust the algorithm's search step size based on the characteristics of sine and cosine curves. Specifically, the sine / cosine strategy explores the search space by changing the search direction and step size, gradually converging to the optimal solution.

[0097] In sine / cosine strategies, the search step size is typically adjusted according to a sine or cosine function. The periodic variation of the sine function helps the algorithm explore the search space more comprehensively, while the asymptotic decrease of the cosine function helps the algorithm gradually converge to the optimal solution.

[0098] A4: The escape energy factor is obtained by performing chaotic mapping on the updated data using the chaotic energy strategy.

[0099] After updating the Harris Hawk position of the adaptive data using the sine and cosine strategies, the intrusion detection model construction system also needs to use the chaotic energy strategy to perform chaotic mapping on the updated data to obtain the escape energy factor.

[0100] The chaotic energy strategy is an improved genetic algorithm (GA) optimization method that adds a new operation—the chaotic energy operation—to the basic selection, crossover, and mutation operations of the genetic algorithm. This operation uses chaotic mapping to generate random numbers, introducing randomness and diversity, thereby enhancing the algorithm's global search capability.

[0101] A5: The initialization data is obtained by performing quantum computation on the escape energy factor using the random dimension quantum rotating gate mutation strategy.

[0102] After obtaining the escape energy factor by performing chaotic mapping on the updated data using a chaotic energy strategy, the intrusion detection model construction system can use a random-dimensional quantum rotating gate mutation strategy to perform quantum computation on the escape energy factor to obtain initialization data.

[0103] The random-dimensional quantum rotation gate mutation strategy is a mutation operation used in quantum genetic algorithms (QGA). In classical genetic algorithms, mutation introduces new gene combinations by changing gene values ​​in chromosomes. However, in quantum genetic algorithms, mutation operations are performed at the qubit level.

[0104] S104: The fitness function is used to iteratively calculate the initial data to obtain the optimal feature subset, and the optimal feature subset is divided into a training set and a test set.

[0105] After initializing the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotating gate mutation strategy, the intrusion detection model construction system also needs to use the fitness function to calculate the fitness value of the feasible solution of the initial data with the fitness function as the optimization direction. The optimal feasible solution in the population is taken as the prey (i.e. the optimal feature subset), and the optimal feature subset is divided into training set and test set.

[0106] S105: An intrusion detection model is obtained by training the model using the training set and the IHHO optimization algorithm based on the Deep Q-Network (DQN) classification algorithm.

[0107] After iteratively calculating the initial data using the fitness function to obtain the optimal feature subset, and dividing the optimal feature subset into a training set and a test set, the intrusion detection model construction system can then use the training set and the IHHO optimization algorithm based on the DQN (Deep Q-Network) classification model to train the model and obtain the intrusion detection model.

[0108] DQN is an algorithm based on deep learning and reinforcement learning. Its goal is to train a neural network to learn how to make optimal action choices in a given environment.

[0109] The DQN algorithm is primarily based on Q-learning, a value-function-based reinforcement learning method. It evaluates the value of each state-action pair by establishing a Q-value function and uses these values ​​to guide the agent's decision-making. Traditional Q-learning algorithms are suitable for problems with small state spaces, but in complex state spaces, storing large tables of Q-values ​​is necessary, and computation and updating become difficult.

[0110] DQN addresses the limitations of traditional Q-learning algorithms by approximating the Q-value function using neural networks. Specifically, it uses a deep convolutional neural network (CNN) as an approximator of the Q-value function. The neural network takes the state of the environment as input and outputs the Q-value for each action. The agent selects actions based on the current state and the Q-value, and updates the neural network weights by interacting with the environment to obtain rewards and the next state.

[0111] In some possible implementations, the Deep Q-Network (DQN) classification algorithm uses the training set and the IHHO optimization algorithm to train an intrusion detection model, including B1-B5:

[0112] B1: Construct a preliminary intrusion detection model.

[0113] To obtain an intrusion detection model based on the Deep Q-Network (DQN) classification algorithm using a training set and the IHHO optimization algorithm, the system for building the intrusion detection model first needs to construct a preliminary intrusion detection model.

[0114] In some possible implementations, the construction process of the initial intrusion detection model includes modeling the intrusion detection environment. This includes defining a state space, an action space, and a reward function. The state space can represent different states of the system, such as network traffic characteristics, network connectivity information, etc. The action space represents the actions that can be taken in each state, such as classifying the state as normal or abnormal using a classifier. The reward function is used to evaluate the quality of each state-action pair.

[0115] B2: Within the preliminary intrusion detection model, simulate a Markov process using the training set to obtain the state-action value function.

[0116] After constructing the initial intrusion detection model, the intrusion detection model construction system also needs to use the training set to simulate the Markov process within the initial intrusion detection model, thereby obtaining the state-action value function.

[0117] In some possible implementations, a Markov process is simulated within the initial intrusion detection model. This can be achieved by defining the state transition probability matrix using the training set and calculating the next state based on the current state of the training set and the actions taken, thereby obtaining an updated reward function as the state-action value function.

[0118] Among them, Markov processes

[0119] B3: The state-action value function is transformed into a function fitting problem using the DQN classification algorithm.

[0120] After obtaining the state-action value function, the intrusion detection model construction system also needs to use the DQN classification algorithm to transform the state-action value function into a function fitting problem.

[0121] In some possible implementations, the method further includes: continuously updating the function fitting problem to make the function fitting problem approach the optimum.

[0122] B4: The intermediate intrusion detection model is obtained by iteratively training the problem using the function fitting described above.

[0123] After transforming the state-action value function into a function fitting problem using the DQN classification algorithm, the intrusion detection model construction system still needs to use the function fitting problem for iterative training to obtain an intermediate intrusion detection model.

[0124] In some possible implementations, when iteratively training an intermediate intrusion detection model using a function fitting problem, the termination condition of the iteration can be determined based on the specific circumstances. Several termination conditions are available:

[0125] Fixed number of iterations: Set a fixed number of iterations as the termination condition. Training stops after the specified number of iterations is reached, regardless of whether the model's performance has converged.

[0126] Convergence Criterion: Set a convergence criterion, such as defining a threshold or tolerance range. When the model's performance metrics (such as the loss function value or the accuracy on the test set) change less than this threshold over a number of consecutive iterations, the model is considered to have converged, and training stops.

[0127] Test set performance no longer improves: Use an additional test set to monitor the model's performance. If, after a certain number of iterations, the model's performance on the test set no longer improves or begins to decline, you can choose to stop training to avoid overfitting.

[0128] Iteration time limit: Set a maximum training time. When the training time exceeds this limit, training stops.

[0129] Monitor other metrics: Depending on the characteristics of the problem, other suitable metrics can be selected as termination conditions. For example, model stability, resource utilization, or other problem-related metrics can be monitored.

[0130] B5: The intermediate intrusion detection model is optimized using the IHHO optimization algorithm to obtain the intrusion detection model.

[0131] After obtaining an intermediate intrusion detection model through iterative training using a function fitting problem, the intrusion detection model construction system can then use the IHHO optimization algorithm to optimize the intermediate intrusion detection model to obtain the final intrusion detection model.

[0132] In some possible implementations, the method further includes C1-C3:

[0133] C1: Input the test set into the intrusion detection model to obtain the prediction result.

[0134] To improve the performance and robustness of the intrusion detection model by real-time correction and iterative updates based on the prediction results of the test set, the intrusion detection model construction system can first input the test set into the constructed intrusion detection model to obtain the prediction results.

[0135] In some possible implementations, the prediction result can be, but is not limited to, a probability or a category label. The prediction result is used to indicate whether the sample is normal or abnormal.

[0136] C2: When the prediction result matches the true label of the test set, the intrusion detection model is output.

[0137] When the predicted results match the true labels on the test set, it indicates that the intrusion detection model has high accuracy and reliability on the current test samples. This means that the model can correctly distinguish between normal network traffic and malicious intrusion behavior, demonstrating good performance for intrusion detection tasks. In this case, the intrusion detection model building system can output and use the intrusion detection model.

[0138] In some possible implementations, the true label can be, but is not limited to, a probability or category label. The true label is used to indicate whether the sample is normal or abnormal.

[0139] C3: When the prediction result is inconsistent with the true label of the test set, the intrusion detection model shall be corrected according to the prediction result.

[0140] When the prediction results are inconsistent with the true labels of the test set, it indicates that the current intrusion detection model is not reliable enough for intrusion detection and needs further improvement. At this time, the intrusion detection model construction system can correct the intrusion detection model based on the prediction results.

[0141] In some possible implementations, when the prediction result is inconsistent with the true label of the test set, correcting the intrusion detection model based on the prediction result may include:

[0142] Data rebalancing: Observe the samples with prediction errors corresponding to the prediction results, analyze their characteristics and patterns, and determine the causes of prediction errors. If it is found that the number of samples of different classes in the dataset is imbalanced, the distribution of samples of each class can be balanced by methods such as undersampling, oversampling, or generating synthetic samples to reduce the impact of sample imbalance on the model.

[0143] Feature engineering involves analyzing samples where predictions are incorrect to assess whether the model can capture key features of malicious behavior. If the model is found to lack certain important features, feature engineering can be performed—that is, constructing, selecting, or extracting more discriminative features to enhance the model's performance and prediction accuracy.

[0144] In some possible implementations, when the intrusion detection model's predictions are inconsistent with the true labels on the test set, the following methods can be considered to correct the model:

[0145] Model hyperparameter tuning: Optimize model performance by adjusting hyperparameters, network structure, loss function, etc. Techniques such as cross-validation can be used to select the optimal combination of hyperparameters to improve model performance on the test set.

[0146] Introducing ensemble learning methods: By combining multiple prediction models using ensemble learning methods (such as Bagging and Boosting), their prediction results are integrated to achieve better overall performance. Ensemble learning methods can reduce the bias and variance of individual models and improve the generalization ability of the model.

[0147] Model updates and iterations: Continuously monitor the performance of the intrusion detection model and update and iterate it in a timely manner. In actual operation, collect new malicious behavior samples and use this data to update and improve the model to adapt to constantly changing network attack methods and approaches.

[0148] Based on the content of S101-S105, the historical detection dataset is first acquired and preprocessed to obtain the first preprocessed data. Next, the first preprocessed data is initialized using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategies, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy to obtain initialization data. Then, the fitness function is used to iteratively calculate the initialization data to obtain the optimal feature subset. Finally, the optimal feature subset is divided into a training set and a test set, and the intrusion detection model is trained using the training set and the IHHO optimization algorithm based on the Deep Q-Network (DQN) classification algorithm to obtain the intrusion detection model. This application combines the IHHO optimization algorithm and the DQN classification algorithm to construct an intrusion detection model, resulting in a higher intrusion detection accuracy and improved detection performance.

[0149] Based on the embodiments of the training method for the intrusion detection model provided above, this application also provides an intrusion detection method. See also Figure 2 , Figure 2 This is a flowchart illustrating an intrusion detection method provided in an embodiment of this application. Figure 2 As shown, the method includes S201-S203:

[0150] S201: Obtain the dataset to be detected.

[0151] To achieve intrusion detection, an intrusion detection system first needs to acquire the dataset to be detected.

[0152] In some possible implementations, the dataset to be detected is an industrial control system (ICS) intrusion detection dataset that currently needs to be detected. An ICS intrusion detection dataset is a dataset used for researching and developing industrial control system (ICS) security. These datasets typically contain actual ICS network traffic data from real-world or simulated environments for training and evaluating intrusion detection systems.

[0153] Here are some common industrial control system intrusion detection datasets:

[0154] CICIDS2017: The CICIDS2017 dataset is a comprehensive intrusion detection dataset for Intrusion Detection Systems (ICS), containing a large amount of normal and malicious network traffic data. This dataset includes multiple different attack types, such as DoS, scanning, and remote access. It can be used to evaluate the performance of various intrusion detection algorithms.

[0155] SOTACS: SOTACS is an ICS security dataset based on a simulated environment, containing network traffic data from virtualized ICS systems. This dataset provides multiple scenarios and attack types, such as command injection, data tampering, and logical errors. It can be used to test and validate the robustness and accuracy of ICS intrusion detection systems.

[0156] SWaT: The SWaT dataset contains ICS network traffic data collected from real water treatment systems. It includes network traffic data under normal operation and various attack scenarios, such as sniffing attacks, simulated attacks, and physical attacks. The SWaT dataset can help researchers evaluate and improve the security of industrial control systems.

[0157] WADI: The WADI dataset is an ICS security dataset based on a real-world industrial environment, containing network traffic data from the oil and gas sector. It includes normal operational data and various types of attacks, such as DoS attacks, scans, and anomalous behavior. The WADI dataset can be used to analyze and study intrusion detection and security in ICS networks.

[0158] S202: Preprocess the dataset to be detected to obtain second preprocessed data.

[0159] After obtaining the dataset to be detected, the intrusion detection system can preprocess the dataset to obtain second preprocessed data.

[0160] In some possible implementations, the preprocessing includes:

[0161] Remove feature columns in the industrial control system intrusion detection dataset that have more than half of the total missing values, and fill the missing values ​​in the dataset with 0; encode normal packets and attack packets with 0 and 1 respectively; process the dataset in a normalized manner to reduce the influence of data units; and remove features in the dataset that are completely irrelevant to the label columns using mutual information feature selection.

[0162] S203: Input the second preprocessed data into the intrusion detection model to obtain the intrusion detection result; wherein the intrusion detection model is constructed according to the construction method of the intrusion detection model as described in any one of claims 1-4.

[0163] Based on the content of S201-S203 above, it is known that the trained intrusion detection model can be used to perform intrusion detection on the preprocessed dataset to obtain intrusion detection results. Using the trained intrusion detection model to perform intrusion detection on the preprocessed dataset can significantly improve the accuracy of intrusion detection.

[0164] See Figure 3 , Figure 3 This is a schematic diagram of a device for constructing an intrusion detection model, provided in an embodiment of this application. Figure 3 As shown, the apparatus for constructing this intrusion detection model includes:

[0165] The first acquisition unit 301 is used to acquire historical detection datasets.

[0166] The first preprocessing unit 302 is used to preprocess the historical detection dataset to obtain the first preprocessed data.

[0167] Initialization unit 303 is used to initialize the first preprocessed data using Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy and random dimension quantum rotation gate mutation strategy to obtain initialization data.

[0168] The calculation partitioning unit 304 is used to iteratively calculate the initial data using the fitness function to obtain the optimal feature subset, and then divide the optimal feature subset into a training set and a test set.

[0169] The model training unit 305 is used to train an intrusion detection model based on the Deep Q-Network (DQN) classification algorithm using the training set and the IHHO optimization algorithm.

[0170] In some possible implementations, the device further includes:

[0171] An optimization processing unit is used to optimize the first preprocessed data using the IHHO optimization algorithm to obtain optimized data.

[0172] An adaptive learning unit is used to adaptively learn from the optimized data using the adaptive elite learning strategy to obtain adaptive data.

[0173] The update unit is used to update the Harris Eagle position of the adaptive data using the sine and cosine strategies to obtain updated data;

[0174] A mapping unit is used to perform chaotic mapping on the updated data using the chaotic energy strategy to obtain an escape energy factor.

[0175] The computing unit is used to perform quantum computation on the escape energy factor using the random-dimensional quantum rotation gate mutation strategy to obtain the initialization data.

[0176] In some possible implementations, the device further includes:

[0177] Building blocks are used to construct preliminary intrusion detection models;

[0178] The simulation unit is used to simulate a Markov process within the training set to obtain a state-action value function in the preliminary intrusion detection model.

[0179] A transformation unit is used to transform the state-action value function into a function fitting problem using the DQN classification algorithm;

[0180] An iterative training unit is used to perform iterative training on the function fitting problem to obtain an intermediate intrusion detection model;

[0181] The optimization unit is used to optimize the intermediate intrusion detection model using the IHHO optimization algorithm to obtain the intrusion detection model.

[0182] In some possible implementations, the device further includes:

[0183] An input unit is used to input the test set into the intrusion detection model to obtain prediction results;

[0184] The output unit is used to output the intrusion detection model when the prediction result matches the true label of the test set.

[0185] The correction unit is used to correct the intrusion detection model based on the prediction result when the prediction result is inconsistent with the true label of the test set.

[0186] This application provides an apparatus for constructing an intrusion detection model. After the first acquisition unit 301 acquires the historical detection dataset, the first preprocessing unit 302 preprocesses the historical detection dataset to obtain first preprocessed data. Then, the initialization unit 303 initializes the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy to obtain initialization data. Then, the calculation and partitioning unit 304 iteratively calculates the initialization data using the fitness function to obtain the optimal feature subset, and divides the optimal feature subset into a training set and a test set, so that the model training unit 305 can train the model based on the Deep Q-Network (DQN) classification algorithm using the training set and the IHHO optimization algorithm to obtain the intrusion detection model. This application combines the IHHO optimization algorithm and the DQN classification algorithm to construct an intrusion detection model, resulting in a higher accuracy in intrusion detection and thus improving the detection performance of the intrusion detection model.

[0187] See Figure 4 , Figure 4 This is a schematic diagram of an intrusion detection device provided in an embodiment of this application. Figure 4 As shown, the intrusion detection device includes:

[0188] The second acquisition unit is used to acquire the dataset to be detected;

[0189] The second preprocessing unit is used to preprocess the dataset to be detected to obtain second preprocessed data;

[0190] An input unit is used to input the second preprocessed data into an intrusion detection model to obtain an intrusion detection result; wherein the intrusion detection model is constructed according to the intrusion detection model construction method described above.

[0191] In addition, this application embodiment also provides an intrusion detection model construction device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the intrusion detection model construction method as described above.

[0192] In addition, this application embodiment also provides an intrusion detection device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the intrusion detection method as described above.

[0193] In addition, this application embodiment also provides a computer-readable storage medium storing instructions that, when executed on a terminal device, cause the terminal device to execute the intrusion detection model construction method as described above, or to execute the intrusion detection method as described above.

[0194] This application provides an intrusion detection device. After the second acquisition unit 401 acquires the dataset to be detected, the second preprocessing unit 402 preprocesses the dataset to be detected to obtain second preprocessed data, so that the input unit 403 can input the second preprocessed data into the intrusion detection model to obtain the intrusion detection result. This application uses a trained intrusion detection model to perform intrusion detection on the preprocessed dataset to obtain the intrusion detection result, which can significantly improve the accuracy of intrusion detection.

[0195] The foregoing has provided a detailed description of the method for constructing an intrusion detection model, the intrusion detection method, and related apparatus provided in this application. The various embodiments in the specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section. It should be noted that those skilled in the art can make several improvements and modifications to this application without departing from the principles of this application, and these improvements and modifications also fall within the protection scope of the claims of this application.

[0196] It should be understood that in this application, "at least one (item)" means one or more, and "more than" means two or more. "And / or" is used to describe the relationship between related objects, indicating that three relationships can exist. For example, "A and / or B" can represent three cases: only A exists, only B exists, and both A and B exist simultaneously, where A and B can be singular or plural. The character " / " generally indicates that the preceding and following related objects are in an "or" relationship. "At least one (item) of the following" or similar expressions refer to any combination of these items, including any combination of single or plural items. For example, at least one (item) of a, b, or c can represent: a, b, c, "a and b", "a and c", "b and c", or "a and b and c", where a, b, and c can be single or multiple.

[0197] It should also be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0198] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0199] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for constructing an intrusion detection model, characterized in that, The method includes: Obtain historical detection datasets; the historical detection datasets are industrial control system intrusion detection datasets based on historical records, including the SOTACS dataset, the SWAT dataset, and the WADI dataset. The historical detection dataset is preprocessed to obtain the first preprocessed data; Initialized data is obtained by initializing the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy. The optimal feature subset is obtained by iteratively calculating the initial data using the fitness function, and the optimal feature subset is then divided into a training set and a test set. An intrusion detection model is obtained by training the model using the training set and the IHHO optimization algorithm based on the Deep Q-Network (DQN) classification algorithm. The initialization data obtained by initializing the first preprocessed data using the IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy, and random dimension quantum rotation gate mutation strategy includes: The first preprocessed data is optimized using the IHHO optimization algorithm to obtain optimized data. The adaptive elite learning strategy is used to adaptively learn from the optimized data to obtain adaptive data. The Harris Eagle position in the adaptive data is updated using the sine and cosine strategies to obtain updated data; The escape energy factor is obtained by performing chaotic mapping on the updated data using the chaotic energy strategy. The initialization data is obtained by performing quantum computation on the escape energy factor using the random dimension quantum rotation gate mutation strategy.

2. The method according to claim 1, characterized in that, The Deep Q-Network (DQN) classification algorithm uses the training set and the IHHO optimization algorithm to train an intrusion detection model, including: Construct a preliminary intrusion detection model; Within the preliminary intrusion detection model, a Markov process is simulated using the training set to obtain the state-action value function; The state-action value function is transformed into a function fitting problem using the DQN classification algorithm. The intermediate intrusion detection model is obtained by iteratively training the problem using the aforementioned function fitting; The intrusion detection model is obtained by optimizing the intermediate intrusion detection model using the IHHO optimization algorithm.

3. The method according to claim 1, characterized in that, The method further includes: The test set is input into the intrusion detection model to obtain the prediction result; When the prediction result matches the true label of the test set, the intrusion detection model is output. When the prediction result is inconsistent with the true label of the test set, the intrusion detection model is corrected based on the prediction result.

4. An intrusion detection method, characterized in that, The method includes: Obtain the dataset to be detected; the historical detection dataset is a historical industrial control system intrusion detection dataset, which includes the SOTACS dataset, the SWAT dataset, and the WADI dataset. The dataset to be detected is preprocessed to obtain second preprocessed data; The second preprocessed data is input into the intrusion detection model to obtain the intrusion detection result; wherein the intrusion detection model is constructed according to the construction method of the intrusion detection model as described in any one of claims 1-3.

5. An apparatus for constructing an intrusion detection model, characterized in that, The device includes: The first acquisition unit is used to acquire historical detection datasets; The first preprocessing unit is used to preprocess the historical detection dataset to obtain first preprocessed data; The initialization unit is used to initialize the first preprocessed data using the Harris Eagle IHHO optimization algorithm, adaptive elite learning strategy, sine and cosine strategy, chaotic energy strategy and random dimension quantum rotation gate mutation strategy to obtain initialization data; A computational partitioning unit is used to iteratively compute the initial data using a fitness function to obtain the optimal feature subset, and then divide the optimal feature subset into a training set and a test set. The model training unit is used to train the intrusion detection model based on the Deep Q-Network (DQN) classification algorithm using the training set and the IHHO optimization algorithm. The device further includes: An optimization processing unit is used to optimize the first preprocessed data using the IHHO optimization algorithm to obtain optimized data. An adaptive learning unit is used to adaptively learn from the optimized data using the adaptive elite learning strategy to obtain adaptive data. The update unit is used to update the Harris Eagle position of the adaptive data using the sine and cosine strategies to obtain updated data; A mapping unit is used to perform chaotic mapping on the updated data using the chaotic energy strategy to obtain an escape energy factor. The computing unit is used to perform quantum computation on the escape energy factor using the random-dimensional quantum rotation gate mutation strategy to obtain the initialization data.

6. An intrusion detection device, characterized in that, The device includes: The second acquisition unit is used to acquire the dataset to be detected; The second preprocessing unit is used to preprocess the dataset to be detected to obtain second preprocessed data; An input unit is used to input the second preprocessed data into an intrusion detection model to obtain an intrusion detection result; wherein the intrusion detection model is constructed according to the construction method of the intrusion detection model as described in any one of claims 1-4.

7. An intrusion detection model construction device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, it implements the method for constructing an intrusion detection model as described in any one of claims 1-3.

8. An intrusion detection device, characterized in that, include: A memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the intrusion detection method as described in claim 4.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a terminal device, cause the terminal device to perform the method for constructing an intrusion detection model as described in any one of claims 1-3, or to perform the intrusion detection method as described in claim 4.

Images