Deep learning method, device, storage medium and computer equipment for network intrusion detection identification

Abstract

The application discloses a kind of network intrusion detection identification deep learning method, device, storage medium and computer equipment, this method uses Concise-former neural network model based on the improvement of Transformer model, convolution gate self-attention layer is introduced in encoder module, to enhance the mining of local dependence in sequence data for encoder module, further strengthen the expression ability and generalization ability of network, improve the accuracy and stability of intrusion detection, by simplifying network, reduce the algorithm complexity of model, improve the calculation efficiency of model.In addition, the method of the application also uses joint learning to train neural network, so as to greatly improve the calculation speed of the model and reduce the memory consumption under the condition of ensuring accuracy, improve the practicability and flexibility of intrusion detection.Therefore, the present application can effectively detect various types of network intrusion.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and specifically to a deep learning method, apparatus, storage medium, and computer equipment for network intrusion detection and identification. Background Technology

[0002] Currently, most research in network intrusion detection within the cybersecurity field employs rule-based algorithms and statistical analysis methods, with limited research applying deep learning algorithms. Rule-based methods typically use predefined rules or features to identify abnormal traffic, relying heavily on rule matching. This approach effectively detects attacks under specific patterns and requires the direct evaluation of input traffic data using predefined rules and features. For example, it involves pre-setting a local rule base, including IP addresses, port numbers, prohibited words in data packets, and other request rules to restrict inbound traffic. Essentially, this is an experience-based method, requiring pre-defined normal and abnormal states; traffic not conforming to the normal state is identified as abnormal. Specifically, methods include: pre-defining attack types by defining attack characteristics through a series of rules; and string matching methods that use different signature-based strings to check incoming data packets one by one, triggering an alert if the signature matches. Rule-based methods can efficiently and quickly detect anomalies with a low false alarm rate, minimizing the impact on normal network service. However, they also have some problems. Although they are easy to implement and very effective at detecting known attacks, they are difficult to identify unknown attacks, attacks hidden by evasion techniques, and many variations of known attacks in today's large-scale networks, rapidly developing internet applications, and massive amounts of data. This leads to some security vulnerabilities in rule-based detection methods, and the lag in the rule base makes it difficult to identify new intrusion attacks. Summary of the Invention

[0003] The purpose of this invention is to overcome the shortcomings of the existing technology and provide a deep learning method for network intrusion detection and identification. This deep learning method for network intrusion detection and identification can better adapt to the complex and ever-changing Internet environment and has the advantages of high efficiency and flexibility.

[0004] The second objective of this invention is to provide a deep learning device for network intrusion detection and identification.

[0005] A third objective of this invention is to provide a storage medium.

[0006] A fourth objective of this invention is to provide a computing device.

[0007] The first objective of this invention is achieved through the following technical solution: This deep learning method for network intrusion detection and identification includes the following steps:

[0008] S1. Configure port mirroring on the ingress switch of the internal network that needs to be protected or monitored, and clone the traffic data passing through the internal network to the server running the data collection module to form a dataset.

[0009] S2. Construct a neural network model, which includes an encoder module consisting of an embedding layer, a specific convolutional gated attention layer, a linear layer, and a main softmax layer connected in sequence.

[0010] S3. Use joint learning to train the neural network model in order to optimize the neural network model;

[0011] S4. Deploy the optimized neural network model to perform intrusion detection on data in the protected or monitored environment, obtain the detection results, record the detection results as logs and save them to the central database, and at the same time notify or control the switches or hosts in the internal network to take a series of protective measures based on the detection results.

[0012] Preferably, the encoder module includes a convolutional gated attention layer, a first residual connection & first normalization layer, a feedforward network layer, and a second residual connection & second normalization layer connected in sequence; simultaneously, the embedding layer inputs the query value and value to the convolutional gated attention layer for convolutional operation processing, and the embedding layer is also connected to the first residual connection & first normalization layer; the first residual connection & first normalization layer sends the calculation results to the feedforward network layer and the second residual connection & second normalization layer respectively, and the second residual connection & second normalization layer is connected to the linear layer.

[0013] Preferably, the convolutional gate attention layer includes W Q Linear layer, one-dimensional convolutional layer, transposed layer, W Qk Linear layer, first multiplication module, addition module, convolutional SoftMax layer, W V Linear layer and second multiplication module;

[0014] Preferably, the W Q The linear layer inputs the query values ​​into a one-dimensional convolutional layer, a transpose layer, and a W layer. Qk Linear layers, one-dimensional convolutional layers, transposed layers, and W Qk The result of the linear layer operation Q C Q T and Q K Q C and Q T The input is fed into the first multiplication module for normalization operation to obtain the result. Then With Q K The input is fed into the addition module, which then feeds the result into the convolutional layer to obtain the score. The score is then summed with the result obtained through W. V The Value input to the linear layer is processed by the second multiplication module to obtain the model output.

[0015] Preferably, the optimization process in step S3 includes the following steps:

[0016] S31. In the initial training phase, first, based on the teacher model dimension d... t Student model dimension d s Parameters to initialize the teacher model t and student model s ;

[0017] S32. In each round of training, the teacher model and the student model are trained on the input sample Input, and the loss function of the teacher model is Loss. t The output O of the teacher model t The loss value with respect to the label is:

[0018] Loss t =Γ(O t ,Label);

[0019] S33, Loss function of the student model S It consists of two parts, namely the output O of the student model. s The loss value of the label and the output O of the student model. s With the output O of the teacher model t The KL divergence composition, in practical applications, involves adding a temperature control parameter t to adjust the proportion of this loss, i.e.:

[0020]

[0021]

[0022] S34. The Loss is calculated using the mixing parameter θ based on the two-part loss of the student model. t :

[0023]

[0024] S34. Based on the loss value, adjust the teacher model. t and student model s After adjusting the parameters, the final student model obtained through training is the neural network model optimized through joint learning.

[0025] Preferably, before step S31, the dataset is preprocessed to divide the dataset into a training set, a validation set, and a test set.

[0026] Preferably, in step S4, the intrusion detection results are restored to the categories of Normal, Probe, DoS, U2R, and R2L.

[0027] The second objective of this invention is achieved through the following technical solution: a deep learning device for network intrusion detection and identification, comprising:

[0028] The data collection module is used to collect traffic data from the network to form a dataset;

[0029] The data processing module is used to process the dataset to obtain training samples;

[0030] The model building module is used to train the neural network model with training samples to obtain a model for intrusion detection.

[0031] The intrusion detection module is used to perform model inference on data in the network environment to be protected or detected, and output the detection results to the result response model.

[0032] The results response module is used to record and save the test results for easy analysis and backtracking.

[0033] The third objective of this invention is achieved through the following technical solution: a storage medium storing a program, which, when executed by a processor, implements a deep learning method for network intrusion detection and identification, achieving the first objective.

[0034] The fourth objective of this invention is achieved through the following technical solution: a computer device, including a processor and a memory for storing processor-executable programs, wherein when the processor executes the program stored in the memory, it achieves the first objective of a deep learning method for network intrusion detection and identification.

[0035] The present invention has the following advantages over the prior art:

[0036] The deep learning method for network intrusion detection and identification of the present invention adopts the Concise-former neural network model, which is improved from the Transformer neural network. Moreover, this Concise-former neural network model is optimized through joint training to obtain a model that can perform intrusion detection. Therefore, this model can be adapted to different network scenarios, can flexibly adjust itself, has strong portability, does not require guidance from historical experience for specific scenarios, and can more flexibly and effectively identify anomalies in network traffic to detect network intrusion behavior.

[0037] The neural network model in the deep learning method for network intrusion detection and identification of the present invention is optimized through joint training, which can significantly improve the detection speed while ensuring detection accuracy, making it easier to adapt to the complex and ever-changing Internet environment. Attached Figure Description

[0038] Figure 1 This is a neural network model structure diagram of the deep learning method for network intrusion detection and identification of the present invention.

[0039] Figure 2 This is a structural diagram of the convolutional gating self-attention layer of the present invention.

[0040] Figure 3 This is a schematic diagram of the joint learning training process of the present invention. Detailed Implementation

[0041] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0042] Example 1

[0043] like Figure 1 As shown, the deep learning method for network intrusion detection and identification includes the following steps:

[0044] S1. Configure port mirroring on the ingress switch of the internal network that needs to be protected or monitored. Clone the traffic data passing through the internal network to the server running the data collection module to form a dataset. Specifically, if protection is needed for a specific host, configure the data collection module on the protected host. On the server running the data collection module, use TCPdump software in conjunction with a Python program using the pcapng and scapy libraries to capture network traffic packets and save the data to a central database. The dataset used in this invention is the KDD CUP99 dataset. The complete dataset contains approximately 5,000,000 samples, including 41 feature dimensions, such as basic TCP connection features, time-based network traffic statistics, and host-based features. The dataset label types are 1, 2, 3, 4, and 5; 1 stands for Normal, 2 for Probe, 3 for DoS, 4 for U2R, and 5 for R2L. The labels are then vectorized.

[0045] S2. Construct a neural network model, which includes an encoder module consisting of an embedding layer, a specific convolutional gated attention layer, a linear layer, and a main softmax layer connected in sequence.

[0046] The encoder module includes a convolutional gated attention layer, a first residual connection & first normalization layer, a feedforward network layer, and a second residual connection & second normalization layer connected in sequence. Simultaneously, the embedding layer inputs the query and value values ​​to the convolutional gated attention layer for convolutional processing, and the embedding layer is also connected to the first residual connection & first normalization layer. The first residual connection & first normalization layer sends the calculation results to the feedforward network layer and the second residual connection & second normalization layer, respectively. The second residual connection & second normalization layer is connected to the Linear Layer.

[0047] The convolutional gate attention layer includes W Q Linear layer, one-dimensional convolutional layer, transposed layer, W Qk Linear layer, first multiplication module, addition module, convolutional SoftMax layer, W V Linear layer and second multiplication module; the W Q The linear layer inputs the query values ​​into a one-dimensional convolutional layer, a transpose layer, and a W layer. Qk Linear layers, one-dimensional convolutional layers, transposed layers, and W Qk The result of the linear layer operation Q C Q T and Q K Q C and Q T The input is fed into the first multiplication module for normalization operation to obtain the result. Then With Q K The input is fed into the addition module, which then feeds the result into the convolutional layer to obtain the score. The score is then summed with the result obtained through W. V The Value input to the linear layer is processed by the second multiplication module to obtain the label prediction result.

[0048] Specifically, the neural network model of this invention is a Concise-former neural network model, which is an improvement on the Transformer neural network. The model structure of the Concise-former neural network model is similar to that of the original Transformer neural network model, but adjustments are made in the encoder module. Specifically, in the encoder module, the input data, after being processed by the embedding layer, is fed into the encoder module for computation. The encoder module involves efficient convolutional self-attention layers and feedforward network layers. After each convolutional self-attention layer and feedforward network layer is computed, it undergoes residual connections and regularization, which helps alleviate the gradient vanishing problem during model training, making it easier for the model to learn the mapping relationship between input and output and improving its ability to handle long-range dependencies and large-scale data training tasks. After computation by the encoder module of this invention, the data is transformed to the size of the output label, and the output result is normalized to label probabilities using the Softmax function. Furthermore, the decoder module in the traditional Transformer model is replaced with ordinary linear layers and nonlinear functions. The computation process of the Concise-former neural network model of this invention is as follows:

[0049] In the S21 Concise-former neural network model, there are two key values: Query and Value. These are the main computational values ​​of the convolutional gate attention layer.

[0050] Q i =XW Q V i =XW V

[0051] Among them, Q i and V i These are the Query and Value values, respectively. Q and W V These are the respective weight matrices obtained through learning. Within the attention mechanism, the query first passes through the W layer of the convolutional attention layer. Q A linear layer that performs a convolution operation on the query to obtain Q. c i :

[0052] Q c i =∑Conv1d(Q i );

[0053] S22. Multiply the results obtained above and divide by d. tensor Square the result, then normalize it to obtain the following: Right now:

[0054]

[0055] W Qk The linear layer is an m×1 linear layer module, where m is the input size of the Query, which is used to adjust the size of the Query to obtain Q. K :

[0056] Q K =∑Linear m×1 (Q i )

[0057] S23, Results and Q K By combining these parameters, where θ is the weight parameter and θ∈(0,1), the attention score is calculated.

[0058]

[0059] S24. Finally, the attention score is compared with the score obtained through W. V The values ​​input to the linear layer are multiplied to obtain the output of the convolutional gate attention layer. In other words, the Concise-former neural network model transforms the module output into a label prediction result through linear layers and nonlinear functions.

[0060] P = S × V.

[0061] S3. Use joint learning to train the neural network model in order to optimize the neural network model;

[0062] The optimization process in step S3 includes the following steps:

[0063] First, the dataset is preprocessed to divide it into training, validation, and test sets, thus obtaining training samples. Specifically, the preprocessing process involves: classifying all sample labels into five categories and encoding them; handling missing values ​​by deleting samples with missing values; encoding discrete features and normalizing continuous features; and finally, using PyTorch to vectorize the data. Each sample is then converted into a vector of size (batch_size, seq_length, input_size). In this invention, batch_size is 128, seq_length is 1, and input_size is 41, so the size of a batch of data vectors is (128, 1, 41).

[0064] S31. In the initial training phase, first, based on the teacher model dimension d... tStudent model dimension d S Parameters to initialize the teacher model t and student model S Set the initial parameters: training batch size to 128, training iterations to 10, learning rate distributed between 0.0001 and 0.00001 in the training iterations, training epochs to 50, Adam optimizer used, cross-entropy loss function used, and teacher and student models configured with the same network structure but different parameter counts.

[0065] S32. In each round of training, the teacher model and the student model are trained on the input sample Input, and the loss function of the teacher model is Loss. t The output O of the teacher model t The loss value with respect to the label is:

[0066] Loss t =Γ(O t ,Label);

[0067] S33, Loss function of the student model s It consists of two parts, namely the output O of the student model. s The loss value of the label and the output O of the student model. s With the output Q of the teacher model t The KL divergence composition, in practical applications, involves adding a temperature control parameter t to adjust the proportion of this loss, i.e.:

[0068]

[0069]

[0070] S34. The Loss is calculated using the mixing parameter θ based on the two-part loss of the student model. t :

[0071]

[0072] S35. Based on the loss value, adjust the teacher model. t and student model s After adjusting the parameters, the final student model obtained through training is the neural network model optimized through joint learning.

[0073] The teacher and student models have the same structure. In the model, the input samples are first converted into word vectors through the Embedding layer, and then processed by W... Q Convert the matrix into a query vector, where WQ The input is a linear layer of size (input_size, d_model), which is then transformed into a Q-mode by a one-dimensional convolutional layer. C And converted to Q after transpose layer T So that Q C and Q T Multiplication calculation yields At the same time, the query vector passes through W. Qk Matrix to Q K ,Will With Q K The attention score is obtained by performing a hybrid calculation, i.e.:

[0074]

[0075] Where θ is the weight parameter, and in this embodiment, the value of θ is taken as 0.7. The calculated Score is represented as an S vector after passing through the Softmax layer.

[0076] The input vector is passed through W V Convert the matrix into a value vector, where W V For a linear layer of size (input_size, d_model), the output of the convolutional gated attention layer is calculated by multiplying the Value with the S vector. Then, the output is passed through the Dropout layer, residual connection layer, normalization layer, and Softmax layer to calculate the predicted label. The loss of the teacher model and the loss of the student model are calculated based on the predicted label and the true label.

[0077] This invention employs the aforementioned joint learning training to train a neural network model, enabling a lightweight model to simultaneously learn the patterns in the dataset and the parameter patterns of a heavyweight model. Through the joint learning proposed in this invention, the inference time and memory consumption of the model can be significantly reduced while maintaining a certain level of accuracy. Specifically, the teacher model is larger in scale, used to fully explore the potential patterns in the dataset during training, while the student model is smaller in scale, allowing it to learn the parameter distribution of the teacher model and the patterns in the dataset respectively. Ultimately, this achieves inference tasks with faster speed and lower memory consumption. The pseudocode for the joint learning training algorithm is shown below:

[0078]

[0079]

[0080] S4. Deploy the optimized neural network model to perform intrusion detection on data in the protected or monitored environment, obtain the detection results, and log the detection results to the central database. Simultaneously, based on the detection results, notify or control switches or hosts in the internal network to take a series of protective measures. The intrusion detection results obtained in step S4 are reclassified into Normal, Probe, DoS, U2R, and R2L categories.

[0081] In summary, the method of this invention enhances the encoder module by introducing a convolutional gate attention layer, thereby improving the attention module's ability to uncover local dependencies in sequence data. This further strengthens the network's expressive and generalization capabilities, improving the accuracy and stability of intrusion detection. By simplifying the network, the algorithmic complexity of the model is reduced, and the computational efficiency is improved. Furthermore, a joint learning neural network training method is proposed, which can significantly improve the model's inference speed and reduce memory consumption while maintaining accuracy, thus enhancing the practicality and flexibility of intrusion detection. The method and system of this invention can effectively detect various types of network intrusions, including probing attacks, DoS attacks, unauthorized user access, and remote-to-local attacks, providing a flexible and efficient intrusion detection algorithm.

[0082] Example 2:

[0083] This embodiment discloses a deep learning device for network intrusion detection and identification, comprising:

[0084] The data collection module is used to collect traffic data from the internal network to form a dataset;

[0085] The data processing module is used to process the dataset to obtain training samples;

[0086] The model building module is used to train the neural network model with training samples to obtain a model for intrusion detection.

[0087] The intrusion detection module is used to perform model inference on data in the network environment to be protected or detected, and output the detection results to the result response model.

[0088] The results response module is used to record and save the test results for easy analysis and backtracking.

[0089] Example 3

[0090] This embodiment discloses a storage medium storing a program. When this program is executed by a processor, it implements the deep learning method for network intrusion detection and identification of Embodiment 1.

[0091] Example 4

[0092] This embodiment discloses a computer device, including a processor and a memory for storing processor-executable programs. When the processor executes the program stored in the memory, it implements the deep learning method for network intrusion detection and identification of Embodiment 1.

[0093] The above-described specific embodiments are preferred embodiments of the present invention and are not intended to limit the present invention. Any other changes or equivalent substitutions made without departing from the technical solution of the present invention are included within the protection scope of the present invention.

Claims

1. A deep learning method for network intrusion detection and identification, characterized in that, Includes the following steps: S1. Configure port mirroring on the ingress switch of the internal network that needs to be protected or monitored, and clone the traffic data passing through the internal network to the server running the data collection module to form a dataset. S2. Construct a neural network model, which includes an embedding layer, an encoder module with a convolutional gated attention layer, a linear layer, and a main softmax layer connected in sequence. S3. Use joint learning to train the neural network model in order to optimize the neural network model; S4. Deploy the optimized neural network model to perform intrusion detection on data in the protected or monitored environment, obtain the detection results, record the detection results as logs and save them to the central database, and at the same time notify or control the switches or hosts in the internal network to take a series of protective measures based on the detection results. The encoder module includes a convolutional gated attention layer, a first residual connection & first normalization layer, a feedforward network layer, and a second residual connection & second normalization layer connected in sequence. Simultaneously, the embedding layer inputs the query and value values ​​into the convolutional gated attention layer for convolutional operations, and the embedding layer is also connected to the first residual connection & first normalization layer. The first residual connection & first normalization layer sends the calculation results to the feedforward network layer and the second residual connection & second normalization layer, respectively. The second residual connection & second normalization layer is connected to the Linear Layer. The convolutional gated attention layer includes Linear layer, one-dimensional convolutional layer, transposed layer Linear layer, first multiplication module, addition module, convolutional SoftMax layer, Linear layer and second multiplication module; The The linear layer inputs the query values ​​into a one-dimensional convolutional layer, a transpose layer, and... Linear layers, one-dimensional convolutional layers, transposed layers, and The result of the linear layer operation , and ,in and The input is fed into the first multiplication module for normalization operation to obtain the result. And then and The input is fed into the addition module, which then feeds the result into the convolutional layer to obtain the score. ,Fraction and through The Value input to the linear layer is processed by the second multiplication module to obtain the label prediction result.

2. The deep learning method for network intrusion detection and identification according to claim 1, characterized in that, The optimization process in step S3 includes the following steps: S31. In the initial training phase, the teacher model dimension is first considered. Student model dimensions Parameters to initialize the teacher model and student model ; S32. In each round of training, the teacher model and the student model respectively train the input samples. The loss function of the teacher model during training and learning. Output from the teacher model With tags The loss value is calculated as follows: ； S33, Loss Function of Student Model It consists of two parts, namely the output of the student model. With tags The loss value and the output of the student model. Output of the teacher model The KL divergence composition, in practical applications, will incorporate temperature control parameters. To adjust the output of the student model Output of the teacher model The proportion of loss in the KL divergence, i.e.: , ； S34. Based on the two-part loss of the student model, through the mixing parameters Calculated : ； S35. Based on the loss value, adjust the teacher model. and student model After adjusting the parameters, the final student model obtained through training is the neural network model optimized through joint learning.

3. The deep learning method for network intrusion detection and identification according to claim 2, characterized in that, Before step S31, the dataset is preprocessed to divide it into training set, validation set and test set.

4. The deep learning method for network intrusion detection and identification according to claim 1, characterized in that, In step S4, the intrusion detection results are restored to the categories of Normal, Probe, DoS, U2R, and R2L.

5. A deep learning device for network intrusion detection and identification, characterized in that, The deep learning method for implementing network intrusion detection and identification as described in any one of claims 1-4 includes: The data collection module is used to collect traffic data from the internal network to form a dataset; The data processing module is used to process the dataset to obtain training samples; The model building module is used to train the neural network model with training samples to obtain a model for intrusion detection. The intrusion detection module is used to perform model inference on data in the network environment to be protected or detected, and output the detection results to the result response model. The results response module is used to record and save the test results for easy analysis and backtracking.

6. A storage medium, characterized in that, The system stores a program that, when executed by a processor, implements the deep learning method for network intrusion detection and identification as described in any one of claims 1 to 4.

7. A computer device, characterized in that, It includes a processor and a memory for storing processor-executable programs. When the processor executes the program stored in the memory, it implements the deep learning method for network intrusion detection and identification as described in any one of claims 1 to 4.

Images