Network intrusion detection method and device, computing device, and storage medium

Abstract

The disclosed embodiments provide a network intrusion detection method and apparatus, a computing device, and a storage medium. The network intrusion detection method includes: in response to obtaining a data packet to be detected, constructing an input tensor based on the data packet to be detected; processing the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network; splicing the target feature tensor to obtain a fused feature tensor; processing the fused feature tensor using a post-processing neural network to determine the network intrusion type of the data packet to be detected; wherein the node parameters of the multi-layer convolutional network and the post-processing neural network are trained simultaneously. Because different target feature tensors represent feature information of different scales of the data packet to be detected, the use of a fused feature tensor can determine the network intrusion type contained in the data packet to be detected based on feature information of more scales, thereby improving the accuracy of network intrusion type prediction.

Description

Technical Field

[0001] The present disclosure relates to the technical field of network security, and in particular to a network intrusion detection method and apparatus, a computing device, and a storage medium. Background Art

[0002] Network intrusion is an increasingly serious problem that coexists with the development of computer network technology and the expansion of computer network scale. How to accurately detect network intrusion events and their types is one of the research directions of network security software.

[0003] The related technology is based on the fact that the convolutional neural network (CNN) has good feature extraction capabilities for high-dimensional input data, and a network intrusion detection model based on a convolutional neural network is constructed for intrusion detection of network terminal equipment. Publication No. CN109379379A discloses a network intrusion detection method based on an improved convolutional neural network. This method is based on an improved convolutional neural network and combines a cross-layer design method to construct and train an improved convolutional neural network model for network intrusion identification and detection. However, the aforementioned improved convolutional neural network model still has the problem of low recognition accuracy in the identification of network intrusion events and intrusion type identification. Summary of the invention

[0004] In order to solve the problem that the existing interactive question-and-answer system cannot meet the user interaction needs, the embodiments of the present disclosure provide a network intrusion detection method and apparatus, a computing device, and a storage medium.

[0005] In a first aspect, an embodiment of the present disclosure provides a network intrusion detection method, including:

[0006] In response to obtaining a data packet to be detected, constructing an input tensor based on the data packet to be detected;

[0007] Processing the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network;

[0008] Concatenating the target feature tensors to obtain a fused feature tensor;

[0009] Processing the fused feature tensor using a post-processing neural network to determine the network intrusion type of the data packet to be detected;

[0010] Wherein, the node parameters of the multi-layer convolutional network and the post-processing neural network are trained simultaneously.

[0011] Optionally, the adopting a multi-layer convolutional network to process the input tensor includes:

[0012] Before using the subsequent convolution layer to process the previous feature tensor output by the previous convolution layer, padding the edge of the previous feature tensor based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the previous feature tensor in the first dimension to obtain a padding tensor;

[0013] Processing the padding tensor with the subsequent convolutional layer to obtain a subsequent feature tensor, so that the subsequent feature tensor has the same length as the preceding feature tensor in the first dimension;

[0014] The step of splicing the target feature tensors to obtain a fused feature tensor includes: splicing the target feature tensors in a second dimension to obtain the fused feature tensor.

[0015] Optionally, the multi-layer convolutional network further includes a pooling layer located after the target convolutional layer, and the pooling layer is used to perform pooling processing on the feature tensor output by the target convolutional layer in the first dimension;

[0016] The adopting a multi-layer convolutional network to process the input tensor comprises:

[0017] After obtaining the feature tensor output by the target convolution layer, the feature tensor is processed by the pooling layer to obtain a pooling tensor;

[0018] The step of filling the edge of the previous feature tensor based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the previous feature tensor in the first dimension to obtain a filling tensor includes:

[0019] When the target convolution layer is not the terminal convolution layer of the multi-layer convolutional network, the edge of the pooling tensor is padded based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the pooling tensor in the first dimension to obtain a padded tensor.

[0020] Optionally, the length of the subsequent feature tensor in the first dimension is the same as that of the preceding feature tensor, including: the length of the subsequent feature tensor in the first dimension is the same as that of the pooling tensor;

[0021] The step of splicing the target feature tensor in the second dimension to obtain the fused feature tensor includes:

[0022] When the target feature tensor output by the target convolution layer is pooled by the pooling layer, the pooling tensor is used to replace the corresponding target feature tensor and is concatenated with other target feature tensors to obtain the fused feature tensor.

[0023] Optionally, the data packet to be detected is a data packet sent to a target host and a target service;

[0024] The method further comprises: obtaining traffic statistics characteristics of the target host and / or the target service;

[0025] The constructing of the input tensor based on the data packet to be detected includes: obtaining header data features and content features of the data packet to be detected;

[0026] The input tensor is constructed based on the packet header data feature, the content feature and the traffic statistical feature.

[0027] Optionally, the post-processing neural network includes a channel attention mechanism module and a type output module;

[0028] The adopting a post-processing neural network to process the fused feature tensor to determine the network intrusion type of the data packet to be detected includes:

[0029] Processing the fused feature tensor using the channel attention mechanism module to obtain a modified fused feature tensor;

[0030] The type output module is used to process the modified fused feature tensor to determine the network intrusion type of the data packet to be detected.

[0031] Optionally, the channel attention mechanism module includes a multi-layer perceptron;

[0032] The adopting the channel attention mechanism module to process the fused feature tensor to obtain a modified fused feature tensor includes: determining a pooling value of the fused feature tensor at each position of the second dimension;

[0033] Concatenating the pooling values ​​to obtain a pooling vector;

[0034] Processing the pooling vector using the multi-layer perceptron to obtain an attention vector;

[0035] The fused feature tensor is corrected using the attention vector to obtain a corrected fused feature tensor.

[0036] In a second aspect, the present disclosure provides a training method for a network intrusion detection model, wherein the network intrusion detection model includes a multi-layer convolutional network and a post-processing neural network; the training method includes:

[0037] Construct input tensors based on sample packets in the sample dataset;

[0038] Processing the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network;

[0039] Concatenating the target feature tensors to obtain a fused feature tensor;

[0040] Processing the fused feature tensor with a post-processing neural network to obtain a predicted network intrusion type;

[0041] The multi-layer convolutional network and the post-processing neural network are trained based on the predicted network intrusion type and the intrusion type label corresponding to the sample data packet.

[0042] In a third aspect, an embodiment of the present disclosure provides a network intrusion detection device, including:

[0043] An input tensor construction unit, configured to construct an input tensor based on the data packet to be detected in response to obtaining the data packet to be detected;

[0044] A convolution processing unit, used to process the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network;

[0045] A splicing processing unit, used for splicing the target feature tensors to obtain a fused feature tensor;

[0046] A post-processing unit, used to process the fused feature tensor using a post-processing neural network to determine the network intrusion type of the data packet to be detected;

[0047] Wherein, the multi-layer convolutional network and the post-processing neural network are trained simultaneously.

[0048] In a fourth aspect, an embodiment of the present disclosure provides a computing device, comprising a processor and a memory, wherein the memory is used to store a computer program; when the computer program is loaded by the processor, the processor executes the network intrusion detection method or the network intrusion detection model training method as described by Qian.

[0049] In a fifth aspect, an embodiment of the present disclosure provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the processor implements the network intrusion detection method or the network intrusion detection model training method as described above.

[0050] The network intrusion detection method of the disclosed embodiment processes the input tensor through a multi-layer convolutional network to obtain the target feature tensor of at least two convolutional layer inputs, constructs a fused feature tensor based on the target feature tensor, and then determines the network intrusion type of the data packet to be detected based on the fused feature tensor. Because different target feature tensors represent feature information of different scales of the data packet to be detected, the use of the fused feature tensor can determine the network intrusion type contained in the data packet to be detected based on feature information of more scales, thereby improving the accuracy of network intrusion type prediction. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0052] In order to more clearly illustrate the technical solutions in the embodiments of the present disclosure or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art description. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor, including

[0053] Figure 1 is a flow chart of a network intrusion detection method provided by an embodiment of the present disclosure;

[0054] Figure 2 is a schematic diagram of the structure of a multi-layer convolutional network used in some embodiments;

[0055] Figure 3 is a schematic diagram of the structure of a multi-layer convolutional network provided in some further embodiments of the present disclosure;

[0056] Figure 4 is a flowchart of using a post-processing neural network to process fused feature tensors to obtain network intrusion types in some embodiments;

[0057] Figure 5 is a flow chart of a training method for a network intrusion detection model provided by an embodiment of the present disclosure;

[0058] Figure 6 is a result schematic diagram of the network intrusion detection device provided by an embodiment of the present disclosure;

[0059] Figure 7 is a result schematic diagram of the network intrusion detection model training device provided by an embodiment of the present disclosure;

[0060] Figure 8 It is a schematic diagram of the structure of a computing device provided in an embodiment of the present disclosure. DETAILED DESCRIPTION

[0061] Embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, which are instead provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0062] The term "including" and its variations used in this document are open inclusions, i.e., "including but not limited to". The term "based on" means "based at least in part on". The term "one embodiment" means "at least one embodiment"; the term "another embodiment" means "at least one other embodiment"; the term "some embodiments" means "at least some embodiments". Relevant definitions of other terms will be given in the description below. In this document, relational terms such as "first" and "second" are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0063] In order to solve the problem that the existing convolutional neural network model has low recognition accuracy in processing network intrusion type identification, the present disclosure provides a new network intrusion detection method. The network intrusion detection method provided by the embodiment of the present disclosure is based on the characteristics of the multi-layer convolutional network model that can extract multi-scale features to achieve detection and identification of network intrusion.

[0064] Figure 1 : is a flow chart of the network intrusion detection method provided by the embodiment of the present disclosure. Figure 1 As shown, the network intrusion detection method provided by the embodiment of the present disclosure includes S110-S140.

[0065] The network intrusion detection method provided by the embodiment of the present disclosure is executed by a computing device capable of acquiring network data packets sent to a target host. In a specific implementation, the computing device may be the aforementioned target host or a network device connected to the target host.

[0066] S110: In response to obtaining the data packet to be detected, construct an input tensor based on the data packet to be detected.

[0067] The data packet to be detected is a data packet sent to the target host and is used to request the target host to provide a target service.

[0068] After obtaining the data packet to be detected, the computing device will unpack the data packet to be detected based on the set unpacking rules, and construct an input tensor based on the unpacked data obtained by the unpacking process.

[0069] In a specific implementation, the data packet to be detected includes a header and a data payload. Accordingly, the computing device extracts the header data of the data packet to be detected to obtain header data features, and extracts the data payload to obtain content features. For example, the header data features extracted from the header data may include connection time, data packet protocol type, number of bytes transmitted, etc., and the content features extracted from the data payload may include features such as the number of failed logins.

[0070] After obtaining the aforementioned packet header data features and content features, the aforementioned packet header data features and content features can be encoded respectively to obtain corresponding vectors or data fragments, and then the aforementioned vectors and / or data fragments are concatenated to obtain an input tensor.

[0071] For example, by obtaining the packet header data features including the data packet protocol type. After determining the data packet protocol type, the data packet protocol type can be converted into a binary vector. In a specific implementation, the TCP protocol is represented by (1,0,0), the UDP protocol is represented by (0,1,0), and the ICMP protocol is represented by (0,0,1).

[0072] In some embodiments, a single data packet to be detected may not fully reflect the type of network intrusion. For example, in the case where the network intrusion is a denial of service, a single data packet cannot reflect abnormal traffic. In order to be able to more accurately determine the type of network intrusion later, the computing device can also obtain traffic statistics characteristics of the target host and / or target service. The traffic statistics characteristics may include traffic statistics characteristics per unit time, and may also include traffic statistics characteristics of a unit number of network data packets received by the target host or target service.

[0073] For example, the traffic statistics characteristics per unit time may include the number of connections with the target host per unit time and the number of connections with the target service per unit time; the traffic statistics characteristics per unit data packet may include the number of connections of network data packets requesting services from the target host among 100 network data packets acquired by the computing device.

[0074] When the traffic statistics features are obtained, the input tensor can be constructed based on the data features and traffic statistics features of the data packet to be detected. In a specific implementation, the input tensor can be constructed based on the header data features, content features and traffic statistics features of the data packet to be detected. In a specific implementation, the data features determined based on the above method are 41-dimensional, and the length of the input tensor obtained after vectorization processing and splicing of the 41-dimensional features is 122 dimensions.

[0075] Here is an interpolation. Although the aforementioned input tensor is named as a tensor, in actual application it may be a one-dimensional vector. Considering the convenience of subsequent data processing and representation, the aforementioned one-dimensional tensor is forcibly expanded to a multi-dimensional tensor. For example, in some specific applications, the aforementioned 122-dimensional one-dimensional vector is expanded to a 1*122*1 three-dimensional tensor.

[0076] S120: Process the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network.

[0077] A multi-layer convolutional network is a pre-trained convolutional neural network that includes multiple convolutional layers. Figure 2 : is a schematic diagram of the structure of a multi-layer convolutional network used in some embodiments, which includes four convolutional layers. The hyperparameters of the multi-layer convolutional network in the disclosed embodiments (such as the number of convolutional layers, the number, length and step size of convolutional kernels used in each convolutional layer) are predetermined, and the network node parameters (such as the weights of the convolutional kernels) are obtained through model training. For convenience, how to train a multi-layer convolutional network will be analyzed later.

[0078] like Figure 2 As shown, in some embodiments, each convolution layer of the multi-layer convolution network is connected in sequence, and the feature tensor output by the previous convolution layer is used as the input of the subsequent convolution layer. After the input tensor is input to the multi-layer convolution network, each convolution layer outputs a feature tensor respectively.

[0079] Based on the principle of convolution processing and the serial relationship of each convolution layer, it can be seen that: (1) the closer the convolution layer is to the front, the more the feature tensor obtained by processing the corresponding input can represent the detailed features (or detailed information) of the input tensor; (2) the closer the convolution layer is to the back, the more the feature tensor obtained by processing the corresponding input can represent the large-scale features (or large-scale information) of the input tensor; (3) after multiple convolution layers are connected in sequence, the feature tensors obtained in sequence can represent the scale features of the corresponding scale of the input tensor.

[0080] In the embodiment of the present disclosure, in the process of processing the input tensor using a multi-layer convolutional network, feature tensors output by at least two convolutional layers are obtained, and the aforementioned feature tensors are used as target feature tensors. Figure 2 As shown, in the use of Figure 2 In the process of processing the input tensor by the multi-layer convolutional network shown in the figure, the output tensor of each convolutional layer is used as the target feature tensor.

[0081] S130: Concatenate the target feature tensors to obtain a fused feature tensor.

[0082] The computing device uses a predetermined tensor splicing method to splice the target feature tensor to obtain a fused feature tensor.

[0083] In some embodiments, the computing device directly converts the target feature tensor into a one-dimensional vector, performs one-dimensional concatenation processing on the vector in the order of the convolutional layers corresponding to the target feature tensor, and obtains a fused feature tensor.

[0084] In some other embodiments, the target feature tensor is an n-dimensional tensor, and its lengths in n-1 first dimensions are the same. The computing device splices the target feature tensors so that the n-1 first dimensions are aligned in sequence, and splices multiple target feature tensors in the nth dimension (herein referred to as the second dimension) to obtain a fused feature tensor.

[0085] According to the previous explanation and the formation method of the fused feature tensor, it can be determined that the fused feature tensor has feature information of at least two scales. Considering that the feature tensor output by the last convolutional layer of the multi-layer convolutional network must be used as the target feature tensor, it can be determined that the fused feature tensor has the global information of the input tensor and the detailed information of some details.

[0086] S140: Using a post-processing neural network to process the fused feature tensor, and determining a network intrusion type of the data packet to be detected.

[0087] The post-processing neural network is a network connected to the input end of the multi-layer convolutional network and used to post-process the fused feature tensor. In a specific implementation, the post-processing neural network can be various types of networks, for example, a fully connected network. Of course, the post-processing network is not limited to a fully connected network, but can also be other types of networks.

[0088] The post-processing neural network is a neural network trained together with the aforementioned multi-layer convolutional network, and the node parameters of the two are correlated during the training process.

[0089] After the post-processing neural network processes the fused feature tensor, it can output a result vector including the probabilities of various network intrusion types. After obtaining the result vector, the network intrusion type of the data packet to be detected can be determined according to the maximum probability in the result vector. The network intrusion type of the data packet to be detected here may be no network intrusion, or it may be one of various network intrusion types (such as denial of service attack, unauthorized access to remote host, authorized access by local super user, port monitoring or port scanning, etc.).

[0090] Here we analyze the reasons why the existing network intrusion detection method based on convolutional neural network has low detection accuracy, and then analyze the reasons why the network intrusion detection method of this scheme can achieve improved detection accuracy.

[0091] The existing network intrusion detection method based on convolutional neural network uses the characteristics of convolutional neural network to extract features from input tensors, relies on multiple convolution processes to gradually obtain large-scale feature information in the input tensor, and determines the type of network intrusion based on the large-scale information. Based on the specific type and specific intrusion method of network intrusion, the intrusion type is not only reflected in the large-scale feature information of the input tensor, but also in other scale feature information of the input tensor (such as small-scale feature information and medium-scale feature information). The existing network intrusion detection method based on convolutional neural network does not take other scale feature information into consideration, and therefore cannot accurately identify certain types of network intrusions.

[0092] The network intrusion detection method of the disclosed embodiment obtains multiple target feature tensors obtained by processing input tensors with a multi-layer convolutional network, constructs a fused feature tensor based on the multiple target feature tensors, and then determines the network intrusion type of the data packet to be detected based on the fused feature tensor. Because the present embodiment uses information characterizing different scale features of the data packet to be detected to predict the network intrusion type, it is also possible to better identify the network intrusion type contained in the data packet to be detected.

[0093] In the foregoing S130, it is mentioned that the target feature tensors need to be spliced ​​to obtain a fused feature tensor. In some embodiments, the computing device splices the target feature tensors in the second dimension to obtain a fused feature tensor. Accordingly, it is necessary to ensure that the scales of the multiple target feature tensors in each first dimension are the same.

[0094] To achieve the aforementioned goal, the above S120 uses a multi-layer convolutional network to process the input tensor including the following S121-S122.

[0095] S121: Before using the subsequent convolution layer to process the previous feature tensor output by the previous convolution layer, the edge of the previous feature tensor is padded based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the previous feature tensor in the first dimension to obtain a padded tensor.

[0096] According to the principle of convolution processing, the previous feature tensor is convolved without padding, because the length of the convolution kernel in a first dimension must be greater than 1, even if the moving step of the convolution kernel is 1, the length of the subsequent feature tensor in the first dimension obtained after convolution processing will be reduced. For example, it will not be possible to ensure that the subsequent target feature tensor is spliced ​​with the previous target feature tensor in the second dimension.

[0097] In order to avoid the aforementioned problems, in the embodiments of the present disclosure, before using the subsequent convolutional layer to process the previous feature tensor output by the previous convolutional layer, the previous feature tensor is first edge-filled in the first dimension to expand the length of the previous feature tensor in the first dimension, so that the length of the subsequent feature tensor obtained after processing by the subsequent convolutional layer is not reduced in the first dimension.

[0098] In a specific implementation, the padding scale for edge padding of the previous feature tensor in the first dimension needs to be determined according to the length of the convolution kernel in the first dimension in the subsequent convolution layer, the moving step, and the length of the previous feature tensor in the first dimension.

[0099] For example, if the length of the convolution kernel in the post-convolution layer in the first dimension is 3, and the moving step in the first dimension is 1, then the corresponding padding scale in the first dimension is 2; for another example, if the length of the post-convolution kernel in the first dimension is 1, and the moving step in the first dimension is 1, then no padding is required in the first dimension, and at this time, there is no need to consider the length of the previous feature tensor in the first dimension.

[0100] For another example, if the length of the convolution kernel in the rear convolution layer in the first dimension is 3, the moving step in the first dimension is 2, and the length of the previous feature tensor in the first dimension is 10, then the corresponding padding scale in the first dimension is 11. However, it should be noted that the padding scale is too large at this time, which only realizes the forced alignment of the rear feature tensor and the front feature tensor in the first dimension, and the value of the rear feature tensor in the first dimension has no practical meaning.

[0101] In practical applications, in order to ensure that the values ​​at each position of the post-feature tensor are meaningful, the moving step length in the first dimension is often set to 1. Combined with the previous example, at this time, it is only necessary to determine the padding scale based on the length of the post-convolution kernel in the first dimension.

[0102] In a specific implementation, the edge padding is performed on the previous feature tensor in the first dimension, and the padding may be performed at the end of the first dimension, or at both the head and the tail of the first dimension.

[0103] S122: Use the subsequent convolutional layer to process the padding tensor to obtain the subsequent feature tensor.

[0104] After the padding tensor is obtained through the padding process of S121, the padding tensor is then processed by the subsequent convolution layer to obtain the subsequent feature tensor. Combined with the analysis in the previous article, the length of the subsequent feature tensor and the previous feature tensor in the first dimension is the same. When the subsequent feature tensor is used as the target feature tensor, it can be spliced ​​with the previous feature tensor in the second dimension.

[0105] In the disclosed embodiment, in order to fuse the features of each channel of the previous feature tensor processed by convolution and avoid increasing the dimension of the subsequent feature tensor obtained after processing in the subsequent convolution layer, the length of the subsequent convolution layer in the second dimension is the same as the number of convolution kernels used in the previous convolution layer. Accordingly, the moving step length of the subsequent convolution kernel in the second dimension is 0.

[0106] When executing the aforementioned S121-S122, the aforementioned S130 may specifically include the following S131.

[0107] S131: Concatenate the target feature tensors in the second dimension to obtain a fused feature tensor.

[0108] In some embodiments, the multi-layer convolutional network includes, in addition to the convolutional layer, a pooling layer disposed after the target convolutional layer.

[0109] Figure 3 is a schematic diagram of the structure of a multi-layer convolutional network provided in some embodiments of the present disclosure. Figure 3 As shown, a pooling layer is set after the first convolution layer of the multi-layer convolution network. The pooling layer is used to process the feature tensor output by the first convolution layer. According to the pooling principle, the feature tensor output by the first convolution layer can be pooled by using the pooling layer to reduce the dimension of the feature tensor or the length of a specific dimension, thereby reducing the dimension or length of the feature tensor output by the post-convolution layer, thereby reducing the complexity of subsequent processing and realizing the number of nodes in the post-processing network.

[0110] In the disclosed embodiment, the pooling layer is used to perform pooling processing on the feature tensor output by the target convolution layer in the first dimension. Accordingly, the above S120 may also include the following S123 during the execution process.

[0111] S123: After obtaining the feature tensor output by the target convolutional layer, a pooling layer is used to process the feature tensor to obtain a pooled tensor.

[0112] For example, Figure 3 In the multi-layer convolutional network shown, after the first convolutional layer outputs the feature tensor, the pooling layer processes the aforementioned feature tensor to obtain a pooled tensor.

[0113] When executing the aforementioned S123, the aforementioned S122 specifically includes the following S1221.

[0114] S1221: When the target convolution layer is not the terminal convolution layer of the multi-layer convolutional network, the edge of the pooling tensor is filled based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the pooling tensor in the first dimension to obtain a filling tensor.

[0115] by Figure 3 Taking the multi-layer convolutional network shown in FIG. 1 as an example, the first convolutional layer is the target convolutional layer, which is not the terminal convolutional layer of the multi-layer convolutional network. Accordingly, after the feature tensor output by the first convolutional layer is processed by the pooling layer to obtain the pooled tensor, the pooled tensor is used as the input of the second convolutional layer. In this case, the length of the subsequent feature tensor and the previous feature tensor in the first dimension is the same, specifically: the length of the subsequent feature tensor and the pooled feature tensor in the first dimension is the same.

[0116] Correspondingly, the above S131 concatenates the target feature tensors in the second dimension to obtain a fused feature tensor, specifically including: when the target feature tensor output by the target convolution layer is pooled by the pooling layer, the pooling tensor is used to replace the corresponding target feature tensor and concatenate it with other target feature tensors to obtain a fused feature tensor.

[0117] like Figure 3 The pooling vector output by the pooling layer in the multi-layer convolutional network shown is used as the target feature tensor and is concatenated with the target feature tensor output by the post-convolutional layer in the second dimension to obtain a fused feature tensor.

[0118] Here is Figure 3 The multi-layer convolutional network shown in Figure 2 is further analyzed. In practical applications, Figure 3 The multi-layer convolutional network shown in the figure is based on the premise that the target feature tensor output by the post-convolutional layer can be concatenated with the pooling tensor in the second dimension, and the length of the post-target feature tensor in the first dimension is the same as the length of the pooling tensor in the first dimension. In order to achieve the above purpose, no pooling layer is set after the post-convolutional layer, and only a pooling layer is set after the first convolutional layer.

[0119] In a specific application, Figure 3 The hyperparameter settings in the multi-layer convolutional network shown in Table 1.

[0120] Table 1 Multi-layer convolutional network hyperparameter configuration table

[0121] Layer Name Kernel function length Number of convolution kernels Step Length Filling method The first convolutional layer 1×4×1 10 (1,2,0) No filling Pooling Layer 1×3×1 / (1,3,0) End padding The second convolutional layer 1×4×10 20 (1,1,0) End padding The third convolutional layer 1×4×20 20 (1,1,0) End padding The fourth convolutional layer 1×4×20 40 (1,1,0) End padding

[0122] Combined with the information in Table 1, it can be seen that if the input tensor is a three-dimensional tensor of 1×122×1, the feature tensor obtained after the first convolution layer is a first feature tensor of 1×60×10, the first feature tensor is pooled to obtain a pooled tensor of 1×20×10, the pooled tensor is processed by the second convolution layer to obtain a second feature tensor of 1×20×20, the second feature tensor is processed by the third convolution layer to obtain a third feature tensor of 1×20×20, and the third feature tensor is processed by the fourth convolution layer to obtain a fourth feature tensor of 1×20×40. After splicing the aforementioned pooled tensor, the second feature tensor, the third feature tensor, and the fourth feature tensor, a fused feature tensor of 1×20×90 is obtained.

[0123] In practical applications, although the multi-scale feature fusion feature tensor determined by the above method can obtain more useful information to characterize the data packet to be processed, it may also introduce more redundant feature information. The introduction of redundant feature information may also affect the intrusion type detection.

[0124] Figure 4Flowchart of some embodiments using post-processing neural network to process fused feature tensors to obtain network intrusion types. Figure 4 As shown, in order to solve the problem of introducing redundant feature information due to the use of multi-scale feature fusion feature tensors, the aforementioned S140 uses a post-processing neural network to process the fused feature tensor and determine the network intrusion type of the data packet to be detected as follows S141-S142. It should be noted that the premise for the computing device to execute the aforementioned S141-S142 is that the post-processing neural network includes an attention mechanism module and a type output module.

[0125] S141: Use the channel attention mechanism module to process the fused feature tensor to obtain a modified fused feature tensor.

[0126] The channel attention mechanism module is based on the channel attention algorithm, which suppresses the redundant information in the input data and enhances the useful information, thereby reducing the impact of redundant feature information on the results. In the specific implementation, the channel attention mechanism module removes redundant feature information by modulating the value at each position of the fused feature tensor.

[0127] In a specific implementation, the channel attention mechanism module includes a multi-layer perceptron. The computing device processes the fused feature tensor based on the channel attention mechanism module to obtain a modified fused feature tensor including the following S1411-S1414.

[0128] S1411: Determine the pooling value of the fused feature tensor at each position of the second dimension.

[0129] Taking the multi-scale feature fusion feature tensor of 1×20×90 (three-dimensional tensor, each dimension is represented by xyz) obtained above as an example, its second dimension is the z feature dimension. To determine the pooling value of the fused feature tensor at each position in the second dimension, the two-dimensional tensor (xy plane tensor) corresponding to each position in the second dimension can be determined, and then the corresponding pooling value is determined according to the value at each position of the two-dimensional tensor.

[0130] In specific implementations, the maximum value or average value in the two-dimensional tensor can be used as the pooling value, or both the maximum value and the average value can be used as the pooling value. Taking the above fused feature tensor as an example, F(i,j,c) represents the value of the (i,j)th position in the x- and y-dimensions and the cth element in the z-dimension. Then the maximum pooling value Average pooling value

[0131] S1412: Concatenate the pooling values ​​to obtain a pooling vector.

[0132] The above-mentioned concatenation of pooling values ​​to obtain a pooling vector is to sort the pooling values ​​according to their positions in the second dimension to obtain a pooling vector. In a specific implementation, the above-mentioned maximum pooling value v(c) is concatenated. max The maximum pooling vector v can be obtained by max , concatenate the above average pooling value v average (c) The average pooling vector v can be obtained average . It can be imagined that the maximum pooling vector v max and the average pooling vector v average The length of is the same as the length of the fused feature tensor F(i,j,c) in the second dimension.

[0133] S1413: Use a multi-layer perceptron to process the pooled vector to obtain an attention vector.

[0134] Because the multilayer perceptron is part of the post-processing network, it can be seen that the node parameters of each layer of the multilayer perceptron have been obtained through pre-training.

[0135] In a specific implementation, the aforementioned maximum pooling vector can be processed by a maximizing multilayer perceptron to obtain a first attention vector, and the aforementioned average pooling vector can be processed by an averaging multilayer perceptron to obtain a second attention vector. When the channel attention mechanism module includes both a maximizing multilayer perceptron and an averaging multilayer perceptron, the first attention vector and the second attention vector can be obtained at the same time.

[0136] In a specific application, the computing device uses v′ max (c) = W2f(W1v max ) obtains the first attention vector, where W2 and W1 represent the node parameter features between the two layers of the multilayer perceptron that are maximized, and f(·) represents the activation function.

[0137] S1414: Use the attention vector to correct the fused feature tensor to obtain a corrected fused feature tensor.

[0138] The attention vector is used to correct the fused feature tensor. The parameters of the attention mechanism vector at each position are multiplied with the eigenvalues ​​of the vectors at positions i and j in the xy dimension of the fused feature tensor to obtain the corresponding correction vector, and then the correction vector is concatenated according to i and j to obtain the corrected fused feature tensor.

[0139] In a specific implementation, a first corrected fused feature tensor can be obtained for the aforementioned first attention vector. A second corrected fused feature tensor can be obtained for the aforementioned second attention vector. If the channel attention mechanism module only includes a maximized multilayer perceptron and an averaged multilayer perceptron, the corresponding first corrected fused feature tensor or the second corrected fused feature tensor is used as the final output corrected fused feature tensor. If the channel attention mechanism module includes both a maximized multilayer perceptron and an averaged multilayer perceptron, the first corrected feature tensor and the second corrected feature tensor can be reconnected to obtain the final output corrected fused feature tensor.

[0140] S142: Use the type output module to process the modified fused feature tensor to determine the network intrusion type of the data packet to be detected.

[0141] In a specific implementation, the type output module may be a fully connected network. The computing device may integrate the modified fused feature tensor into a one-dimensional vector, and then use the type output module to process the aforementioned one-dimensional tensor to obtain an output vector. Finally, the network intrusion type of the data packet to be detected may be determined based on the probability value of each position of the output vector.

[0142] In addition to providing the aforementioned network intrusion detection method, the embodiment of the present disclosure also provides a method for training a network intrusion detection model, wherein the network intrusion detection model includes the aforementioned multi-layer convolutional network and post-processing neural network. Accordingly, the training of the network intrusion detection model is to train the aforementioned multi-layer convolutional network and post-processing neural network at the same time.

[0143] Figure 5 FIG. 1 is a flow chart of a training method for a network intrusion detection model provided by an embodiment of the present disclosure. Figure 5 As shown, the training method of the network intrusion detection model includes the following S210-S250.

[0144] It should be noted that before training the network intrusion detection model, the hyperparameters of the network intrusion detection model have been determined. The aforementioned hyperparameters include the number of convolutional layers and pooling layers in the multi-layer convolutional network, the number of convolutional kernels used in each convolutional layer and the length of the convolutional kernel, the splicing method of the target feature parameters, the number of network layers and the number of nodes in each layer of the post-processing network, the total number of cyclic training, the learning rate, the number of samples in batch training, etc.

[0145] S210: Construct an input tensor based on a sample data packet in the sample data set.

[0146] In a specific implementation, the sample data set used for model training can be a self-constructed data set or a general industry data set. Each sample in the sample data set includes feature data of a network data packet and a corresponding network intrusion type label.

[0147] In order to realize model training and model accuracy testing, the sample data set needs to be divided into a training sample set and a test sample set. Constructing the input tensor based on the sample data packets in the sample data set is to construct the input tensor based on the sample data packets in the training sample set.

[0148] To implement the operation of S210, first determine the training sample set in the sample data set. Assume that there are N samples and K+1 categories in the sample data set, where the 1st, 2nd, ..., Kth categories represent the 1st, 2nd, ..., Kth types of network intrusions, respectively, and the K+1th category represents no network intrusion. Randomly select t% of the samples in each category as training samples, and the remaining r% of the samples as test samples. Among them, t% = 1-r%. All training samples are randomly shuffled to obtain a training sample set, and all test samples are randomly shuffled to obtain a test sample set. The total number of training samples T contained in the training sample set is T = N × t%, and the total number of test samples contained in the test sample set is R = N × r%. In the specific implementation, the method of constructing an input tensor based on a sample data packet in the sample data set is the same as the method of constructing an input tensor based on a data packet to be detected in the previous text, and will not be repeated here.

[0149] S220: Process the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network.

[0150] S230: Concatenate the target feature tensors to obtain a fused feature tensor.

[0151] S240: Use a post-processing neural network to process the fused feature tensor to obtain a predicted network intrusion type.

[0152] The execution process of the corresponding steps of S220-S230 is the same as the operation process of S120-S140 in the previous text, and will not be repeated here. For details, please refer to the previous description. After using the post-processing neural network to process the fused feature tensor, a K+1-dimensional output vector can be obtained. The parameters of the K+1 output vector are the probabilities that the network intrusion detection model determines that the sample data packet includes the corresponding network intrusion type. At this time, the largest value among the K+1 probability values ​​is used as the predicted network intrusion type, and its probability data is used as the basis of the loss function.

[0153] S250: Training a multi-layer convolutional network and a post-processing neural network based on the predicted network intrusion type and the intrusion type label corresponding to the sample data packet.

[0154] After obtaining the predicted network intrusion type, the loss function can be determined based on the predicted network intrusion type and the intrusion type label corresponding to the sample data packet. After determining the loss function, error forward propagation can be performed based on the loss function to achieve training of the multi-layer convolutional network and the post-processing neural network network nodes.

[0155] In some embodiments of the present disclosure, the computing device may use cross entropy As the loss function. is the intrusion severity label corresponding to the sample data packet, and y is the predicted network intrusion type.

[0156] In a specific implementation, the aforementioned S210 - S250 may be executed cyclically until the number of training times reaches a set total number of cyclic training times.

[0157] After the network intrusion detection model training is completed, the network intrusion detection model can be tested using a test data set to determine the accuracy of the model. The method for testing the network intrusion detection model is the same as the steps of S210-S250 above, except that the loss function and parameter training do not need to be determined.

[0158] In addition to providing the aforementioned network intrusion detection method, the embodiment of the present disclosure also provides a network intrusion detection device 600 . Figure 6 FIG. 6 is a result diagram of the network intrusion detection device 600 provided in an embodiment of the present disclosure. Figure 6 As shown, the network intrusion detection device 600 includes an input tensor construction unit 601, a convolution processing unit 602, a splicing processing unit 603 and a post-processing unit 604.

[0159] The input tensor construction unit 601 is used to construct an input tensor based on the data packet to be detected in response to obtaining the data packet to be detected.

[0160] The convolution processing unit 602 is used to process the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network. ;

[0161] The splicing processing unit 603 is used to splice the target feature tensors to obtain a fused feature tensor.

[0162] The post-processing unit 604 is used to process the fused feature tensor using a post-processing neural network to determine the network intrusion type of the data packet to be detected.

[0163] The aforementioned multi-layer convolutional network and post-processing neural network are trained simultaneously.

[0164] Before using the subsequent convolution layer to process the previous feature tensor output by the previous convolution layer, the convolution processing unit 602 pads the edge of the previous feature tensor based on the length of the corresponding convolution kernel in the first dimension, the moving step size and the length of the previous feature tensor in the first dimension to obtain a padding tensor; the padding tensor is processed by the subsequent convolution layer to obtain a subsequent feature tensor, so that the subsequent feature tensor has the same length as the previous feature tensor in the first dimension. Correspondingly, the splicing processing unit 603 splices the target feature tensor in the second dimension to obtain a fused feature tensor.

[0165] In some embodiments, the multi-layer convolutional network also includes a pooling layer located after the target convolutional layer, and the pooling layer is used to perform pooling processing on the feature tensor output by the target convolutional layer in the first dimension; after obtaining the feature tensor output by the target convolutional layer, the convolution processing unit 602 uses the pooling layer to process the feature tensor to obtain a pooling tensor; when the target convolutional layer is not the terminal convolutional layer of the multi-layer convolutional network, the convolution processing unit 602 fills the edges of the pooling tensor based on the length of the corresponding convolution kernel in the first dimension, the moving step size and the length of the pooling tensor in the first dimension to obtain a filling tensor.

[0166] In some embodiments, the post-feature tensor and the pooling tensor have the same length in the first dimension; when the target feature tensor output by the target convolution layer is pooled by the pooling layer, the splicing processing unit 603 uses the pooling tensor to replace the corresponding target feature tensor and splices it with other target feature tensors to obtain a fused feature tensor.

[0167] In some embodiments, the data packet to be detected is a data packet sent to a target host and a target service. The network intrusion detection device 600 also includes a data acquisition unit. The data acquisition unit acquires traffic statistics characteristics of the target host and / or the target service; the input tensor construction unit 601 acquires the header data characteristics and content characteristics of the data packet to be detected, and then constructs the input tensor based on the header data characteristics, content characteristics and traffic statistics characteristics.

[0168] In some embodiments, the post-processing neural network includes a channel attention mechanism module and a type output module; the post-processing unit 604 uses the channel attention mechanism module to process the fused feature tensor to obtain a modified fused feature tensor; then the type output module is used to process the modified fused feature tensor to determine the network intrusion type of the data packet to be detected.

[0169] In some embodiments, the channel attention mechanism module includes a multi-layer perceptron; the post-processing unit 604 first determines the pooling value of the fused feature tensor at each position of the second dimension; concatenates the pooling values ​​to obtain a pooling vector; uses a multi-layer perceptron to process the pooling vector to obtain an attention vector; and uses the attention vector to correct the fused feature tensor to obtain a corrected fused feature tensor.

[0170] The disclosed embodiment also provides a network intrusion detection model training device. Figure 7 7 , the network intrusion detection model training device 700 includes an input tensor construction unit 701 , a convolution processing unit 702 , a splicing processing unit 703 , a post-processing unit 704 and a network training unit 705 .

[0171] The input tensor construction unit 701 is used to construct an input tensor based on the data packet to be detected in response to obtaining the data packet to be detected.

[0172] The convolution processing unit 702 is used to process the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network.

[0173] The splicing processing unit 703 is used to splice the target feature tensors to obtain a fused feature tensor.

[0174] The post-processing unit 704 is used to process the fused feature tensor using a post-processing neural network to determine the network intrusion type of the data packet to be detected.

[0175] The network training unit 705 is used to train the multi-layer convolutional network and the post-processing neural network based on the predicted network intrusion type and the intrusion type label corresponding to the sample data packet.

[0176] During the specific training process, the execution process of the input tensor construction unit 701, the convolution processing unit 702, the splicing processing unit 703 and the post-processing unit 704 is the same as the processing process of the corresponding devices in the previous network intrusion detection device, and will not be analyzed here.

[0177] The embodiment of the present disclosure also provides a computing device for implementing the aforementioned method. Figure 8 Schematic diagram of the structure of the computing device provided by the embodiment of the present disclosure. Figure 8 , which shows a schematic diagram of the structure of a computing device 800 suitable for implementing the embodiments of the present disclosure. Figure 8 The computing device shown is only an example and should not bring any limitation to the functionality and scope of use of the embodiments of the present disclosure.

[0178] like Figure 8As shown, the computing device 800 may include a processing device (e.g., a central processing unit, a graphics processing unit, etc.) 801, which can perform various appropriate actions and processes according to a program stored in a read-only memory ROM 802 or a program loaded from a storage device 808 to a random access memory RAM 803. Various programs and data required for the operation of the computing device 800 are also stored in the RAM 803. The processing device 801, the ROM 802, and the RAM 803 are connected to each other via a bus 804. An input / output I / O interface 805 is also connected to the bus 804.

[0179] Typically, the following devices may be connected to the I / O interface 805: input devices 805 including, for example, a touch screen, a touch pad, a camera, a microphone, etc.; output devices 807 including, for example, a liquid crystal display (LCD), a speaker, a vibrator, etc.; storage devices 808 including, for example, a magnetic tape, a hard disk, etc.; and communication devices 809. The communication devices 809 may allow the computing device 800 to communicate with other devices wirelessly or by wire to exchange data. Although Figure 8 The computing device 800 is shown with various devices, but it should be understood that it is not required to implement or have all of the devices shown. More or fewer devices may be implemented or have instead.

[0180] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a non-transitory computer-readable medium, and the computer program contains program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device 809, or installed from a storage device 808, or installed from a ROM 802. When the computer program is executed by the processing device 801, the above-mentioned functions defined in the method of the embodiment of the present disclosure are executed.

[0181] It should be noted that the computer-readable medium mentioned above in the present disclosure may be a computer-readable storage medium, a computer-readable signal medium, or any combination of the above two.

[0182] The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus or device, or any combination thereof. More specific examples of computer-readable storage media may include, but are not limited to, an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0183] Computer readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer readable program codes. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than a computer readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, device, or device. The program code contained on the computer readable medium may be transmitted using any suitable medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0184] In some embodiments, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperText Transfer Protocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an ad hoc peer-to-peer network), as well as any currently known or future developed network.

[0185] The computer-readable medium may be included in the computing device, or may exist independently without being incorporated into the computing device.

[0186] Computer program code for performing the operations of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including but not limited to object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the tester computer, partially on the tester computer, as a separate software package, partially on the tester computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving a remote computer, the remote computer may be connected to the tester computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., through the Internet using an Internet service provider).

[0187] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated system based on hardware that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0188] The units involved in the embodiments described in the present disclosure may be implemented by software or by hardware. The name of the unit does not, in some cases, constitute a limitation on the unit itself. The functions described above herein may be performed at least in part by one or more hardware logic components. For example, without limitation, exemplary types of hardware logic components that may be used include: field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), and the like.

[0189] The above are only specific embodiments of the present disclosure, so that those skilled in the art can understand or implement the present disclosure. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present disclosure. Therefore, the present disclosure will not be limited to the embodiments described herein, but will conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A network intrusion detection method, characterized in that: include: In response to obtaining a data packet to be detected, constructing an input tensor based on the data packet to be detected; A multi-layer convolutional network is used to process the input tensor to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network; wherein each convolutional layer of the multi-layer convolutional network includes a plurality of convolutional kernels of the same dimension and the same length of the corresponding dimension, the length of the kernel function of the rear convolutional layer in the second dimension is the number of convolutional kernels of the directly preceding convolutional layer, the moving step length in the second dimension is 0, and the moving step length in the first dimension where the convolutional kernel length in the rear convolutional layer exceeds 1 is 1; before the rear convolutional layer is used to process the preceding feature tensor output by the preceding convolutional layer, the edge of the preceding feature tensor is padded based on the length of the corresponding convolutional kernel in the first dimension, the moving step length, and the length of the preceding feature tensor in the first dimension to obtain a padded tensor; the rear convolutional layer is used to process the padded tensor to obtain the rear feature tensor, so that the rear feature tensor has the same length as the preceding feature tensor in each first dimension; Splicing the target feature tensors to obtain a fused feature tensor, including: splicing the target feature tensors in a second dimension to obtain the fused feature tensor; A post-processing neural network is used to process the fused feature tensor to determine the network intrusion type of the data packet to be detected; the post-processing neural network includes a channel attention mechanism module and a type output module, and the channel attention mechanism module includes a maximization multi-layer perceptron and / or an averaging multi-layer perceptron; The adopting of a post-processing neural network to process the fused feature tensor to determine the network intrusion type of the data packet to be detected includes: determining the pooling value of the fused feature tensor at each position of the second dimension, including: determining the maximum pooling value and / or the average pooling value of the fused feature tensor at each position of the second dimension; Splicing the pooling values ​​to obtain a pooling vector includes: splicing the maximum pooling values ​​to obtain a maximum pooling vector, and / or splicing the average pooling values ​​to obtain an average pooling vector; Using the multi-layer perceptron to process the pooling vector to obtain an attention vector includes: using a maximization multi-layer perceptron to process the maximum pooling vector to obtain a first attention vector, and / or using an averaging multi-layer perceptron to process the average pooling vector to obtain a second attention vector; The fused feature tensor is corrected by using an attention vector to obtain a corrected fused feature tensor, including: multiplying the fused feature tensor with a first attention vector to obtain a first corrected feature tensor, and / or multiplying the fused feature tensor with a second attention vector to obtain a second corrected feature tensor; and The first corrected feature tensor and the second corrected feature tensor are used as a corrected fused feature tensor, or the first corrected feature tensor and the second corrected feature tensor are concatenated to obtain a corrected fused feature tensor; The type output module is used to process the modified fused feature tensor to determine the network intrusion type of the data packet to be detected; Wherein, the node parameters of the multi-layer convolutional network and the post-processing neural network are trained simultaneously.

2. The detection method according to claim 1, characterized in that: The multi-layer convolutional network also includes a pooling layer located after the target convolutional layer, and the pooling layer is used to perform pooling processing on the feature tensor output by the target convolutional layer in the first dimension; The adopting a multi-layer convolutional network to process the input tensor comprises: After obtaining the feature tensor output by the target convolution layer, the feature tensor is processed by the pooling layer to obtain a pooling tensor; The step of filling the edge of the previous feature tensor based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the previous feature tensor in the first dimension to obtain a filling tensor includes: When the target convolution layer is not the terminal convolution layer of the multi-layer convolutional network, the edge of the pooling tensor is padded based on the length of the corresponding convolution kernel in the first dimension, the moving step size, and the length of the pooling tensor in the first dimension to obtain a padded tensor.

3. The detection method according to claim 2, characterized in that: The subsequent feature tensor has the same length as the preceding feature tensor in the first dimension, including: the subsequent feature tensor has the same length as the pooling tensor in the first dimension; The step of splicing the target feature tensor in the second dimension to obtain the fused feature tensor includes: When the target feature tensor output by the target convolution layer is pooled by the pooling layer, the pooling tensor is used to replace the corresponding target feature tensor and is concatenated with other target feature tensors to obtain the fused feature tensor.

4. The detection method according to claim 1, characterized in that: The data packet to be detected is a data packet sent to the target host and the target service; The method further comprises: obtaining traffic statistics characteristics of the target host and / or the target service; The constructing of the input tensor based on the data packet to be detected includes: obtaining header data features and content features of the data packet to be detected; The input tensor is constructed based on the packet header data feature, the content feature and the traffic statistical feature.

5. A training method for a network intrusion detection model, characterized in that: The network intrusion detection model includes a multi-layer convolutional network and a post-processing neural network; the training method includes: Construct input tensors based on sample packets in the sample dataset; A multi-layer convolutional network is used to process the input tensor to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network; wherein each convolutional layer of the multi-layer convolutional network includes a plurality of convolutional kernels of the same dimension and the same length of the corresponding dimension, the length of the kernel function of the rear convolutional layer in the second dimension is the number of convolutional kernels of the directly preceding convolutional layer, the moving step length in the second dimension is 0, and the moving step length in the first dimension where the convolutional kernel length in the rear convolutional layer exceeds 1 is 1; before the rear convolutional layer is used to process the preceding feature tensor output by the preceding convolutional layer, the edge of the preceding feature tensor is padded based on the length of the corresponding convolutional kernel in the first dimension, the moving step length, and the length of the preceding feature tensor in the first dimension to obtain a padded tensor; the rear convolutional layer is used to process the padded tensor to obtain a rear feature tensor, so that the rear feature tensor has the same length as the preceding feature tensor in the first dimension; Splicing the target feature tensors to obtain a fused feature tensor, including: splicing the target feature tensors in a second dimension to obtain the fused feature tensor A post-processing neural network is used to process the fused feature tensor to determine the predicted network intrusion type of the sample data packet; the post-processing neural network includes a channel attention mechanism module and a type output module, and the channel attention mechanism module includes a maximization multi-layer perceptron and / or an averaging multi-layer perceptron; The adopting a post-processing neural network to process the fused feature tensor to determine the predicted network intrusion type of the sample data packet includes: Determining the pooling value of the fused feature tensor at each position in the second dimension includes: determining the maximum pooling value and / or the average pooling value of the fused feature tensor at each position in the second dimension; Splicing the pooling values ​​to obtain a pooling vector includes: splicing the maximum pooling values ​​to obtain a maximum pooling vector, and / or splicing the average pooling values ​​to obtain an average pooling vector; Using the multi-layer perceptron to process the pooling vector to obtain an attention vector includes: using a maximization multi-layer perceptron to process the maximum pooling vector to obtain a first attention vector, and / or using an averaging multi-layer perceptron to process the average pooling vector to obtain a second attention vector; The fused feature tensor is corrected by using an attention vector to obtain a corrected fused feature tensor, including: multiplying the fused feature tensor with a first attention vector to obtain a first corrected feature tensor, and / or multiplying the fused feature tensor with a second attention vector to obtain a second corrected feature tensor; using the first corrected feature tensor and the second corrected feature tensor as a fused feature tensor, or concatenating the first corrected feature tensor and the second corrected feature tensor to obtain a corrected fused feature tensor; Processing the modified fused feature tensor using the type output module to determine the predicted network intrusion type of the sample data packet; The multi-layer convolutional network and the post-processing neural network are trained based on the predicted network intrusion type and the intrusion type label corresponding to the sample data packet.

6. A network intrusion detection device, characterized in that: include: An input tensor construction unit, configured to construct an input tensor based on the data packet to be detected in response to obtaining the data packet to be detected; A convolution processing unit, configured to process the input tensor using a multi-layer convolutional network to obtain a target feature tensor output by at least two convolutional layers in the multi-layer convolutional network; wherein each convolutional layer of the multi-layer convolutional network includes a plurality of convolutional kernels of the same dimension and the same length of the corresponding dimension, the length of the kernel function of the subsequent convolutional layer in the second dimension is the number of convolutional kernels of the directly preceding convolutional layer, the moving step length in the second dimension is 0, and the moving step length in the first dimension where the convolutional kernel length in the subsequent convolutional layer exceeds 1 is 1; before using the subsequent convolutional layer to process the preceding feature tensor output by the preceding convolutional layer, the edge of the preceding feature tensor is padded based on the length of the corresponding convolutional kernel in the first dimension, the moving step length, and the length of the preceding feature tensor in the first dimension to obtain a padded tensor; and the subsequent convolutional layer is used to process the padded tensor to obtain a subsequent feature tensor, so that the subsequent feature tensor has the same length as the preceding feature tensor in the first dimension; A splicing processing unit, used for splicing the target feature tensors to obtain a fused feature tensor, comprising: splicing the target feature tensors in a second dimension to obtain the fused feature tensor; A post-processing unit, used to process the fused feature tensor using a post-processing neural network to determine the network intrusion type of the data packet to be detected; The post-processing neural network includes a channel attention mechanism module and a type output module, and the channel attention mechanism module includes a maximization multi-layer perceptron and / or an averaging multi-layer perceptron; The adopting a post-processing neural network to process the fused feature tensor to determine the network intrusion type of the data packet to be detected includes: Determining the pooling value of the fused feature tensor at each position in the second dimension includes: determining the maximum pooling value and / or the average pooling value of the fused feature tensor at each position in the second dimension; Splicing the pooling values ​​to obtain a pooling vector includes: splicing the maximum pooling values ​​to obtain a maximum pooling vector, and / or splicing the average pooling values ​​to obtain an average pooling vector; Using the multi-layer perceptron to process the pooling vector to obtain an attention vector includes: using a maximization multi-layer perceptron to process the maximum pooling vector to obtain a first attention vector, and / or using an averaging multi-layer perceptron to process the average pooling vector to obtain a second attention vector; The fused feature tensor is corrected by using an attention vector to obtain a corrected fused feature tensor, including: multiplying the fused feature tensor by a first attention vector to obtain a first corrected feature tensor, and / or multiplying the fused feature tensor by a second attention vector to obtain a second corrected feature tensor; and using the first corrected feature tensor and the second corrected feature tensor as a fused feature tensor, or concatenating the first corrected feature tensor and the second corrected feature tensor to obtain a corrected fused feature tensor; The type output module is used to process the modified fused feature tensor to determine the network intrusion type of the data packet to be detected; Wherein, the multi-layer convolutional network and the post-processing neural network are trained simultaneously.

7. A computing device, characterized in that It comprises a processor and a memory, wherein the memory is used to store a computer program; when the computer program is loaded by the processor, the processor executes the network intrusion detection method or the network intrusion detection model training method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by the processor, the processor implements the network intrusion detection method or the network intrusion detection model training method as described in any one of claims 1 to 5.

Images