An internet of things intrusion detection method

Abstract

This invention discloses an IoT intrusion detection method, belonging to the field of network security intrusion detection. The method includes: Step 1, feeding the intrusion detection dataset into a GWR-GCN feature extractor to extract domain-invariant features of the source and target domains; Step 2, defining the Copula distance, considering the impact of a single feature on data distribution and the impact of correlations between different features on data distribution, further reducing the distance between the feature distributions of the source and target domains; Step 3, constructing a conditional domain-based adversarial intrusion detection model for attack detection. By adding class information conditions to the discriminator, the impact of domain offset on cross-domain detection performance is reduced, improving the accuracy of feature distribution alignment and strengthening the model's cross-domain detection capability in IoT intrusion detection. This invention can better extract domain-invariant features and align data distributions, while also exhibiting better cross-domain intrusion detection performance.

Description

Technical Field

[0001] This invention relates to the field of network attack detection in Internet of Things (IoT) intrusion detection, and in particular to an IoT intrusion detection method. Background Technology

[0002] The Internet of Things (IoT) has become an indispensable part of various real-world applications and has been innovatively applied in fields such as healthcare, intelligent transportation, and smart homes. The diverse range of network devices makes IoT traffic more varied, but it also leads to a significant increase in cyberattacks against the IoT. Traditional intrusion detection systems (IDS) typically require a relatively complete repository of intrusion patterns or a large amount of labeled training data. However, due to data privacy concerns and the frequent emergence of new IoT devices, traditional intrusion detection methods are difficult to apply to the data-scarce IoT field.

[0003] Intrusion detection systems typically require a comprehensive repository of intrusion patterns or a large amount of labeled training data. The scarcity of IoT data makes traditional intrusion detection methods ineffective at detecting IoT network attacks. Domain-adaptive methods can improve cross-domain performance by training feature extractors to extract domain-invariant features from the data and projecting source and target domain features into a domain-invariant feature space. However, feature extractors in domain-adaptive methods are often single-layer neural networks, which prevents them from mining deeper feature information and neglects the impact of correlations between sample data on feature extraction. This results in inaccurate extracted domain-invariant features, failing to adequately support cross-domain detection in intrusion detection models. When reducing the overall feature distribution differences between the source and target domains, most domain-adaptive methods only consider the marginal distribution differences of individual features, neglecting the joint distribution differences between features and being insensitive to changes in the overall distribution caused by changes in related features. Furthermore, the lack of explicit consideration of class information in the source and target domains during feature distribution alignment can lead to suboptimal feature alignment when the class distributions of the source and target domains are significantly different. Therefore, adversarial domain-adaptive methods may fail to effectively align the feature distributions of the source and target domains. These issues reduce the detection efficiency and accuracy of intrusion detection systems in the Internet of Things (IoT) field and increase resource consumption. Summary of the Invention

[0004] The technical problem this invention aims to solve is to provide an IoT intrusion detection method that can better extract domain-invariant features and align data distributions, while also exhibiting better cross-domain intrusion detection performance. This results in superior performance across evaluation metrics such as accuracy and recall.

[0005] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows:

[0006] An IoT intrusion detection method includes the following steps:

[0007] Step 1: Input the intrusion detection dataset into the GWR-GCN feature extractor to extract domain-invariant features of the source and target domains;

[0008] Step 2: Use the Copula distribution alignment method to perform distribution alignment on the domain-invariant features of the source and target domains obtained in Step 1;

[0009] Step 3: Construct a conditional domain-based adversarial intrusion detection model for attack detection.

[0010] A further improvement of the technical solution of the present invention is that: in step 1, the extraction of domain-invariant features of the source domain and the target domain by using the GWR-GCN feature extractor is achieved by combining the GWR network with the graph convolutional neural network GCN. The GWR network is used to calculate the correlation between the original data and connect the related data into a graph. The graph convolutional neural network GCN is used to mine the feature information of the graph structure data and extract the optimal domain-invariant features.

[0011] A further improvement to the technical solution of this invention is that it specifically includes:

[0012] 1.1 The algorithm flow for converting intrusion detection data into graph-structured data using the Growing Flow Network (GWR) is as follows:

[0013] Assume Data is an intrusion detection dataset, where each data sample represents a node, A is the set of selected sample nodes, and v i Let w represent the i-th node. i It is the weight vector of the i-th node; It is the set of edges, age(v s ,v t ) represents an edge (v s ,v t The weight of age max h is the weight threshold. i For node v i The access strength is determined, where h0 is the initial access strength. The steps are as follows:

[0014] 1.1.1, Randomly select two node samples v1 and v2 from the intrusion detection dataset Data to form set A;

[0015] 1.1.2, Initialize edge set C as an empty set;

[0016] 1.1.3, Randomly select an unselected sample ξ from the intrusion detection dataset Data as the new input sample node v. ξ ;

[0017] 1.1.4, for each node v i Calculate its path to the new input node v ξ Distance ||w ξ -w i ||;

[0018] 1.1.5 Selecting the best sample node and the second-best sample node

[0019] 1.1.6, if edge (v s ,v t If it does not exist, create it, C = C∪{(v s ,v t And set its weight age(v) s ,v t ) is 0;

[0020] 1.1.7, Computation node v ξ With the best matching node v s The similarity a = exp(-||w ξ -w s ||);

[0021] 1.1.8, If a is less than the similarity threshold a T And the access strength is less than the access strength threshold h T Then in v s and v t Add a new node v between r Create a weight vector: w r =0.5(w s +w ξ Create edges (v) r ,v s ) and (v r ,v t ) and delete the old edge (v s ,v t );

[0022] 1.1.9 Otherwise, do not add new sample nodes, and adjust the optimal sample node v. s and its neighboring node v i Location: 0<ε n <ε b <1,h s For node v s Access strength, ε b ε n Update parameters for location;

[0023] Version 1.1.10 adds a connection to v. sWeights of all connected edges: age(v s ,v i ) = age(v s ,v i )+1;

[0024] Version 1.1.11 updates the best matching node v. s and its neighboring node v i Access intensity:

[0025]

[0026]

[0027] Where S is the access intensity constant, α b α n τ b τ n To access the equation parameters, h i (τ) represents the access strength of the i-th node when it is accessed by the algorithm for the τth time;

[0028] 1.1.12, Remove all items whose total weight exceeds the weight threshold age. max Remove all isolated sample nodes from the edges;

[0029] 1.1.13 If there are unselected samples in the dataset, return to step 1.1.3 to continue selecting;

[0030] 1.1.14 Construct the graph structure data G corresponding to the intrusion detection dataset Data based on the node set A and the edge set C;

[0031] 1.2 The input graph structure data is processed using a Graph Convolutional Neural Network (GCN) to mine the feature information between related nodes, specifically including the following:

[0032] Graph Convolutional Neural Networks (GCNs) are neural networks that directly operate on graphs; an undirected graph is represented by Graph = (V, E), where V is the set of nodes, E represents the set of edges, and X ∈ R. n×M It is a feature matrix consisting of n nodes and their corresponding features, where n is the number of nodes and M is the dimension of the feature vectors; given an adjacency matrix A∈R n×n Each layer of a graph convolutional neural network (GCN) can be written as a non-linear function:

[0033]

[0034] Among them, H (0) For the input feature matrix, H (0) =X,H (1) W is the feature matrix of the first layer; (0)∈R M×F and b (0) These are the weight matrix and the bias matrix, respectively; F is the dimension of the output feature of each node; δ(·) is a non-linear activation function. It is a normalized symmetric adjacency matrix, calculated as follows:

[0035]

[0036]

[0037] in, Let I be the degree matrix of the undirected graph Graph, and let I be the identity matrix. If multiple convolutional layers are stacked together, information from more distant connected nodes is aggregated.

[0038]

[0039] Among them, H (l) Let W represent the feature matrix of the l-th layer. (l) and b (l) These are the weight matrix and bias matrix of the l-th layer graph convolutional neural network (GCN), respectively. After the graph structure data for intrusion detection is established, the graph structure data is input into the multi-layer graph convolutional neural network (GCN). By mining the information of each node and the information related to each node, the domain-invariant features that can be learned across domains are finally extracted.

[0040] Finally, the feature data H extracted by the multi-layer graph convolutional neural network GCN is... (l) The input is fed into a softmax classifier to perform classification prediction for each sample node. Z is the prediction result for the sample, where ReLU is selected as the activation function, and the cross-entropy loss function for each node is calculated:

[0041]

[0042] Graph Convolutional Neural Networks (GCNs) aggregate information from connected nodes by stacking convolutional layers. This approach takes into account the correlation between nodes themselves and other nodes, which helps to extract features that are more representative of global information, thereby constructing domain-invariant features in domain adaptation.

[0043] A further improvement of the technical solution of the present invention is that: in step 2, by defining the Copula distance, the overall feature distribution difference between the source domain and the target domain is divided into single feature marginal distribution difference and joint distribution difference between features, thereby reducing the marginal distribution difference and joint distribution difference of features between the source domain and the target domain and achieving data distribution alignment;

[0044] The data distribution alignment method based on copula distance specifically includes:

[0045] Sklar's theorem states that any multivariate distribution can be decomposed into the product of a marginal distribution and a copula function, and vice versa; therefore, the copula function and the marginal distribution can recover the original multivariate distribution; as shown in formula (8), the continuous density function p(x1,…,x) d It can be written as a marginal distribution p i (·) and Copula density function c(u1,…,u d The product of )

[0046]

[0047] Among them, u i =p i (x i ), 1≤i≤d;

[0048] The overall difference in data distribution is divided into two parts: the marginal difference of a single feature and the correlation difference between different features. The correlation difference between different features is measured by Copula distance. Copula is a function used to describe the relationship between multiple random variables. Copula can separate the marginal distribution of multiple random variables from the dependency structure between random variables. By using Copula, the relationship between multiple features can be better described and modeled without being affected by the marginal distribution of each feature.

[0049] Given multiple random variables X, their marginal distributions u, and the Copula density function c(u), then the Copula entropy (H) c ) is defined as:

[0050] H c (X)= -∫ u c(u)logc(u)du (9)

[0051] The `copula` function can be used to process any component [X] in a random vector X. i ,X j The degree of correlation between features X and X should be clearly quantified; i and X j The correlation between them is expressed by formula (10):

[0052]

[0053] Among them, P ij For [X] i ,X j The joint distribution of P i P j Indicates marginal distribution, c ij (u i ,u j) is the density function; thus, for feature X i and X j The measure of the interdependence between them is equivalent to calculating the mutual information of X i and X j ;

[0054] Let two random vectors be X and Y, where X = [x1,..., x d ∈ R d , Y = [y1,..., y d ∈ R d ; Let and be the cumulative joint distributions of any component pairs [X i , X j and [Y i , Y j respectively; Let H c (·, ·) be the measure of the distribution difference; Define the copula distance between [X i , X j and [Y i , Y j (1 ≤ i < j ≤ d) as:

[0055]

[0056] The copula distance between random vectors X and Y is:

[0057]

[0058] The copula - based data distribution alignment method pays more attention to the differences in the relationships or dependencies between different features, enhancing the sensitivity to marginal differences and correlation differences; In the source domain, decompose the data distribution of the source - domain feature F s into m feature marginal distributions and the copula distance between features, and perform the same processing on the target domain; Evaluate the overall data distribution difference between the source domain and the target domain by dividing it into marginal differences and copula distance. By splitting the overall difference of the joint feature distribution, it is possible to determine the contribution degrees of marginal feature differences and copula distance to data distribution alignment respectively;

[0059] Take the marginal difference and copula distance as the overall data distribution difference between the source domain and the target domain, obtain the objective function Distence for data distribution alignment, and achieve data distribution alignment between the source domain and the target domain by minimizing the objective function:

[0060]

[0061] The copula distance between the source feature and the target feature is denoted as D. C (F s ,F t The sum of the edge differences of a single feature is expressed as: F s and F t For source domain features and target domain features, Let i and represent the i-th feature of the source domain and the i-th feature of the target domain, respectively.

[0062] A further improvement of the technical solution of the present invention is as follows: In step 3, the discriminator and the feature extractor are trained adversarially using a conditional domain adversarial neural network. Class information conditions are added to the discriminator to reduce the impact of domain offset on cross-domain detection performance, improve the accuracy of feature distribution alignment, and enhance the cross-domain detection capability of the conditional domain adversarial intrusion detection model in IoT intrusion detection. The trained conditional domain adversarial intrusion detection model is used to detect network attacks and predict the correct network attack category.

[0063] A further improvement to the technical solution of this invention lies in the following: In step 3, the specific process of constructing the conditional domain-based adversarial intrusion detection model is as follows:

[0064] Ganin introduced the idea of ​​generative adversarial networks into domain adaptation, thus proposing Domain Adversarial Neural Network (DANN). The DANN structure consists of three parts: a feature extractor, a source domain classifier, and a discriminator.

[0065] The feature extractor feeds the extracted domain-invariant features into the discriminator, which then determines whether the input feature information comes from the source domain or the target domain and calculates the loss. The discriminator's goal is to classify the input feature information into the correct domain, while the feature extractor's goal is to prevent the extracted features from being correctly judged by the discriminator, thus forming an adversarial relationship. At the same time, the features extracted by the feature extractor are also fed into the source domain classifier. Since the source domain samples are labeled, supervised training is performed using the labeled sample data from the source domain to ensure the accuracy of classification.

[0066] Domain Adversarial Neural Network (DANN) training consists of two stages. In the first stage, a discriminator D is trained to distinguish feature data between the source and target domains. In the second stage, a feature extractor is trained to confuse the discriminator D. Simultaneously, the loss function of the discriminator D is used to measure the difference between the data distributions of the source and target domains. In unsupervised domain adaptation, the DANN can be formulated as a minimax optimization problem, minimizing the classification error ε(G) on the source domain classifier G and maximizing the domain discrimination error ε(D) between the source and target domains on the discriminator D.

[0067]

[0068]

[0069]

[0070] Where L(·,·) is the cross-entropy loss, Let G(x) represent the source domain samples with n labeled instances and the target domain samples with n unlabeled instances, where G(x) represents the classification prediction generated by the source domain classifier G, and λ is the balance factor.

[0071] The conditional domain adversarial intrusion detection model is a domain-adaptive model based on conditional adversarial domain networks, which integrates the source domain category label Y. s The predicted label G(F) of the target domain on the source domain classifier G. t The feature distribution is aligned by adding it to the discriminator D as a category condition. The Conditional Domain Adversarial Network (CDAN) trains the discriminator and feature extractor by minimizing the classification error ε(G) on the source domain classifier G and maximizing the domain discrimination errors ε(D,G) of the source domain and target domain on the source domain classifier G and discriminator D, as shown in Equation (17).

[0072]

[0073] Where L(·,·) is the cross-entropy loss, F s and F t These represent the domain-invariant features of the source and target domains, respectively. Represents target domain samples Predicted labels on the source domain classifier G;

[0074] Based on the conditional domain adversarial intrusion detection model, firstly, the feature extractor F extracts features from the source and target domains to obtain domain-invariant features. Then, category information is added to the discriminator D, and the discriminator is trained to distinguish between source and target domain features. Simultaneously, F is calculated. s and F t The Copula distance between data distributions and the loss of the source domain classifier G are used to train the feature extractor F by minimizing the loss of the source domain classifier G and the Copula distance and maximizing the loss of the discriminator D. This results in the conditional domain adversarial intrusion detection model having good cross-domain performance. The final overall loss function of the conditional domain adversarial intrusion detection model is shown in Equation (18).

[0075]

[0076] The technological advancements achieved by this invention due to the adoption of the above technical solutions are as follows:

[0077] 1. This invention applies the GCN-GWR feature extraction method to extract domain-invariant features. By converting data samples into graph nodes, connecting related samples together to construct a graph structure data, and mining the correlation information between samples through graph convolution, domain-invariant feature extraction is achieved. Considering the influence of the correlation between samples on the extraction of domain-invariant features, the accuracy of extracting domain-invariant features is improved.

[0078] 2. This invention is based on the Copula distribution alignment method, inspired by Sklar's theorem. It divides the overall difference in data distribution into two parts: the marginal difference of a single feature and the correlation difference between different features. The correlation difference between different features is measured by the Copula distance. By minimizing the marginal distribution difference and the joint distribution difference, the distribution distance between the source domain and the target domain is effectively reduced, thereby achieving the distribution alignment between the source domain and the target domain.

[0079] 3. This invention employs a conditional domain adversarial neural network (CDMA) intrusion detection model. The model utilizes a feature extractor to extract domain-invariant features, minimizing distribution differences, and a discriminator to distinguish between source and target domain features, maximizing distribution differences. This allows the feature extractor and discriminator to engage in adversarial learning. Simultaneously, category information is input into the discriminator to ensure that source and target domain features are aligned across categories, ultimately giving the model excellent cross-domain performance. Attached Figure Description

[0080] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0081] Figure 1 This is an overall flowchart of an IoT intrusion detection method provided in an embodiment of the present invention;

[0082] Figure 2 This is an ablation experiment diagram of the source domain being NSL-KDD and the target domain being UNSW-BOTIOT in an embodiment of the present invention;

[0083] Figure 3 This is an ablation experiment diagram of the source domain UNSW-NB15 and the target domain UNSW-TONIOT in an embodiment of the present invention. Detailed Implementation

[0084] It should be noted that the terms "comprising" and "having" and any variations thereof in the specification, claims and accompanying drawings of this invention are intended to cover non-exclusive inclusion. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such processes, methods, products or devices.

[0085] The present invention will be further described in detail below with reference to the accompanying drawings and embodiments:

[0086] This invention provides an IoT intrusion detection method, mainly consisting of four parts: domain-invariant feature extraction, data distribution alignment, conditional domain adversarial intrusion detection, and algorithm evaluation. Specifically, the intrusion detection dataset is fed into a GWR-GCN feature extractor to extract domain-invariant features. The method utilizes the Copula data distribution alignment method and a conditional domain adversarial neural network as the intrusion detection model for attack detection. The overall process is as follows: Figure 1 As shown, the specific steps include:

[0087] Step 1: Input the intrusion detection dataset into the GWR-GCN feature extractor to extract domain-invariant features of the source and target domains;

[0088] Training the GWR-GCN feature extractor for feature extraction:

[0089] The GWR-GCN feature extractor is used to extract domain-invariant features from the source and target domains. By combining the Growing-on-Demand Network (GWR) with the Graph Convolutional Neural Network (GCN), the GWR is used to calculate the correlation between the original data and connect the related data into a graph. The GCN is used to mine the feature information of the graph structure data and extract the optimal domain-invariant features.

[0090] Specifically, the methods for extracting domain-invariant features based on the GWR-GCN algorithm include the following:

[0091] 1.1 Incremental Clustering Algorithm Based on GWR

[0092] Self-Organizing Feature Map (SOM) is a neural network clustering method that mimics the self-organizing feature mapping function of the brain's neural system. Through the self-organizing process of the network structure, it automatically clusters input data patterns. GWR, proposed by Marsland et al., is a self-organizing neural network. It learns using Hebb rules, mapping high-dimensional input data to a limited number of neurons while preserving the original data's structural information. This ensures that when GWR converts intrusion detection traffic data into graph-structured data, the original traffic information is not lost. Simultaneously, GWR automatically controls the number of neurons to better fit the distribution of the input data, ensuring that the original data distribution of the source and target domains remains unchanged.

[0093] The algorithm flow for converting intrusion detection data into graph-structured data using GWR is as follows:

[0094] Assume Data is an intrusion detection dataset, where each data sample represents a node, A is the set of selected sample nodes, and v i Let w represent the i-th node. i It is the weight vector of the i-th node. It is the set of edges, age(v s ,v t ) represents an edge (v s ,v t The weight of age max h is the weight threshold. i For node v i The access strength is determined, with h0 being the initial access strength. The main steps are as follows:

[0095] 1.1.1, Randomly select two nodes (samples) v1 and v2 from the intrusion detection dataset Data to form set A;

[0096] 1.1.2, Initialize edge set C as an empty set;

[0097] 1.1.3, Randomly select an unselected sample ξ from the intrusion detection dataset Data as the new input sample node v. ξ ;

[0098] 1.1.4, for each node v i Calculate its path to the new input node v ξ Distance ||w ξ -w i ||;

[0099] 1.1.5 Selecting the best sample node and the second-best sample node

[0100] 1.1.6, if edge (vs ,v t If it does not exist, create it, C = C∪{(v s ,v t And set its weight age(v) s ,v t ) is 0;

[0101] 1.1.7, Computation node v ξ With the best matching node v s The similarity a = exp(-||w ξ -w s ||);

[0102] 1.1.8, If a is less than the similarity threshold a T And the access strength is less than the access strength threshold h T Then in v s and v t Add a new node v between r Create a weight vector: w r =0.5(w s +w ξ Create edges (v) r ,v s ) and (v r ,v t ) and delete the old edge (v s ,v t );

[0103] 1.1.9 Otherwise, do not add new sample nodes, and adjust the optimal sample node v. s and its neighboring node v i Location: 0<ε n <ε b <1,h s For node v s Access strength, ε b ε n Update parameters for location;

[0104] Version 1.1.10 adds a connection to v. s Weights of all connected edges: age(v s ,v i ) = age(v s ,v i )+1;

[0105] Version 1.1.11 updates the best matching node v. s and its neighboring node v i Access intensity:

[0106]

[0107]

[0108] Where S is the access intensity constant, α b α n τ b τ n To access the equation parameters, h i (τ) represents the access strength of the i-th node when it is accessed by the algorithm for the τth time.

[0109] 1.1.12, Remove all items whose total weight exceeds the weight threshold age. max Remove all isolated sample nodes from the edges; 1.1.13, if there are unselected samples in the dataset, return to step 1.1.3 to continue selecting;

[0110] 1.1.14 Construct the graph structure data G corresponding to the intrusion detection dataset Data based on the node set A and the edge set C.

[0111] The GWR algorithm can effectively summarize data while preserving the structure of the dataset and the relationships between samples, presenting the data in a graphical format for a more intuitive understanding of its structure. By utilizing GWR to summarize source domain data... and target domain data The data is converted into a graph structure so that information can be extracted from the graph data using GCN, thereby enabling better extraction of domain-invariant features.

[0112] 1.2 Graph Convolutional Neural Network

[0113] GCN (Graph Convolutional Networks) aggregates information about distant neighbors by multiplying graph convolutional layers with spectral filters in the Fourier domain, making it well-suited for non-Euclidean graphs. GCN ingeniously designs a method for extracting features from graph data, enabling the mining of correlational features between connected nodes. These features can then be used for tasks such as node classification. By processing input graph structure data with GCN, the feature information between associated nodes is mined, leading to better extraction of domain-invariant features between source and target domain data.

[0114] GCN is a neural network that directly operates on graphs. An undirected graph is represented by Graph = (V, E), where V is the set of nodes, E represents the set of edges, and X ∈ R. n×M It is a feature matrix consisting of n nodes and their corresponding features, where n is the number of nodes and M is the dimension of the feature vectors. Given an adjacency matrix A∈R n×n Each GCN layer can be written as a non-linear function:

[0115]

[0116] Among them, H (0) For the input feature matrix, H (0) =X,H (1) This is the feature matrix of the first layer. W (0) ∈R M×F and b (0) These are the weight matrix and the bias matrix, respectively, and F is the dimension of the output feature of each node. δ(·) is a non-linear activation function, such as ReLU. It is a normalized symmetric adjacency matrix, which can be calculated as:

[0117]

[0118]

[0119] in, Let I be the degree matrix of the undirected graph Graph, and let I be the identity matrix. If multiple convolutional layers are stacked together, information from more distant connected nodes can be aggregated.

[0120]

[0121] Among them, H (l) Let W represent the feature matrix of the l-th layer. (l) and b (l) These are the weight matrix and bias matrix of the l-th layer GCN, respectively. After the graph structure data for intrusion detection is established, it is input into the multi-layer GCN. By mining the information of each node and the information related to each node, domain-invariant features that can be learned across domains are finally extracted.

[0122] Finally, the feature data H extracted through multiple GCNs can be... (l) The data is input into a softmax classifier to perform classification prediction for each sample node. Z represents the sample prediction result, where ReLU is selected as the activation function, and the cross-entropy loss function for each node is calculated.

[0123]

[0124] GCN can aggregate information from connected nodes by stacking convolutional layers. This approach takes into account the correlation between the node itself and other nodes, which helps to extract features that are more representative of global information, thereby building domain-invariant features in domain adaptation.

[0125] Step 2: Use the Copula distribution alignment method to perform distribution alignment on the domain-invariant features of the source and target domains obtained in Step 1;

[0126] The Copula distribution alignment method is used to align the domain-invariant features of the source and target domains obtained in step 1. By defining the Copula distance, the overall feature distribution difference between the source and target domains is divided into marginal distribution difference of single features and joint distribution difference between features. This reduces the marginal distribution difference and joint distribution difference of features between the source and target domains, thereby achieving data distribution alignment.

[0127] The data distribution alignment method based on copula distance specifically includes:

[0128] Traditional domain adaptation methods focus only on the overall distribution differences or marginal differences of individual features between the source and target domains when aligning data distributions. In certain contexts, the relationships between different features can significantly impact prediction results. However, traditional data alignment methods lack attention to the correlations between different features, failing to distinguish whether data distribution differences stem from marginal differences of a single feature or from differences in correlation between different features.

[0129] Sklar's theorem states that any multivariate distribution can be decomposed into the product of a marginal distribution and a copula function, and vice versa. Therefore, the copula function and the marginal distribution can recover the original multivariate distribution. As shown in formula (8), the continuous density function p(x1,…,x) d This can be written as the marginal distribution p i (·) and Copula density function c(u1,…,u d The product of u, where u i =p i (x i ), where 1≤i≤d.

[0130]

[0131] Inspired by Sklar's theorem, the overall difference in data distribution is divided into two parts: marginal differences of individual features and correlation differences between different features. The correlation differences between different features are measured using Copula distance. Copula is a function used to describe the relationships between multiple random variables. Copula can separate the marginal distributions of multiple random variables from the dependency structure between them. By using Copula, the relationships between multiple features can be better described and modeled without being affected by the marginal distributions of their individual features.

[0132] Given multiple random variables X, their marginal distributions u, and the Copula density function c(u), then the Copula entropy (H) c ) is defined as:

[0133] H c (X)= -∫u ∫c(u)logc(u)du (9)

[0134] In information theory, mutual information is equivalent to the negative entropy of the Copula. The copula function can be used to clearly quantify the degree of correlation between any components [X i , X j in the random vector X. The correlation between features X i and X j can be represented by formula (10):

[0135]

[0136] where P ij is the joint distribution of [X i , X j , P i , P j represent the marginal distributions, and c ij (u i , u j ) is the density function. Therefore, for the measure of the mutual dependence between features X i and X j , it is equivalent to calculating the mutual information of X i and X j .

[0137] Let two random vectors be X and Y, where X = [x1,..., x d ∈ R d , Y = [y1,..., y d ∈ R d . Let and be the cumulative joint distributions of any component pairs [X i , X j and [Y i , Y j of X and Y respectively. Let H c (·, ·) be the measure of the distribution difference. Define the copula distance between [X i , X j and [Y i , Y j (1 ≤ i < j ≤ d) as:

[0138]

[0139] The copula distance between the random vectors X and Y is:

[0140]

[0141] This invention proposes a data distribution alignment method based on copula to pay more attention to the differences in the interrelationships or dependencies between different features, and to enhance the sensitivity to marginal differences and correlation differences. Specifically, in the source domain, the source domain features F... s The data distribution is decomposed into m feature marginal distributions and copula distances between features, and the same process is applied to the target domain. The overall data distribution difference between the source and target domains is evaluated by dividing it into marginal differences and copula distances. By segmenting the overall difference in the joint feature distribution, the contribution of marginal feature differences and copula distances to the data distribution alignment can be determined.

[0142] By taking the marginal difference and copula distance as the overall data distribution difference between the source and target domains, we obtain the objective function Distence for data distribution alignment. By minimizing the objective function, we achieve data distribution alignment between the source and target domains.

[0143]

[0144] The copula distance between the source feature and the target feature is denoted as D. C (F s ,F t The sum of the edge differences of a single feature is expressed as: F s and F t For source domain features and target domain features, Let i and represent the i-th feature of the source domain and the i-th feature of the target domain, respectively.

[0145] Step 3: Construct a conditional domain-based adversarial intrusion detection model for attack detection.

[0146] This paper utilizes a conditional adversarial neural network (CAN) to conduct adversarial training of the discriminator and feature extractor. Class information conditions are added to the discriminator to reduce the impact of domain offset on cross-domain detection performance, improve the accuracy of feature distribution alignment, and enhance the cross-domain detection capability of the conditional adversarial intrusion detection model in IoT intrusion detection. The trained conditional adversarial intrusion detection model is then used to detect network attacks and predict the correct network attack category.

[0147] The conditional domain adversarial intrusion detection model is an adaptive model based on the conditional domain adversarial domain.

[0148] Ganin introduced the concept of Generative Adversarial Networks (GANs) into domain adaptation, proposing Domain Adversarial Neural Networks (DANNs). The DANN structure mainly consists of three parts: a feature extractor, a source domain classifier, and a discriminator. The feature extractor feeds extracted domain-invariant features into the discriminator, which then determines whether the input feature information comes from the source or target domain and calculates the loss. The discriminator's goal is to classify the input feature information into the correct domain, while the feature extractor's goal is to prevent the extracted features from being correctly identified by the domain discriminator, thus creating an adversarial relationship. Simultaneously, the features extracted by the feature extractor are also fed into the source domain classifier. Because the source domain samples are labeled, supervised training using labeled sample data from the source domain ensures classification accuracy.

[0149] DANN training consists of two phases. In the first phase, a discriminator D is trained to distinguish feature data between the source and target domains. In the second phase, a feature extractor is trained to confuse the discriminator D. Simultaneously, the loss function of the discriminator D is used to measure the difference between the data distributions of the source and target domains. In unsupervised domain adaptation, DANN can be formulated as a minimax optimization problem: minimizing the classification error ε(G) on the source domain classifier G and maximizing the domain discrimination error ε(D) between the source and target domains on the discriminator D.

[0150]

[0151]

[0152]

[0153] Where L(·,·) is the cross-entropy loss, Let G(x) represent the source domain samples with n labeled instances and the target domain samples with n unlabeled instances, where G(x) represents the classification prediction generated by the source domain classifier G, and λ is the balance factor.

[0154] Most existing adversarial domain adaptation methods only align feature distributions. When the joint distributions of source and target domain features and sample classes are not the same, neglecting the influence of class information on feature extraction leads to inaccurate feature distribution alignment. Conditional Generative Adversarial Networks (CGANs) better match different distributions by using class information as a condition for the generator and discriminator. Inspired by CGANs, Conditional Domain Adversarial Networks (CDANs) add class information conditions to the discriminator D on adversarial domain adaptation networks, thereby achieving alignment of conditional feature distributions and minimizing cross-domain differences.

[0155] The proposed conditional domain adversarial intrusion detection model (a domain adaptive model based on conditional adversarial domain networks) uses the source domain category label Y... sThe predicted label G(F) of the target domain on the source domain classifier G. t The feature distribution is aligned by adding it to the discriminator D as a class condition. CDAN trains the discriminator and feature extractor by minimizing the classification error ε(G) on the source domain classifier G and maximizing the domain discrimination errors ε(D,G) of the source domain and target domain on the source domain classifier G and discriminator D, as shown in Equation (17):

[0156]

[0157] Where L(·,·) is the cross-entropy loss, F s and F t These represent the domain-invariant features of the source and target domains, respectively. Represents target domain samples Predicted labels on the source domain classifier G.

[0158] The proposed conditional domain adversarial intrusion detection model (a domain adaptive model based on conditional adversarial domain networks) firstly involves a feature extractor F extracting domain-invariant features from the source and target domains. Then, category information is added to the discriminator D, which is trained to distinguish between source and target domain features. Simultaneously, F is calculated. s and F t The Copula distance between data distributions and the loss of the source domain classifier G are used to train the feature extractor F by minimizing the loss of the source domain classifier G and the Copula distance, and maximizing the loss of the discriminator D. This ultimately gives the model good cross-domain performance. The loss function of the final overall model is shown in Equation (18).

[0159]

[0160] Step 4, Algorithm Evaluation:

[0161] To verify the effectiveness of the proposed domain-adaptive algorithm for cross-domain detection, this invention uses four representative intrusion detection datasets: UNSW-NB15 and NSL-KDD, and IoT intrusion detection datasets: UNSW-BOTTOT and UNSW-TONIOT. Experimental groups were set up with NSL-KDD as the source domain and UNSW-BOTTOT as the target domain, and UNSW-NB15 as the source domain and UNSW-TONIOT as the target domain. First, ablation experiments were conducted on both experimental groups to verify the impact of the proposed GWR-GCN method for extracting domain-invariant features, the Copula-based distance data distribution alignment method, and the conditional domain adversarial network on the overall cross-domain performance of the algorithm. Second, cross-domain detection experiments based on domain adaptation were conducted on both experimental groups. By comparing with similar algorithms, the cross-domain performance of the proposed algorithm was verified.

[0162] 4.1 Experimental Environment and Dataset

[0163] The experimental environment for this invention consisted of a 64-bit Windows 11 operating system, an AMD R7-5800H processor, an NVIDIA RTX 3060 graphics card, and 16GB of RAM. The experimental frameworks used included the machine learning library Scikit-learn, the deep learning library Keras, and PyTorch.

[0164] The NSL-KDD dataset

[38] solves the problem of a large amount of redundancy in the original KDD99 dataset. The NSL-KDD dataset includes four different types of attacks: DoS, Probing, U2R, and R2L. Each traffic record in the dataset is represented by 41 features. The University of New South Wales created the UNSWNB15 dataset in 2015 to solve the data quality problems and outdated and incomplete network traffic problems in the previous dataset. The dataset contains 10 traffic categories, including normal traffic, DoS attacks, Fuzzers attacks, etc., and the dataset is represented by 49 features. The UNSW-BOTIOT dataset is an IoT intrusion detection dataset released by the University of New South Wales in 2017. This dataset is based on a real test bench environment to capture the latest modern attack scenarios. The test bench environment uses MQTT, a lightweight communication protocol commonly used in real IoT scenarios, and deploys IoT devices such as weather stations and smart refrigerators. The dataset contains four categories, including normal traffic, DoS attacks, information theft attacks, information collection, etc., and the original dataset consists of 46-dimensional features. The UNSW-TONIOT dataset is an IoT intrusion dataset released in 2021. It captures network data on a modern testing platform consisting of seven types of IoT devices, including smart refrigerators, Modbus sensors, and GPS trackers. The dataset contains nine attack types, such as scanning attacks and DoS attacks, and exhibits heterogeneity among the IoT devices.

[0165] 4.2 Evaluation Indicators

[0166] This invention uses evaluation metrics based on the confusion matrix to verify the effectiveness of the proposed algorithm, including accuracy, precision, recall, F1 score, false positive rate (FPR), and false negative rate (FNR). The confusion matrix is ​​shown in Table 1. The calculation methods for each metric are shown in formulas (19)-(24).

[0167] Table 1 Confusion Matrix

[0168]

[0169] Among them, TP (True Positive) represents data that is normal and is predicted to be normal, TN (True Negative) represents data that is attacking and is predicted to be attacking, FN (False Negative) represents data that is normal but is predicted to be attacking, and FP (False Positive) represents data that is attacking but is predicted to be normal.

[0170]

[0171]

[0172]

[0173]

[0174]

[0175]

[0176] Accuracy, precision, recall, F1 score, false positive rate, and false negative rate are all within the range [0,1]. Among them, the higher the values ​​of accuracy, precision, recall, and F1 score, the better, while the lower the values ​​of false positive rate and false negative rate, the better.

[0177] The invention has been tested, and the intrusion detection model performs very well, consistent with the design expectations.

[0178] To evaluate the overall performance of the proposed domain-adaptive method in cross-domain detection, two sets of experiments were conducted: one set learned intrusion knowledge from the source domain UNSW-NB15 dataset and performed cross-domain detection on the target domain UNSW-TONIOT dataset; the other set learned network attack knowledge using NSL-KDD as the source domain dataset and performed cross-domain detection using UNSW-BOTIOT as the target domain dataset. The results were compared with algorithms such as APE, CDAC, STAR, DDAS, STN, DDAC, WCGN, and GGA on multiple metrics. The experimental results for both sets are shown in Tables 1 and 2.

[0179] Table 1 Cross-domain detection from source domain UNSW-NB15 to target domain UNSW-TONIOT

[0180]

[0181] Table 2 Cross-domain detection from source domain NSL-KDD to target domain UNSW-BOTIOT

[0182]

[0183]

[0184] As shown in Table 1, the method proposed in this invention achieved the highest values ​​in all metrics in the comparative experiment: accuracy, precision, recall, and F1 score, while maintaining the lowest FNR and FPR. Specifically, the algorithm proposed in this invention has the highest precision, recall, and F1 score, indicating that the proposed GWR-GCN domain-invariant feature extraction method and data distribution alignment method can better learn traditional intrusion detection knowledge and make comprehensive and accurate detections of abnormal traffic in the Internet of Things field compared to other methods. Meanwhile, the algorithm of this invention has the lowest FPR and FNR, indicating that the model minimizes false positives and false negatives when detecting malicious traffic, and the model has good generalization performance. As shown in Table 2, the domain adaptive algorithm proposed in this invention outperforms other comparative algorithms in all metrics except accuracy. Although the accuracy of the method of this invention (0.902) is slightly lower than the accuracy of the GGA method (0.927), the GGA method is lower than the method of this invention in all other metrics. This indicates that the accuracy of the GGA method relies on correctly detecting most normal traffic, while its detection effect on attack traffic with fewer samples is worse than that of the method of this invention. These evaluation metrics collectively validate the effectiveness of the proposed domain-invariant feature extraction method, feature distribution alignment method, and conditional domain adversarial method in cross-domain detection for IoT intrusion detection and their practical applicability in avoiding false alarms.

[0185] To verify the contributions of the GWR-GCN feature extraction method, the Copula data distribution alignment method, and the conditional domain adversarial method to the algorithm proposed in this invention, the following experiments were conducted under the same experimental environment:

[0186] Experiment 1: Using only the improved conditional domain adversarial method

[0187] Experiment 2: GWR-GCN+ Conditional Domain Adversarial Model

[0188] Experiment 3: Copula Data Distribution Alignment Method + Conditional Domain Adversarial Model

[0189] Experiment 4: GWR-GCN + Copula data distribution alignment method + domain adversarial method DANN

[0190] Experiment 5: The algorithm proposed in this invention is a combination of GWR-GCN+Copula data distribution alignment method and conditional domain adversarial method.

[0191] like Figure 2 , 3As shown, this invention conducted ablation experiments using the same experimental environment, performing ablation experiments from the source domain NSL-KDD dataset to the target domain UNSW-BOTIOT dataset and from the source domain UNSW-NB15 dataset to the target domain UNSW-TONIOT dataset. These experiments verified the contributions of the GWR-GCN feature extraction method, the Copula-based distribution alignment method, and the conditional domain alignment network to the algorithm proposed in this invention. Figure 1 The results of the ablation experiments are presented. Firstly, the results of Experiments 1 and 2 show that introducing the GWR-GCN feature extraction method on top of the Conditional Domain Adversarial Network (CDN) enables the model to learn domain-invariant features effectively for cross-domain detection, resulting in excellent detection performance. Secondly, comparing Experiments 1 and 3 shows that introducing the Copula data distribution alignment method proposed in this invention on top of the CDN improves the model's classification results. This is because the Copula method effectively reduces the data distribution differences between the source and target domains, allowing the CDN to select the optimal feature subset for cross-domain learning and simultaneously align the distribution of the optimal features, thus achieving good classification results. Finally, the results of Experiments 4 and 5 show that the CDN has higher classification accuracy for cross-domain detection compared to other CDNs. This is because the CDN, by adding class information as a condition, effectively learns the relationship between the class distribution and feature distribution of the data, thereby better aligning feature distributions and reducing errors in cross-domain detection. The algorithm proposed in this invention achieves an accuracy of 90.5% and 90.2%, a PR of 88.40% and 87.9%, and false positive and false negative rates of 0.095 and 0.098, respectively.

[0192] In summary, this invention extracts domain-invariant features using the GWR-GCN feature extraction method, and further enhances feature extraction by connecting sample data into a graph based on correlation relationships. A data distribution alignment method based on Copula distance is proposed, which calculates the correlation between features using Copula and considers the impact of feature-to-feature correlation on distribution alignment, further reducing the data distribution differences between the source and target domains. A conditional domain adversarial intrusion detection model is utilized, incorporating class information into the discriminator to reduce the impact of domain offset on distribution alignment and improve the model's cross-domain detection performance. Cross-domain detection experiments are conducted on network intrusion detection datasets and IoT intrusion detection datasets, along with ablation and comparative experiments. Comparisons with other algorithms in terms of accuracy, recall, and other evaluation metrics demonstrate the superiority of this algorithm.

[0193] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. An Internet of Things (IoT) intrusion detection method, characterized by comprising the following steps: Step 1: The intrusion detection dataset is fed into the GWR-GCN feature extractor to extract domain-invariant features of the source and target domains. The GWR-GCN feature extractor transforms data samples into graph nodes, connects related samples to construct a graph structure, and mines the correlation information between samples using graph convolution. Specifically, this includes: 1.1 The algorithm flow for converting intrusion detection data into graph-structured data using the Growing Flow Network (GWR) is as follows: Assumption This is an intrusion detection dataset, where each data sample represents a node. It is the set of selected sample nodes. Indicates the first 1 node It is the first Each node weight vector; It is the set of edges, age( ) represents an edge ( The weight of ) This is the weight threshold; For nodes Access intensity, To establish the initial access strength, the steps are as follows: 1.1.1, From the intrusion detection dataset Two nodes are randomly selected from the samples. and Form a set ; 1.1.2, Initialize the edge set It is an empty set; 1.1.3, From the intrusion detection dataset Randomly select an unselected sample Sample nodes as new input ; 1.1.4, for each node Calculate its path to the new input node. distance ; 1.1.5 Selecting the best sample node and the second-best sample node ; 1.1.6, if the edge ( If it does not exist, create it. And set its weight age( ) is 0; 1.1.7, Computation Nodes with the best matching node similarity ; 1.1.8, if Less than the similarity threshold And the access strength is less than the access strength threshold. Then in and Add a new node between Create a weight vector: Create edges and And delete the old edges ; 1.1.9 Otherwise, do not add new sample nodes, and adjust the optimal sample node. and its neighboring nodes Location: , , , For nodes Access intensity, , Update parameters for location; 1.1.10, Added with Weights of all connected edges: Version 1.1.11 updates the best matching node. and its neighboring nodes Access intensity: in, For access intensity constant, , , To access the equation parameters, For the first The node at the th The access strength corresponding to the number of times the algorithm accesses the data; 1.1.12, Remove all items whose total weight exceeds the weight threshold. Remove all isolated sample nodes from the edges; 1.1.13 If there are unselected samples in the dataset, return to step 1.1.3 to continue selecting; 1.1.14, based on the node set Sum of edges Construct an intrusion detection dataset The corresponding graph structure data G; 1.2 The input graph structure data is processed using a Graph Convolutional Neural Network (GCN) to mine the feature information between related nodes, specifically including the following: Graph Convolutional Neural Networks (GCNs) are neural networks that directly operate on graphs; undirected graphs are... It means that, among them It is a set of nodes. Represents the set of edges. It is a product of A feature matrix consisting of nodes and their corresponding features The number of nodes The dimension of the feature vector; given the adjacency matrix Each layer of a graph convolutional neural network (GCN) is written as a non-linear function: in, For the input feature matrix, , This is the feature matrix of the first layer; and These are the weight matrix and the bias matrix, respectively. It is the dimension of the output feature of each node; It is a non-linear activation function; It is a normalized symmetric adjacency matrix, calculated as follows: in, It is an undirected graph The degree matrix, It is the identity matrix; if multiple convolutional layers are stacked together, they aggregate information from more distant connected nodes: in, Indicates the first Layer feature matrix, and They are the first The weight matrix and bias matrix of the multilayer graph convolutional neural network (GCN); after the graph structure data for intrusion detection is established, the graph structure data is input into the multilayer graph convolutional neural network (GCN). By mining the information of each node and the information related to each node, the domain-invariant features that can be learned across domains are finally extracted. Finally, the feature data extracted by the multi-layer graph convolutional neural network (GCN) is... The input is fed into a softmax classifier to perform classification prediction for each sample node. Z is the prediction result for the sample, where ReLU is selected as the activation function, and the cross-entropy loss function for each node is calculated: Graph Convolutional Neural Networks (GCNs) aggregate information from connected nodes by stacking convolutional layers. This approach takes into account the correlation between the nodes themselves and other nodes, which helps to extract features that are more representative of global information, thereby constructing domain-invariant features in domain adaptation. Step 2: Use the Copula distribution alignment method to perform distribution alignment on the domain-invariant features of the source and target domains obtained in Step 1; By defining the Copula distance, the overall feature distribution difference between the source and target domains is divided into single feature marginal distribution difference and joint distribution difference between features, thereby reducing the marginal distribution difference and joint distribution difference between the features of the source and target domains and achieving data distribution alignment. The data distribution alignment method based on copula distance specifically includes: Sklar's theorem states that any multivariate distribution can be decomposed into the product of a marginal distribution and a copula function, and vice versa; therefore, the copula function and the marginal distribution can recover the original multivariate distribution; continuous density function Can be written as a marginal distribution and Copula density function The product of is shown in the following formula: in, The overall difference in data distribution is divided into two parts: the marginal difference of a single feature and the correlation difference between different features. The correlation difference between different features is measured by Copula distance. Copula is a function used to describe the relationship between multiple random variables. Copula can separate the marginal distribution of multiple random variables from the dependency structure between random variables. By using Copula, the relationship between multiple features can be better described and modeled without being affected by the marginal distribution of each feature. Given multiple random variables and its marginal distribution and Copula density function Then Copula entropy ( ) is defined as: The copula function can be used to process random vectors. Any component in [ The degree of correlation between them should be clearly quantified; characteristics and The correlation between them is expressed by formula (10): in, for[ The joint distribution of ] , Indicates marginal distribution, It is a density function; therefore, for features and The measurement of interdependence is equivalent to calculating and Mutual information; Let the two random vectors be... and ,in , set up and yes and Arbitrary component pairs [ ] and[ Their respective cumulative joint distributions; let A measure of the difference in distribution; defined [ ] and[ ] The copula distance between the two is: The copula distance between random vectors X and Y is: The data distribution alignment method based on copula focuses more on the differences in the interrelationships or dependencies between different features, enhancing sensitivity to marginal and correlational differences; in the source domain, it aligns source domain features... The data distribution is decomposed into m feature marginal distributions and copula distances between features, and the same processing is applied to the target domain. The overall data distribution difference between the source and target domains is evaluated by dividing it into marginal differences and copula distances. By segmenting the overall difference of the joint feature distribution, the contribution of marginal feature differences and copula distances to the data distribution alignment can be determined. Using marginal difference and copula distance as the overall data distribution difference between the source and target domains, we obtain the objective function Distance for data distribution alignment. Data distribution alignment between the source and target domains is achieved by minimizing this objective function. Wherein, the copula distance between the source feature and the target feature is expressed as: The sum of edge differences of a single feature is expressed as , For source domain features and target domain features, Representing the source domain, respectively The first feature and target domain One feature; Step 3: Construct a conditional domain-based adversarial intrusion detection model for attack detection.

2. The IoT intrusion detection method according to claim 1, characterized in that: In step 3, the conditional domain adversarial neural network is used to perform adversarial training on the discriminator and the feature extractor. Class information conditions are added to the discriminator to reduce the impact of domain offset on cross-domain detection performance, improve the accuracy of feature distribution alignment, and enhance the cross-domain detection capability of the conditional domain adversarial intrusion detection model in IoT intrusion detection. The trained conditional domain adversarial intrusion detection model is then used to detect network attacks and predict the correct network attack category.

3. The IoT intrusion detection method according to claim 1, characterized in that: In step 3, the specific process of constructing the conditional domain-based adversarial intrusion detection model is as follows: Ganin introduced the idea of ​​generative adversarial networks into domain adaptation, thus proposing Domain Adversarial Neural Network (DANN). The DANN structure consists of three parts: a feature extractor, a source domain classifier, and a discriminator. The feature extractor feeds the extracted domain-invariant features into the discriminator, which then determines whether the input feature information comes from the source domain or the target domain and calculates the loss. The discriminator's goal is to classify the input feature information into the correct domain, while the feature extractor's goal is to prevent the extracted features from being correctly judged by the discriminator, thus forming an adversarial relationship. At the same time, the features extracted by the feature extractor are also fed into the source domain classifier. Since the source domain samples are labeled, supervised training is performed using the labeled sample data from the source domain to ensure the accuracy of classification. Domain Adversarial Neural Network (DANN) training consists of two phases. The first phase trains a discriminator D to distinguish feature data between the source and target domains. The second phase trains a feature extractor to confuse the discriminator D. Simultaneously, the loss function of the discriminator D is used to measure the difference between the data distributions of the source and target domains. In unsupervised domain adaptation, the DANN can be formulated as a minima optimization problem, minimizing the difference in the source domain classifier's performance. Classification error Maximize the domain discrimination error of the source and target domains on the discriminator D. : in It is cross-entropy loss. , express The source domain samples of each labeled instance and An unlabeled target domain sample Source domain classifier The generated classification predictions As a balance factor; The conditional domain-based adversarial intrusion detection model is a domain-adaptive model based on conditional adversarial domain networks, which integrates source domain category labels. and the target domain in the source domain classifier On the prediction label It is added to the discriminator D as a category condition to achieve alignment of feature distributions; Conditional Domain Adversarial Network (CDAN) minimizes the classifier in the source domain. Classification error Maximize the difference between the source and target domains in the source domain classifier. and discriminator Domain discrimination error To train the discriminator and feature extractor, as shown in Equation (17): in, It is cross-entropy loss. and These represent the domain-invariant features of the source and target domains, respectively. Represents target domain samples In the source domain classifier Predicted labels on; Based on the conditional domain adversarial intrusion detection model, firstly, the feature extractor... Domain-invariant features are obtained by extracting features from the source and target domains, and then category information is added to the discriminator. The discriminator is trained to distinguish between source and target domain features, and at the same time, it is calculated... and Copula distance between data distributions and source domain classifier The loss is finally minimized by the source domain classifier. Loss and Copula distance, maximizing discriminator Loss-based inverse training feature extractor This ultimately enables the conditional domain-based adversarial intrusion detection model to possess good cross-domain performance; the final overall loss function of the conditional domain-based adversarial intrusion detection model is shown in formula (18):

Images