A network intrusion detection method based on HBA and multi-branch 1D CNN

Abstract

The embodiment of the application discloses a network intrusion detection method based on HBA and a multi-branch 1DCNN, which comprises the following steps: obtaining a network intrusion data set; preprocessing the network intrusion data set; dividing the preprocessed data set into a training set and a test set; constructing a multi-branch 1DCNN network intrusion detection model; extracting part of data from the training set and the test set, using an HBA algorithm to optimize the model hyperparameters, and obtaining the optimal hyperparameters of the model; using the optimal hyperparameters as the parameters of the multi-branch 1DCNN model, training the network intrusion detection model using the divided training set, and obtaining a multi-branch 1DCNN network intrusion detection model to be tested; inputting the test set data into the multi-branch 1DCNN network intrusion detection model to be tested, and obtaining the final classification result. The network intrusion detection method based on HBA and the multi-branch 1DCNN can obtain a detection effect with high accuracy, high convergence speed and high training efficiency when facing a network environment with large data volume and high real-time requirement.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network intrusion detection method based on HBA (Honey Badger Algorithm) and multi-branch 1DCNN (one-dimensional convolutional neural network). Background Technology

[0002] With the rapid development of computer network technology, various network attack methods are constantly being updated, impacting an increasingly larger scale and increasing frequency, making network security issues increasingly serious. Network intrusion detection technology, as a crucial technology in network security, plays an indispensable role in preventing network attacks. Traditional intrusion detection methods are gradually revealing their limitations when facing complex and ever-changing network attacks, urgently requiring more intelligent and efficient solutions. The rise of deep learning technology has injected new vitality into the field of network intrusion detection. Deep learning-based intrusion detection systems have become one of the most promising methods for quickly identifying and handling network intrusions. They can identify whether a system is currently being intruded upon or has already been intruded upon, and can take preventative measures against potential network attacks.

[0003] Currently, deep learning has been widely applied to intrusion detection. Compared to traditional machine learning models, deep learning models perform better when handling large-scale, high-dimensional data, capable of learning and understanding massive amounts of network traffic data, and possessing stronger feature learning and representation capabilities. Thanks to its efficient data processing, deep learning has achieved more accurate and higher-performance results in intrusion detection. However, due to the high computational cost and long training cycles of traditional deep learning models, there are relatively few detection models suitable for network environments with high real-time requirements. Summary of the Invention

[0004] To address at least one technical problem existing in the prior art, this invention discloses a network intrusion detection method based on HBA and multi-branch 1DCNN.

[0005] The network intrusion detection method based on HBA and multi-branch 1DCNN includes the following steps:

[0006] Obtain network intrusion dataset;

[0007] Preprocess the network intrusion dataset;

[0008] The preprocessed dataset is divided into a training set and a test set;

[0009] Construct a multi-branch 1DCNN network intrusion detection model;

[0010] We extract some data from the training and test sets and use the HBA algorithm to optimize the model's hyperparameters to obtain the optimal hyperparameters of the model.

[0011] The optimal hyperparameters are used as the parameters of the multi-branch 1DCNN model. The network intrusion detection model is trained using the partitioned training set to obtain the multi-branch 1DCNN network intrusion detection model to be tested.

[0012] The test set data is input into the multi-branch 1DCNN network intrusion detection model to be tested, and the final classification result is obtained.

[0013] According to a preferred embodiment of the present invention, the network intrusion dataset is the UNSW-NB15 dataset.

[0014] According to a preferred embodiment of the present invention, the method for preprocessing network intrusion datasets is as follows:

[0015] The network intrusion dataset is quantified, standardized, and normalized.

[0016] According to a preferred embodiment of the present invention, the preprocessed dataset is divided into a training set and a test set in a 7:3 ratio.

[0017] According to a preferred embodiment of the present invention, the multi-branch 1DCNN network intrusion detection model includes multi-branch convolutional layers, pooling layers, and fully connected layers based on one-dimensional convolutional kernels; and an attention mechanism is added to each convolutional branch, and multiple branches are weighted using parameters optimized by the HBA algorithm.

[0018] According to a preferred embodiment of the present invention, in the multi-branch 1DCNN network intrusion detection model, all activation functions used are ReLU functions throughout the entire neural network propagation process; the pooling layer is a Max-pool layer; and a Softmax layer is used after the network output for multi-class detection of network intrusion.

[0019] According to a preferred embodiment of the present invention, in a multi-branch convolutional layer, the stride of each Conv1D is set to be equal to the size of the convolutional kernel; and multiple different Conv1Ds are synthesized by the Concatenate function.

[0020] According to a preferred embodiment of the present invention, the method for obtaining the optimal hyperparameters of the model is as follows:

[0021] Several hyperparameters are defined for the multi-branch 1DCNN network intrusion detection model, forming a hyperparameter space;

[0022] The hyperparameter space was incorporated into the network intrusion detection model using the HBA optimization algorithm. Using a portion of the training and test data, the model parameters were optimized using the HBA algorithm to obtain the optimal hyperparameters.

[0023] According to a preferred embodiment of the present invention, a model evaluation step is also included;

[0024] The model evaluation step evaluates the multi-branch 1DCNN network intrusion detection model using accuracy, precision, recall, and / or F-score.

[0025] According to a preferred embodiment of the present invention, preprocessing a network intrusion dataset includes the following steps:

[0026] Perform a cleaning operation on the network intrusion dataset, removing rows containing "NaN" or "Inf" values, redundant records, and invalid records, and processing all data in the dataset that is not of type "int", "float", or "string".

[0027] Then, convert all non-numerical data in the dataset into numerical data;

[0028] Finally, the dataset is normalized to a form with a mean of 0 and a standard deviation of 1, compressing the data into the interval [0, 1].

[0029] The network intrusion detection method based on HBA and multi-branch 1DCNN provided in this invention has at least one of the following technical effects:

[0030] 1. The network intrusion detection method based on HBA and multi-branch 1DCNN in this invention optimizes the model hyperparameters by using the HBA algorithm, automatically adjusts the model parameter values, finds a better combination of hyperparameters, eliminates the process of repeated manual experiments and manual parameter tuning, improves training efficiency and model detection performance, and accelerates the convergence speed of the network.

[0031] 2. The network intrusion detection method based on HBA and multi-branch 1DCNN in this embodiment of the invention adopts a multi-scale convolutional branch approach, using convolutional kernels of different sizes, so that the network can learn features of different scales at the same time, better capture the relationships in the input data, increase the receptive field and robustness of the network, and reduce the risk of overfitting to a certain extent.

[0032] In summary, the network intrusion detection method based on HBA and multi-branch 1DCNN of this invention can achieve high accuracy, high convergence speed and high training efficiency in network environments with large data volume and high real-time requirements.

[0033] Some additional features of the present invention will be described in the following description. These additional features will become apparent to those skilled in the art upon examination of the following description and the accompanying drawings, or upon understanding the production or operation of the embodiments. The features disclosed in this invention can be implemented and achieved through the practice or use of various methods, means, and combinations thereof with respect to the specific embodiments described below. Attached Figure Description

[0034] The accompanying drawings, which are provided to further illustrate the invention and constitute a part of this invention, illustrate exemplary embodiments of the invention and are used to explain the invention, but do not constitute a limitation thereof. In the drawings, the same reference numerals denote the same parts.

[0035] Figure 1 This is a flowchart illustrating a network intrusion detection method based on HBA and multi-branch 1DCNN according to some embodiments of the present invention;

[0036] Figure 2 This is a schematic diagram of the multi-branch 1DCNN model structure in a network intrusion detection method based on HBA and multi-branch 1DCNN, as shown in some embodiments of the present invention. Detailed Implementation

[0037] To enable those skilled in the art to better understand the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0038] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0039] To address the issue that traditional models perform poorly in real-time network environments due to large data volumes, computational demands, and long training cycles, this invention discloses a network intrusion detection method based on HBA-multi-branch 1DCNN that features fewer parameters, faster training speed, and higher detection efficiency.

[0040] Figure 1 This is a flowchart illustrating a network intrusion detection method based on HBA and multi-branch 1DCNN according to some embodiments of the present invention.

[0041] like Figure 1As shown, the network intrusion detection method based on HBA (Honey Badger Algorithm) and multi-branch 1DCNN (one-dimensional convolutional neural network) includes the following steps:

[0042] Step 1: Obtain the network intrusion dataset.

[0043] As a preferred implementation, in this embodiment, the network intrusion dataset can be the UNSW-NB15 dataset.

[0044] The UNSW-NB15 dataset, created by the Network Lab at the University of New South Wales, Canberra, is a next-generation dataset for Industry 4.0, the Internet of Things (IoT), and the Industrial Internet of Things (IIoT), mixing real-world modern normal activities with contemporary attack behaviors. It includes nine types of attack labels (Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, Worms) and one category of benign labels, commonly used to evaluate the efficiency of different cybersecurity applications based on artificial intelligence (AI) (i.e., machine / deep learning algorithms). Therefore, the UNSW-NB15 dataset is suitable for this embodiment. The specific data distribution of this dataset is shown in Table 1 below:

[0045] Table 1. Specific data distribution of the UNSW-NB15 dataset.

[0046]

[0047] Step 2: Preprocess the network intrusion dataset.

[0048] The method for preprocessing the network intrusion dataset is as follows: the network intrusion dataset is quantified, standardized, and normalized.

[0049] For example, methods for preprocessing network intrusion datasets include cleaning the data, deleting rows and redundant records containing "NaN" or "Inf" values, numerating non-numerical data, and finally performing standardization and normalization operations.

[0050] Specifically, in this embodiment, the preprocessing of the network intrusion dataset includes the following steps:

[0051] Clean the UNSW-NB15 dataset by removing rows containing "NaN" or "Inf" values, redundant records, and invalid records, and process all data in the dataset that is not of type "int", "float", or "string".

[0052] Next, all non-numerical data in the dataset is converted to numerical data. For example, the 9 attack types and 1 benign data type in the "attack_cat" label are replaced with numerical values: such as Normal is 0, Fuzzers is 1, and so on.

[0053] Then, the dataset is normalized by using Min-Max normalization to compress the data to the range [0, 1], achieving proportional scaling of the original data. This makes different indicators comparable and solves the problem of inconsistent data units affecting model training performance. The normalization calculation formula is as follows (1):

[0054]

[0055] Where X is the original value of this data feature, X min and X max These are the minimum and maximum values ​​in this type of sample data, respectively, and Y is the target value after normalization of each data point.

[0056] The non-numerical data in the UNSW-NB15 dataset was converted into numerical data to transform all data in the dataset into a data type that can be input into the intrusion detection model. Rows containing "NaN" or "Inf" values ​​and redundant records were removed. The dataset was normalized to a form with a mean of 0 and a standard deviation of 1, compressing the data into the interval [0, 1] to solve the problem of inconsistent data units. Normalization can improve the performance of the network intrusion detection model and speed up the training of the model.

[0057] Step 3: Divide the preprocessed dataset into training and test sets.

[0058] As a preferred implementation, in this embodiment, to prevent model overfitting and to better evaluate the model's generalization ability in real-world scenarios, the preprocessed dataset is divided into a training set and a test set in a 7:3 ratio.

[0059] Step 4: Construct a multi-branch 1DCNN network intrusion detection model.

[0060] The multi-branch 1DCNN intrusion detection model includes multi-branch convolutional layers based on one-dimensional convolutional kernels, pooling layers, and fully connected layers. An attention mechanism is incorporated into each convolutional branch, and multiple branches are weighted using parameters optimized by the HBA algorithm. Furthermore, throughout the entire neural network propagation process, all activation functions in the multi-branch 1DCNN intrusion detection model use the ReLU function. Max-pooling layers are used for pooling. A Softmax layer is applied after the network output for multi-class intrusion detection. Additionally, in the multi-branch convolutional layers, the stride of each Conv1D is set to be equal to the convolutional kernel size. Multiple different Conv1Ds are then combined using the Concatenate function.

[0061] In this embodiment, the multi-branch 1DCNN network intrusion detection model is mainly composed of multi-scale convolutional branches with one-dimensional convolutional kernels. Attention mechanisms are also added to each convolutional branch, and the three branches are weighted using parameters optimized by the HBA algorithm. Finally, the multi-class detection of network intrusion is achieved through the Softmax layer.

[0062] Specifically, in this embodiment, the multi-branch 1DCNN network intrusion detection model mainly consists of multi-branch convolutional layers, pooling layers, and fully connected layers. An attention mechanism is also added to each convolutional branch. Furthermore, the three branches are weighted using parameters optimized by the HBA (Honey Badger Algorithm). In addition, all activation functions use the ReLU function throughout the entire neural network propagation process, the pooling layer uses Max-pooling, and a Softmax layer is used after the network output for multi-class detection of network intrusions. Its specific model structure is as follows: Figure 2 As shown.

[0063] The function expression of the ReLU function is as follows (2):

[0064]

[0065] Here, x represents the value input to the ReLU function.

[0066] The function expression of the Softmax function is as follows (3):

[0067]

[0068] Where, x i x represents the i-th element in the input vector; j This represents the j-th element in the input vector.

[0069] Furthermore, in the multi-branch convolutional layer, the stride of each Conv1D is set to be equal to the kernel size. For example, if the kernel size is 1, the stride is set to 1; if the kernel size is 5, the stride is set to 5. Finally, the three different Conv1Ds are combined through a concatenation operation, which fuses the information extracted by several convolutional feature extraction frameworks. This not only enhances feature propagation but also alleviates the gradient vanishing problem to some extent.

[0070] The embodiments of this invention employ a one-dimensional convolutional neural network. One-dimensional convolutional neural networks are more user-friendly for devices with low computing power. Compared with traditional convolutional neural networks, one-dimensional convolutional neural networks have higher computational efficiency, fewer parameters, and smaller models, making them suitable for the network environment described in this invention.

[0071] Step 4: Determine the model hyperparameters. Extract a portion of data from the training and test sets, and use the HBA algorithm to optimize the model's hyperparameters to obtain the optimal hyperparameters.

[0072] The method for obtaining the optimal hyperparameters of the model is as follows:

[0073] Several hyperparameters are defined for the multi-branch 1DCNN network intrusion detection model, forming a hyperparameter space.

[0074] The hyperparameter space was incorporated into the network intrusion detection model using the HBA optimization algorithm. Using a portion of the training and test data, the model parameters were optimized using the HBA algorithm to obtain the optimal hyperparameters.

[0075] The HBA algorithm is used to optimize the hyperparameters of the constructed multi-branch 1DCNN model. This algorithm mainly optimizes by simulating the foraging behavior of honey badgers and has the characteristics of strong optimization ability and fast convergence speed. Its main steps are as follows:

[0076] S1: Population Initialization

[0077] Within a defined boundary range, the number of honey badgers (population size N) and their respective locations are randomly initialized, as shown in equation (4):

[0078] x i =lb i +r1*(ub i -lb i (4);

[0079] Among them, ub i and lb i Let r1 be a random number between [0, 1], and x be the upper and lower bounds of the search. i Let i be the i-th individual in the population.

[0080] S2: Define density factor

[0081] The density factor is defined as shown in equation (5), and its intensity is related to the prey's concentration force and the distance between it and the prey. i It refers to the concentration of the prey's scent. If the scent concentration is high, the prey moves quickly, and vice versa.

[0082]

[0083] Where S is the source intensity or concentrated intensity; d i Indicates the distance between the prey and the current individual honey badger; x prey r1 represents the location of the prey, which is considered the location of the optimal individual in this scenario; r2 represents a random number between [0, 1].

[0084] S3: Update density factor

[0085] The density factor α controls the time-varying randomization to ensure a smooth transition from exploration to mining. The specific expression is shown in equation (6):

[0086]

[0087] Among them, t max The maximum number of iterations is given; and C ≥ 1; t represents the current iteration number.

[0088] S4: Escape local optima

[0089] This step, along with the next two, is used to escape local optima. In this phase, a flag "F" is used to change the direction of the search, taking advantage of more opportunities to rigorously scan the search space.

[0090] S5: Update individual position

[0091] As mentioned above, the HBA location update process is divided into two parts: the "mining phase" and the "honey harvesting phase".

[0092] a) Excavation stage

[0093] During the digging phase, the honey badger performs heart-shaped movements. Its heart-shaped motion X new Simulation can be performed using equation (7):

[0094] X new =X prey +F*β*I*X prey +F*r3*α*d i *|cos(2πr4)*[1-cos(2πr5)]| (7);

[0095] Among them, Xprey It is the globally optimal position; β≥1 represents the honey badger's ability to obtain food; d i The distance between the prey and the current honey badger individual is represented by (same as in equation (5)); r3, r4, and r5 are three distinct random numbers between [0, 1]; I represents the odor concentration of the prey; α represents the density factor; F is a flag for changing the search direction, as detailed in expression (8):

[0096]

[0097] r6 is also a random number between [0, 1].

[0098] b) Honey harvesting stage

[0099] The honey badger following the honey guide badger to the beehive can be simulated as equation (9):

[0100] X new =X prey +F*r7*α*d i (9)

[0101] Among them, X new The updated location of the honey badger; X prey The location of the prey; F and α are determined by expressions (8) and (6) respectively; r7 is a random number between [0, 1].

[0102] For each hyperparameter, several possible values ​​commonly used in convolutional neural networks that make the model perform well are set, along with the weight coefficients on the three convolutional branches, to form the hyperparameter space.

[0103] Using a subset of training and testing data, the HBA algorithm is used to optimize the model's parameters, thereby obtaining the optimal hyperparameters.

[0104] Step 5: Model Training. The optimal hyperparameters are used as parameters for the multi-branch 1DCNN model. The network intrusion detection model is trained using the pre-defined training set to obtain the multi-branch 1DCNN network intrusion detection model to be tested.

[0105] Step 6: Model Detection. Input the test set data into the multi-branch 1DCNN network intrusion detection model to be tested, and obtain the final classification result.

[0106] The test set data is input into the multi-branch 1DCNN network intrusion detection model to be tested, and the final classification result is obtained. If the test result is consistent with the real result, the model is used as the final network intrusion detection model; otherwise, the optimal hyperparameters are adjusted until the model test result is consistent with the real result.

[0107] After obtaining the optimal hyperparameters, the model is trained using the training set. Once the model training is complete, the preprocessed data to be detected can be input to obtain the classification results of the data, thereby determining whether it is abnormal data.

[0108] Furthermore, in some embodiments, the network intrusion detection method based on HBA and multi-branch 1DCNN also includes a model evaluation step.

[0109] The model evaluation step evaluates the multi-branch 1DCNN network intrusion detection model using accuracy, precision, recall, and / or F-score.

[0110] Specifically, the model is evaluated using accuracy, precision, recall, and / or F-score, with the calculation formulas as follows:

[0111]

[0112]

[0113]

[0114]

[0115] Wherein, TP is the number of positive samples predicted as positive, that is, the number of positive samples correctly identified; FP is the number of negative samples predicted as positive, that is, the number of falsely reported negative samples; TN is the number of negative samples predicted as negative, that is, the number of falsely reported negative samples; and FN is the number of positive samples predicted as negative, that is, the number of falsely reported positive samples.

[0116] To further verify the comprehensive performance of the network intrusion detection method based on HBA and multi-branch 1DCNN in this embodiment of the invention, under the same experimental conditions, models with superior detection performance in existing literature, such as CNN-BiLSTM, SSAE-LSTM, CWGAN-DNN, AE-CGAN-RF, and F-CSGRU algorithms, were reproduced according to their paper descriptions and parameter settings. These models were then applied to the UNSW-NB15 dataset for binary and multi-class intrusion detection experiments, and the performance results are shown in Tables 2 and 3 below.

[0117] Table 2 compares the current model with models that outperform existing models in the literature for multi-class classification on the UNSW-NB15 dataset.

[0118]

[0119] Table 3 compares the current model with models in existing literature that outperform it in binary classification on the UNSW-NB15 dataset.

[0120]

[0121] The performance of different models on the test set shows that the present invention has good performance and high detection accuracy in intrusion detection. Furthermore, after optimization of the HBA algorithm, the model training process is significantly accelerated and stabilizes earlier, achieving rapid convergence. This demonstrates the potential and application prospects of the network intrusion detection method based on HBA and multi-branch 1DCNN in the field of intrusion detection.

[0122] In summary, the network intrusion detection method based on HBA and multi-branch 1DCNN of this invention can achieve high accuracy, high convergence speed and high training efficiency in network environments with large data volume and high real-time requirements.

[0123] Specifically, the network intrusion detection method based on HBA and multi-branch 1DCNN in this embodiment of the invention optimizes the model hyperparameters by using the HBA algorithm, automatically adjusting the model parameter values ​​to find a better combination of hyperparameters. This eliminates the need for repeated manual experiments and parameter tuning, improving training efficiency and model detection performance, and accelerating network convergence. Furthermore, the network intrusion detection method based on HBA and multi-branch 1DCNN in this embodiment employs multi-scale convolutional branches, using convolutional kernels of different sizes, allowing the network to learn features at different scales simultaneously. This better captures relationships in the input data, increases the network's receptive field and robustness, and mitigates the risk of overfitting to some extent.

[0124] It should be noted that all features disclosed in this specification, or all steps in all methods or processes disclosed, may be combined in any way, except for mutually exclusive features and / or steps.

[0125] Furthermore, the specific embodiments described above are exemplary. Those skilled in the art can devise various solutions inspired by the disclosure of this invention, and these solutions all fall within the scope of this invention and its protection. Those skilled in the art should understand that this specification and its accompanying drawings are illustrative and not intended to limit the scope of the claims. The scope of protection of this invention is defined by the claims and their equivalents.

Claims

1. A network intrusion detection method based on HBA and multi-branch 1DCNN, characterized in that, It includes the following steps: Obtain network intrusion dataset; Preprocess the network intrusion dataset; The preprocessed dataset is divided into a training set and a test set; Construct a multi-branch 1DCNN network intrusion detection model; The multi-branch 1DCNN network intrusion detection model includes multi-branch convolutional layers, pooling layers, and fully connected layers based on one-dimensional convolutional kernels; furthermore, an attention mechanism is added to each convolutional branch, and multiple branches are weighted using parameters optimized by the HBA algorithm. In a multi-branch convolutional layer, the stride of each Conv1D is set to be equal to the size of the convolutional kernel; and multiple different Conv1Ds are combined using the Concatenate function. We extract some data from the training and test sets and use the HBA algorithm to optimize the model's hyperparameters to obtain the optimal hyperparameters of the model. The optimal hyperparameters are used as the parameters of the multi-branch 1DCNN model. The network intrusion detection model is trained using the partitioned training set to obtain the multi-branch 1DCNN network intrusion detection model to be tested. The test set data is input into the multi-branch 1DCNN network intrusion detection model to be tested, and the final classification result is obtained.

2. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 1, characterized in that, The network intrusion dataset is the UNSW-NB15 dataset.

3. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 1, characterized in that, The method for preprocessing network intrusion datasets is as follows: The network intrusion dataset is quantified, standardized, and normalized.

4. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 1, characterized in that, The preprocessed dataset was divided into training and test sets in a 7:3 ratio.

5. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 1, characterized in that, The multi-branch 1DCNN network intrusion detection model uses the ReLU function for all activation functions throughout the entire neural network propagation process; the pooling layer uses the Max-pool layer; and the network output uses the Softmax layer for multi-class detection of network intrusion.

6. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 1, characterized in that, The method for obtaining the optimal hyperparameters of the model is as follows: Several hyperparameters are defined for the multi-branch 1DCNN network intrusion detection model, forming a hyperparameter space; The hyperparameter space was incorporated into the network intrusion detection model using the HBA optimization algorithm. Using a portion of the training and test data, the model parameters were optimized using the HBA algorithm to obtain the optimal hyperparameters.

7. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 1, characterized in that, It also includes a model evaluation step; The model evaluation step evaluates the multi-branch 1DCNN network intrusion detection model using accuracy, precision, recall, and / or F-score.

8. The network intrusion detection method based on HBA and multi-branch 1DCNN according to claim 3, characterized in that, Preprocessing network intrusion datasets includes the following steps: Perform a cleaning operation on the network intrusion dataset, removing rows containing "NaN" or "Inf" values, redundant records, and invalid records, and processing all data in the dataset that is not of type "int", "float", or "string". Then, convert all non-numerical data in the dataset into numerical data; Finally, the dataset is normalized to a form with a mean of 0 and a standard deviation of 1, compressing the data into the interval [0, 1].

Images