Network intrusion detection method, system, device and medium based on contrastive learning

Abstract

The present invention discloses a network intrusion detection method, system, device and medium based on contrastive learning. The method comprises the following steps: obtaining and normalizing network traffic data packets, arranging the normalized network traffic data packets in chronological order and then performing preprocessing, wherein the network traffic data comprises normal traffic data and attack traffic data; converting the preprocessed network traffic data packets into two-dimensional images, and dividing them into a training set and a test set; using a CNN model as a feature extractor, inputting the training set into the CNN model, extracting high-dimensional features of the two-dimensional image, and generating normal-abnormal sample pairs; mapping the extracted high-dimensional features onto a unit sphere by a contrastive learning method, and performing data classification; inputting the classified data into a prediction model for analysis and prediction, and outputting the results; and inputting the test set into the trained CNN model and the prediction model in sequence to perform network intrusion detection.

Description

Technical Field

[0001] The present invention belongs to the field of information security technology, and in particular relates to a network intrusion detection method, system, equipment and medium based on contrastive learning. Background Art

[0002] With the rapid development of network technology, network traffic has become increasingly complex and diverse, and the boundary between malicious network behavior and normal network behavior has become increasingly blurred, resulting in unprecedented challenges for network intrusion detection, especially the difficulties brought about by intra-class diversity and inter-class similarity.

[0003] In the field of machine learning, convolutional neural networks (CNNs) have achieved remarkable results in image processing and speech recognition due to their excellent feature extraction capabilities. However, there are limitations when directly applying CNNs to network traffic data because such data lacks the obvious spatial structure of image data. In addition, the continuous changes in network traffic data also place higher requirements on the generalization ability of the model.

[0004] Contrastive learning has been successfully applied in many fields such as image recognition, natural language processing and video understanding, and has significantly surpassed existing technologies. Unlike traditional deep learning methods, it focuses more on learning feature representations that can effectively reflect the semantic relationship between samples. Summary of the invention

[0005] In order to overcome one or more of the above technical deficiencies, the present invention provides a network intrusion detection method, system, device and medium based on contrastive learning.

[0006] In order to solve the above problem, the first aspect of the present invention provides a network intrusion detection method based on contrastive learning, comprising the following steps:

[0007] Acquire and normalize network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data;

[0008] Convert the preprocessed network traffic data packets into two-dimensional images and divide them into training sets and test sets;

[0009] The CNN model is used as a feature extractor. The training set is input into the CNN model to extract high-dimensional features of the two-dimensional image and generate normal-abnormal sample pairs.

[0010] The extracted high-dimensional features are mapped to the unit sphere through contrastive learning method to perform data classification;

[0011] Input the classified data into the prediction model for analysis and prediction, and output the results;

[0012] The test set is input into the trained CNN model and prediction model in turn to perform network intrusion detection.

[0013] Optionally, the step of acquiring and normalizing the network traffic data packets, arranging the normalized network traffic data packets in chronological order and then performing preprocessing comprises the following steps:

[0014] The network traffic data packets are normalized according to the five-tuple format, where the five-tuple format is: five-tuple [source IP, destination IP, port number, protocol type, timestamp];

[0015] Set the IP address, port number and MAC address in the network traffic data packet to zero;

[0016] Sort network traffic packets in chronological order;

[0017] Quantile normalization is used to reduce the range of each byte in the network traffic data packet to [0,1].

[0018] Optionally, the step of converting the preprocessed network traffic data packet into a two-dimensional image comprises the following steps:

[0019] Dividing the network traffic data packets into consecutive data blocks according to the timestamps, wherein each data block includes all the network traffic data packets within a selected time window;

[0020] Select key features from each data block and organize the key features into a two-dimensional array;

[0021] Convert a 2D array to a 2D image, where each array element is a pixel of the 2D image.

[0022] Optionally, the step of selecting key features from each data block comprises the following steps:

[0023] Get the number, size and direction of packets in a data block;

[0024] Generate frequent item sets based on the degree of association between each data packet;

[0025] Select a frequent set from the item set, and select the items in the frequent set as key features.

[0026] Optionally, the step uses a CNN model as a feature extractor, inputs the training set into the CNN model, extracts high-dimensional features of the two-dimensional image, and generates normal-abnormal sample pairs, including the following steps:

[0027] Select a convolution kernel to perform convolution operation on the two-dimensional image in the training set to obtain feature mapping data;

[0028] The activation function is used to operate the feature map data, and the operation results are input into the pooling layer for compression and downsampling;

[0029] The output of the pooling layer is input into the fully connected layer for transformation, and the high-dimensional features of the two-dimensional image are output;

[0030] Extract deep features of the training set based on high-dimensional features of two-dimensional images;

[0031] The deep features are combined with label information to divide the training set and generate normal-abnormal sample pairs.

[0032] Optionally, before the step of selecting a convolution kernel to perform a convolution operation on the two-dimensional image in the training set, the following steps are also included:

[0033] The safety sample screening rules are obtained through the upper and lower intervals, and the neural network algorithm is used to screen the training set to obtain the optimal training set.

[0034] Optionally, the step of mapping the extracted high-dimensional features onto a unit sphere by a contrastive learning method to perform data classification includes the following steps:

[0035] The CNN model is trained using the predefined infoNCE-Binary Crossentropy joint function;

[0036] Map the extracted high-dimensional features onto the unit sphere to obtain the feature vector mapped onto the unit sphere;

[0037] The cosine similarity method is used to calculate the similarity between two feature vectors;

[0038] Optimize the classification of feature vectors.

[0039] A second aspect of the present invention provides a network intrusion detection system based on contrastive learning, which is used to implement the above-mentioned network intrusion detection method based on contrastive learning, comprising:

[0040] The network traffic data packet processing module is used to obtain and normalize the network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data;

[0041] The model training module is used to convert the pre-processed network traffic data packets into two-dimensional images and divide them into training sets and test sets; the CNN model is used as a feature extractor, the training set is input into the CNN model, the high-dimensional features of the two-dimensional image are extracted, and normal-abnormal sample pairs are generated; the extracted high-dimensional features are mapped to the unit sphere through the contrastive learning method to perform data classification; the classified data is input into the prediction model for analysis and prediction, and the results are output;

[0042] The network intrusion detection module is used to input the test set into the trained CNN model and prediction model in sequence to perform network intrusion detection.

[0043] A third aspect of the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above method when executing the computer program.

[0044] A fourth aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the above method when executed by a processor.

[0045] Compared with the prior art, the present invention has the following beneficial effects:

[0046] The present invention discloses a network intrusion detection method, system, device and medium based on contrastive learning. The method comprises the following steps: obtaining and normalizing network traffic data packets, arranging the normalized network traffic data packets in chronological order and then preprocessing them, wherein the network traffic data packets comprise normal traffic data and attack traffic data; converting the preprocessed network traffic data packets into two-dimensional images, and dividing them into a training set and a test set; using a CNN model as a feature extractor, inputting the training set into the CNN model, extracting high-dimensional features of the two-dimensional images, and generating normal-abnormal sample pairs; mapping the extracted high-dimensional features onto a unit sphere by a contrastive learning method, and performing data classification; inputting the classified data into a prediction model for analysis and prediction, and outputting the results; and inputting the test set into the trained CNN model and the prediction model in sequence to perform network intrusion detection. By using a contrast method to map the extracted high-dimensional features onto a unit sphere, the same type of data can be spatially aggregated and different types of data can be spatially distanced, thereby achieving data classification, enhancing the ability to aggregate similar data samples and distinguish different data samples, and achieving simultaneous enhancement of detection accuracy and sample feature distribution optimization. Through contrastive learning, network traffic detection is enhanced to meet the increasingly complex needs of network intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] The specific embodiments of the present invention are further described in detail below in conjunction with the accompanying drawings, wherein:

[0048] Figure 1 This is a flow chart of the network intrusion detection method based on contrastive learning described in Example 1;

[0049] Figure 2 This is a schematic diagram of the structure of the network intrusion detection system based on contrastive learning described in Example 2;

[0050] Figure 3 This is a schematic diagram of the structure of the computer device described in Example 3. DETAILED DESCRIPTION

[0051] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0052] Example 1

[0053] like Figure 1 This embodiment discloses a network intrusion detection method based on contrastive learning, comprising the following steps:

[0054] S1. Acquire and normalize network traffic data packets, arrange the normalized network traffic data packets in chronological order, and then perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data.

[0055] Specifically, step S1 includes the following steps:

[0056] The network traffic data packets are normalized according to the five-tuple format, where the five-tuple format is: five-tuple [source IP, destination IP, port number, protocol type, timestamp].

[0057] The IP address, port number, and MAC address in the network traffic data packet are set to zero to avoid overfitting.

[0058] Sort network traffic packets in chronological order to ensure that the data reflects the true sequence of network behavior.

[0059] The quantile normalization method is used to reduce the range of each byte in the network traffic data packet to [0,1]. Specifically, for each numerical feature in the network traffic data packet In this embodiment, the numerical feature refers to the data information in the five-tuple format, and the quantile transformation first calculates its quantile in the network traffic data packet. It is a feature In percentile The value of between 0 and 1. The goal of the quantile transformation is to find a mapping Will The original value of is mapped to its relative position in the distribution:

[0060]

[0061] in, is a mapping such that The value of falls between 0 and 1, and if The quantiles in the original data are So Should be close

[0062] After quantile transformation, the eigenvalues ​​are already in the range [0,1]; by Multiply by 255 to scale these eigenvalues ​​to the range [0,255]:

[0063] in, is the scaled eigenvalue, falling in the range [0,255].

[0064] S2. Convert the preprocessed network traffic data packets into two-dimensional images and divide them into training set and test set.

[0065] Specifically, step S2 includes the following steps:

[0066] The network traffic data packets are divided into continuous data blocks according to the timestamps, wherein each data block includes all the network traffic data packets within a selected time window.

[0067] Key features are selected from each data block and organized into a two-dimensional array, where each row in the two-dimensional array represents a key feature and each column represents a time point.

[0068] Convert a 2D array into a 2D image, where each array element is a pixel of the 2D image. A change in an array element can result in a change in the color or intensity of a pixel. For multi-channel images (such as RGB images), different key features can be mapped to different color channels.

[0069] In one embodiment, the step of selecting key features from each data block comprises the following steps:

[0070] Get basic features such as the number, size, and direction of packets in a data block.

[0071] According to the degree of association between each data packet, a frequent 1-item set L1, a frequent 2-item set L2, and so on, a frequent r-item set L r , at this time the r value makes L r Empty; in the kth cycle, a set C of candidate k-itemsets is generated k, C k Each item set in L is a pair of two items that have only one item belonging to L k-1 The itemsets are connected by (k-2) connections, C k The item set in is a set of items with a high degree of association. Specifically, when generating the set C of candidate k-item sets k When the two L k-1 Combine the frequent (k-1)-itemsets of the candidate itemsets if and only if the two itemsets are identical in the first k-2 elements, to ensure that all non-empty subsets of the generated candidate itemsets are frequent.

[0072] From C k Select the frequent set L from the k-item set k , and select the frequency set L k The items in are used as key features.

[0073] The test set and training set are divided into two parts in a ratio of 2:8.

[0074] S3. Use the CNN model as a feature extractor, input the training set into the CNN model, extract the high-dimensional features of the two-dimensional image, and generate normal-abnormal sample pairs.

[0075] Specifically, step S3 includes the following steps:

[0076] Select a convolution kernel to perform convolution operation on the two-dimensional image in the training set to obtain feature mapping data;

[0077] The activation function is used to operate the feature map data, and the operation results are input into the pooling layer for compression and downsampling;

[0078] The output of the pooling layer is input into the fully connected layer for transformation, and the high-dimensional features of the two-dimensional image are output;

[0079] Extract deep features of the training set based on high-dimensional features of two-dimensional images;

[0080] The deep features are combined with label information to divide the training set and generate normal-abnormal sample pairs.

[0081] In one embodiment, before the step of selecting a convolution kernel to perform a convolution operation on the two-dimensional image in the training set, the following steps are also included:

[0082] Use neural network algorithm to screen the training set:

[0083] Its solution:

[0084]

[0085] Among them, ψ(·) is the penalty term, φ(·) is the loss function, λ>0 is a regularization parameter that can balance the penalty term and the loss function, and the penalty term uses the L2 norm. The loss function is the hinge loss function.

[0086] In order to find the optimal classification decision boundary, solve the original problem expressed by equation (4.1) and obtain the optimal solution W*. In order to find the optimal classification decision boundary, solve the dual problem of the original problem as follows:

[0087]

[0088] s.t0≤α i ≤λ,1≤i≤n (4.2)

[0089] in, is the kernel function defined by the feature map Φ. Construct an original space The space contains w * , and then calculate the lower interval of the interval and upper interval

[0090] The optimal solution to the inclusion problem W * The spherical region of is defined as follows:

[0091] For any

[0092]

[0093] in, It is a feasible solution and Duality gap defined

[0094] For a spherical region given in (4.3), the upper and lower intervals of the region are defined as follows:

[0095]

[0096] From the above, we can get the optimal solution α * .

[0097] The safety sample screening rules are obtained through the upper and lower intervals, and the data in the training set are screened according to the neural network algorithm. The worthless and unimportant data are removed from the training set to achieve the screening of the data in the training set, which is convenient for the subsequent extraction of training set images and avoids the residual of invalid data affecting the detection effect.

[0098] In one embodiment, the present invention provides a dual-branch structure, including a comparison branch and a prediction branch. The comparison branch is used to optimize the distance between samples, and the prediction branch is used to predict and classify traffic. The CNN model is shared by the two branches as a feature extractor, that is, no matter what type of input data is processed, the same CNN model is used for feature extraction, and a shared architecture is constructed, which helps to improve the model's generalization ability for different data.

[0099] When CNN models are used in conjunction with contrastive learning and prediction models:

[0100] S4. The extracted high-dimensional features are mapped to the unit sphere through contrastive learning method for data classification.

[0101] Specifically, step S4 includes:

[0102] The enhanced view is constructed by using random sequence masking method, which randomly selects specific rows or columns of the image and modifies the pixel values ​​of the corresponding area to simulate data loss or distortion. That is, the enhanced view contains a certain proportion of masked information while retaining most of the original information.

[0103] The CNN model is trained using the predefined infoNCE-Binary Crossentropy joint function to identify the difference between the original image (complete network traffic data) and the enhanced view (partially obscured data). The loss function infoNCE is:

[0104]

[0105] The loss function Binary Crossentropy is:

[0106]

[0107] The predefined infoNCE-BinaryCrossentropy joint functions are:

[0108] l total =λ·l InfoNCE +(1-λ)·l classify

[0109] Where N is the total number of sample pairs; z i is a sample feature anchor point; Yes i and the matching positive sample; z j is the sample feature in the batch, including positive samples and negative samples; K is the total number of samples in the batch (including one positive sample and K-1 negative samples); sim(x·y) is the similarity score between x and y; and zi ·z j Represent the dot product between the anchor sample and the positive sample and other samples respectively; is a temperature parameter used to scale the result of the dot product; λ is a weight parameter between 0 and 1 that is used to adjust the relative importance between the two loss functions.

[0110] In order to enhance the discriminative ability of the CNN model, the extracted high-dimensional features are mapped to the unit sphere to obtain the feature vector mapped to the unit sphere:

[0111] The cosine similarity method is used to calculate the similarity between two feature vectors. For antiparallel and parallel vectors, the cosine similarity is bounded between -1 and 1, and is equal to 0 for orthogonal vectors. On the unit sphere, the cosine similarity score can be calculated using the dot product:

[0112] Optimize the classification of feature vectors, classify feature vectors with positive sample relationships into the same category based on the positive sample relationships of all feature vectors, determine the number of categories for category division based on the negative sample relationships of all feature vectors, and complete the category division of all feature vectors. Optimizing the classification of feature vectors usually involves improving the distance metric between samples to enhance the performance of the classifier. It is usually performed in a feature space, with the goal of making the distance between samples of the same category (positive samples) as small as possible (small intra-class distance) and the distance between different categories (positive samples and negative samples) as large as possible (large inter-class distance), even if the distance between negative samples gradually becomes farther and the distance between positive samples gradually decreases; given a network traffic sample X and a label Y, and using the average distance between samples from the same category to represent the intra-class distance:

[0113]

[0114] The average distance between samples of different categories is used to represent the inter-class distance:

[0115]

[0116] S5. Input the classified and optimized data into the prediction model for analysis and prediction, and output the results.

[0117] S6. Input the test set into the trained CNN model and prediction model in turn to perform network intrusion detection and evaluate the detection accuracy of the trained CNN model and prediction model. Specifically, the evaluation can be performed using indicators such as accuracy, precision, recall, and F1 score.

[0118] When the CNN model is used in conjunction with a prediction model:

[0119] The prediction model includes multiple fully connected layers, which analyze and predict high-dimensional features. Specifically, when given When , the prediction model is:

[0120] The Adam optimizer is used in the training process, and the loss function is BinaryCrossentropy. The number of epochs can be set to 10 to 20 at the beginning. The number of epochs can be adjusted after observing the model training situation. The batch size can start from 32 or 64, and can be adjusted according to the amount of data and computing resources. When training the model, add callback functions to monitor the training process, such as early stopping, to prevent overfitting.

[0121] The loss function BinaryCrossentropy is:

[0122]

[0123] Where N is the number of samples; y i is the true label of the i-th sample; y′ i is the probability predicted by the model.

[0124] Input the test set into the trained CNN model and prediction model in turn to perform network intrusion detection and evaluate the detection accuracy of the trained CNN model and prediction model. Specifically, the evaluation can be performed using indicators such as accuracy, precision, recall, and F1 score. Adjust the number of layers, number of neurons, learning rate, and number of iterations of the model as needed. Use the trained CNN model and prediction model to predict new data, analyze the error rate of the model, and see which types of data are most likely to be misclassified to further optimize the model.

[0125] When using the trained CNN model and prediction model to detect new network traffic packets, the feature learning and classification results are recorded and analyzed.

[0126] The network traffic data collected in the network intrusion detection system within a certain period of time is selected, and the data is cleaned and preprocessed. The processed data is used as input, and the corresponding processing results are obtained and the processing error rate is statistically processed. The time used for the two different branch applications to process network traffic data detection is recorded, and the detection accuracy of the two different branch applications is analyzed. The various record information of the two models processing input data can also be counted and displayed in the form of charts, and the analysis and judgment of which branch application has a better processing effect on the input data is analyzed to verify the effect of combining comparative learning with deep learning. After verification, it can be seen that the CNN model-comparison branch-prediction branch can enhance the detection of network traffic data and meet the increasingly complex needs of network intrusion detection.

[0127] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0128] Example 2

[0129] Based on the same inventive concept, the embodiment of the present application also provides a network intrusion detection system based on contrastive learning for implementing the network intrusion detection method based on contrastive learning involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more embodiments of the network intrusion detection system based on contrastive learning provided below can refer to the limitations of the network intrusion detection method based on contrastive learning above, and will not be repeated here.

[0130] like Figure 2 , a network intrusion detection system based on contrastive learning, including a network traffic data packet processing module, a model training module and a network intrusion detection module, wherein:

[0131] The network traffic data packet processing module is used to obtain and normalize the network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data;

[0132] The model training module is used to convert the pre-processed network traffic data packets into two-dimensional images and divide them into training sets and test sets; the CNN model is used as a feature extractor, the training set is input into the CNN model, the high-dimensional features of the two-dimensional image are extracted, and normal-abnormal sample pairs are generated; the extracted high-dimensional features are mapped to the unit sphere through the contrastive learning method to perform data classification; the classified data is input into the prediction model for analysis and prediction, and the results are output;

[0133] The network intrusion detection module is used to input the test set into the trained CNN model and prediction model in sequence to perform network intrusion detection.

[0134] In one embodiment, the network traffic data packet processing module is further configured to:

[0135] The network traffic data packets are normalized according to the five-tuple format, where the five-tuple format is: five-tuple [source IP, destination IP, port number, protocol type, timestamp];

[0136] Set the IP address, port number and MAC address in the network traffic data packet to zero;

[0137] Sort network traffic packets in chronological order;

[0138] Quantile normalization is used to reduce the range of each byte in the network traffic data packet to [0,1].

[0139] In one embodiment, the model training module is further used to:

[0140] Dividing the network traffic data packets into consecutive data blocks according to the timestamps, wherein each data block includes all the network traffic data packets within a selected time window;

[0141] Select key features from each data block and organize the key features into a two-dimensional array;

[0142] Convert a 2D array to a 2D image, where each array element is a pixel of the 2D image.

[0143] In one embodiment, the model training module is further used to:

[0144] Get the number, size and direction of packets in a data block;

[0145] Generate frequent item sets based on the degree of association between each data packet;

[0146] Select the frequent set from the item set and select the items in the frequent set as key features

[0147] In one embodiment, the model training module is further used to:

[0148] Select a convolution kernel to perform convolution operation on the two-dimensional image in the training set to obtain feature mapping data;

[0149] The activation function is used to operate the feature map data, and the operation results are input into the pooling layer for compression and downsampling;

[0150] The output of the pooling layer is input into the fully connected layer for transformation, and the high-dimensional features of the two-dimensional image are output;

[0151] Extract deep features of the training set based on high-dimensional features of two-dimensional images;

[0152] The deep features are combined with label information to divide the training set and generate normal-abnormal sample pairs.

[0153] In one embodiment, the model training module is further used to:

[0154] The safety sample screening rules are obtained through the upper and lower intervals, and the neural network algorithm is used to screen the training set to obtain the optimal training set.

[0155] In one embodiment, the model training module is further used to:

[0156] The CNN model is trained using the predefined infoNCE-Binary Crossentropy joint function;

[0157] Map the extracted high-dimensional features onto the unit sphere to obtain the feature vector mapped onto the unit sphere;

[0158] The cosine similarity method is used to calculate the similarity between two feature vectors;

[0159] Optimize the classification of feature vectors.

[0160] Example 3

[0161] This embodiment discloses a computer device, which may be a server or terminal integrated with a scheduler, and its internal structure diagram may be as follows: Figure 3As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network intrusion detection method based on contrastive learning is implemented.

[0162] Those skilled in the art will understand that Figure 3 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0163] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the following steps are implemented:

[0164] Acquire and normalize network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data;

[0165] Convert the preprocessed network traffic data packets into two-dimensional images and divide them into training sets and test sets;

[0166] The CNN model is used as a feature extractor. The training set is input into the CNN model to extract high-dimensional features of the two-dimensional image and generate normal-abnormal sample pairs.

[0167] The extracted high-dimensional features are mapped to the unit sphere through contrastive learning method to perform data classification;

[0168] Input the classified data into the prediction model for analysis and prediction, and output the results;

[0169] The test set is input into the trained CNN model and prediction model in turn to perform network intrusion detection.

[0170] The processor also implements the following steps when executing the computer program:

[0171] The network traffic data packets are normalized according to the five-tuple format, where the five-tuple format is: five-tuple [source IP, destination IP, port number, protocol type, timestamp];

[0172] Set the IP address, port number and MAC address in the network traffic data packet to zero;

[0173] Sort network traffic packets in chronological order;

[0174] Quantile normalization is used to reduce the range of each byte in the network traffic data packet to [0,1].

[0175] The processor also implements the following steps when executing the computer program:

[0176] Dividing the network traffic data packets into consecutive data blocks according to the timestamps, wherein each data block includes all the network traffic data packets within a selected time window;

[0177] Select key features from each data block and organize the key features into a two-dimensional array;

[0178] Convert a 2D array to a 2D image, where each array element is a pixel of the 2D image.

[0179] The processor also implements the following steps when executing the computer program:

[0180] Get the number, size and direction of packets in a data block;

[0181] Generate frequent item sets based on the degree of association between each data packet;

[0182] Select a frequent set from the item set, and select the items in the frequent set as key features.

[0183] The processor also implements the following steps when executing the computer program:

[0184] Select a convolution kernel to perform convolution operation on the two-dimensional image in the training set to obtain feature mapping data;

[0185] The activation function is used to operate the feature map data, and the operation results are input into the pooling layer for compression and downsampling;

[0186] The output of the pooling layer is input into the fully connected layer for transformation, and the high-dimensional features of the two-dimensional image are output;

[0187] Extract deep features of the training set based on high-dimensional features of two-dimensional images;

[0188] The deep features are combined with label information to divide the training set and generate normal-abnormal sample pairs.

[0189] The processor also implements the following steps when executing the computer program:

[0190] The safety sample screening rules are obtained through the upper and lower intervals, and the neural network algorithm is used to screen the training set to obtain the optimal training set.

[0191] The processor also implements the following steps when executing the computer program:

[0192] The CNN model is trained using the predefined infoNCE-Binary Crossentropy joint function;

[0193] Map the extracted high-dimensional features onto the unit sphere to obtain the feature vector mapped onto the unit sphere;

[0194] The cosine similarity method is used to calculate the similarity between two feature vectors;

[0195] Optimize the classification of feature vectors.

[0196] Example 4

[0197] This embodiment discloses a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0198] Acquire and normalize network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data;

[0199] Convert the preprocessed network traffic data packets into two-dimensional images and divide them into training sets and test sets;

[0200] The CNN model is used as a feature extractor. The training set is input into the CNN model to extract high-dimensional features of the two-dimensional image and generate normal-abnormal sample pairs.

[0201] The extracted high-dimensional features are mapped to the unit sphere through contrastive learning method to perform data classification;

[0202] Input the classified data into the prediction model for analysis and prediction, and output the results;

[0203] The test set is input into the trained CNN model and prediction model in turn to perform network intrusion detection.

[0204] When the computer program is executed by the processor, the following steps are also performed:

[0205] The network traffic data packets are normalized according to the five-tuple format, where the five-tuple format is: five-tuple [source IP, destination IP, port number, protocol type, timestamp];

[0206] Set the IP address, port number and MAC address in the network traffic data packet to zero;

[0207] Sort network traffic packets in chronological order;

[0208] Quantile normalization is used to reduce the range of each byte in the network traffic data packet to [0,1].

[0209] When the computer program is executed by the processor, the following steps are also performed:

[0210] Dividing the network traffic data packets into consecutive data blocks according to the timestamps, wherein each data block includes all the network traffic data packets within a selected time window;

[0211] Select key features from each data block and organize the key features into a two-dimensional array;

[0212] Convert a 2D array to a 2D image, where each array element is a pixel of the 2D image.

[0213] When the computer program is executed by the processor, the following steps are also performed:

[0214] Get the number, size and direction of packets in a data block;

[0215] Generate frequent item sets based on the degree of association between each data packet;

[0216] Select a frequent set from the item set, and select the items in the frequent set as key features.

[0217] When the computer program is executed by the processor, the following steps are also performed:

[0218] Select a convolution kernel to perform convolution operation on the two-dimensional image in the training set to obtain feature mapping data;

[0219] The activation function is used to operate the feature map data, and the operation results are input into the pooling layer for compression and downsampling;

[0220] The output of the pooling layer is input into the fully connected layer for transformation, and the high-dimensional features of the two-dimensional image are output;

[0221] Extract deep features of the training set based on high-dimensional features of two-dimensional images;

[0222] The deep features are combined with label information to divide the training set and generate normal-abnormal sample pairs.

[0223] When the computer program is executed by the processor, the following steps are also performed:

[0224] The safety sample screening rules are obtained through the upper and lower intervals, and the neural network algorithm is used to screen the training set to obtain the optimal training set.

[0225] The processor also implements the following steps when executing the computer program:

[0226] The CNN model is trained using the predefined infoNCE-Binary Crossentropy joint function;

[0227] Map the extracted high-dimensional features onto the unit sphere to obtain the feature vector mapped onto the unit sphere;

[0228] The cosine similarity method is used to calculate the similarity between two feature vectors;

[0229] Optimize the classification of feature vectors.

[0230] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetoresistive random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0231] The technical features of the above embodiments may be arbitrarily combined. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0232] The above description is only a preferred embodiment of the present invention and does not limit the present invention in any form. Therefore, any modification, equivalent change and modification made to the above embodiment based on the technical essence of the present invention without departing from the technical solution of the present invention shall still fall within the scope of the technical solution of the present invention.

Claims

1. A network intrusion detection method based on contrastive learning, characterized in that: The steps include: Acquire and normalize network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data; Convert the preprocessed network traffic data packets into two-dimensional images and divide them into training sets and test sets; The CNN model is used as a feature extractor. The training set is input into the CNN model to extract high-dimensional features of the two-dimensional image and generate normal-abnormal sample pairs. The extracted high-dimensional features are mapped to the unit sphere through contrastive learning method to perform data classification; Input the classified data into the prediction model for analysis and prediction, and output the results; The test set is sequentially input into the trained CNN model and prediction model to perform network intrusion detection; The steps are as follows: Using the CNN model as a feature extractor, inputting the training set into the CNN model, extracting high-dimensional features of the two-dimensional image, and generating normal-abnormal sample pairs, including the following steps: Select a convolution kernel to perform convolution operation on the two-dimensional image in the training set to obtain feature mapping data; Steps Before selecting the convolution kernel to perform convolution operation on the two-dimensional image in the training set, the following steps are included: Use neural network algorithm to screen the training set: Its solution: Among them, ·ψ(.) is the penalty term, φ(.) is the loss function, λ>0 is a regularization parameter that can balance the penalty term and the loss function, the penalty term uses the L2 norm, ψ(w)=||w|| 2 , the loss function is the hinge loss function, In order to find the optimal classification decision boundary, solve the original problem expressed by equation (4.1) and obtain the optimal solution W*. In order to find the optimal classification decision boundary, solve the dual problem of the original problem as follows: s.t 0≤α i ≤λ,1≤i≤n (4.2) in, is the kernel function defined by the feature map Φ; construct an original space The space contains w * , and then calculate the lower interval of the interval and upper interval The optimal solution w * The spherical region of is defined as follows: For any in, It is a feasible solution and Duality gap defined; For a spherical region given in (4.3), the upper and lower intervals of the region are defined as follows: From the above, we can get the optimal solution α * ; The steps are to map the extracted high-dimensional features onto the unit sphere through contrastive learning method to perform data classification, including the following steps: The CNN model is trained using the predefined infoNCE-Binary Crossentropy joint function; Map the extracted high-dimensional features onto the unit sphere to obtain the feature vector mapped onto the unit sphere; The cosine similarity method is used to calculate the similarity between two feature vectors; Optimize the classification of feature vectors, including: According to the positive sample relationship of all feature vectors, feature vectors with positive sample relationship are classified into the same category, and the number of categories for category division is determined according to the negative sample relationship of all feature vectors, and the category division of all feature vectors is completed; given the network traffic sample X and label Y, the average distance between samples from the same category is used to represent the intra-class distance: The average distance between samples of different categories is used to represent the inter-class distance:

2. The network intrusion detection method based on contrastive learning according to claim 1 is characterized in that: The step of obtaining and normalizing network traffic data packets, arranging the normalized network traffic data packets in chronological order and then performing preprocessing comprises the following steps: The network traffic data packets are normalized according to the five-tuple format, where the five-tuple format is: five-tuple [source IP, destination IP, port number, protocol type, timestamp]; Set the IP address, port number and MAC address in the network traffic data packet to zero; Sort network traffic packets in chronological order; Quantile normalization is used to reduce the range of each byte in the network traffic data packet to [0,1].

3. The network intrusion detection method based on contrastive learning according to claim 2 is characterized in that: The step of converting the preprocessed network traffic data packets into a two-dimensional image includes the following steps: Dividing the network traffic data packets into consecutive data blocks according to the timestamps, wherein each data block includes all the network traffic data packets within a selected time window; Select key features from each data block and organize the key features into a two-dimensional array; Convert a 2D array to a 2D image, where each array element is a pixel of the 2D image.

4. The network intrusion detection method based on contrastive learning according to claim 3 is characterized in that: Step 1: Select key features from each data block, including the following steps: Get the number, size and direction of packets in a data block; Generate frequent item sets based on the degree of association between each data packet; Select a frequent set from the item set, and select the items in the frequent set as key features.

5. The network intrusion detection method based on contrastive learning according to claim 1, characterized in that: The step uses a CNN model as a feature extractor, inputs the training set into the CNN model, extracts high-dimensional features of the two-dimensional image, and generates normal-abnormal sample pairs, and also includes the following steps: The activation function is used to operate the feature map data, and the operation results are input into the pooling layer for compression and downsampling; The output of the pooling layer is input into the fully connected layer for transformation, and the high-dimensional features of the two-dimensional image are output; Extract deep features of the training set based on high-dimensional features of two-dimensional images; The deep features are combined with label information to divide the training set and generate normal-abnormal sample pairs.

6. The network intrusion detection method based on contrastive learning according to claim 5 is characterized in that: Steps Before selecting the convolution kernel to perform convolution operation on the two-dimensional image in the training set, the following steps are also included: The safety sample screening rules are obtained through the upper and lower intervals, and the neural network algorithm is used to screen the training set to obtain the optimal training set.

7. A network intrusion detection system based on contrastive learning, used to implement the network intrusion detection method based on contrastive learning according to any one of claims 1 to 6, characterized in that: include: The network traffic data packet processing module is used to obtain and normalize the network traffic data packets, arrange the normalized network traffic data packets in chronological order and perform pre-processing, wherein the network traffic data includes normal traffic data and attack traffic data; The model training module is used to convert the pre-processed network traffic data packets into two-dimensional images and divide them into training sets and test sets; the CNN model is used as a feature extractor, the training set is input into the CNN model, the high-dimensional features of the two-dimensional image are extracted, and normal-abnormal sample pairs are generated; the extracted high-dimensional features are mapped to the unit sphere through the contrastive learning method to perform data classification; the classified data is input into the prediction model for analysis and prediction, and the results are output; The network intrusion detection module is used to input the test set into the trained CNN model and prediction model in sequence to perform network intrusion detection.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images