Network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection

Abstract

The invention discloses a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection, comprising: step S1, obtaining an intrusion detection data set, and preprocessing the intrusion detection data set; step S2, unbalanced processing of the data set by using the Balanced WCGAN-GP model; step S3, improving the AOA algorithm by using the mRMR algorithm strategy, Sigmoid transfer function, Lévy flight and Macro F1 score weighted fitness function, forming an IBAOA model, and screening out key features in the data set; step S4, inputting the screened feature combination into a network intrusion detection classification model, and optimizing the parameters of the network intrusion detection classification model by using the TPE optimization algorithm, and performing the final intrusion detection and classification. The method solves the data imbalance problem in the traditional network intrusion detection data set, and realizes the multi-class classification task.

Description

Technical Field

[0001] The present invention relates to a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection. Background Art

[0002] With the widespread popularity of Internet services, service providers and users are facing increasingly severe challenges in system security protection, especially in dealing with new types of attacks and sabotage. Network intrusion detection systems identify potential threats by analyzing network packets. However, when dealing with datasets with severe feature redundancy and class imbalance, improving the prediction accuracy of intrusion detection has become a key issue that needs to be addressed. In addition, most existing machine learning-based intrusion detection models often suffer from poor training results due to data imbalance and feature redundancy, which in turn affects detection accuracy and faces high complexity in feature selection optimization.

[0003] To solve the above problems, a network intrusion detection method which integrates Balanced WCGAN-GP (Improved Conditional Generative Adversarial Network) and IBAOA (Improved Binary Algorithm Optimization Algorithm) feature selection is provided. Summary of the invention

[0004] The purpose of the present invention is to overcome the existing defects and provide a network intrusion detection method that integrates Balanced WCGAN-GP and IBAOA feature selection, solves the data imbalance problem in traditional network intrusion detection data sets, and realizes multi-class classification tasks.

[0005] The technical solution to achieve the above purpose is:

[0006] The network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection includes:

[0007] Step S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set;

[0008] Step S2, using the Balanced WCGAN-GP model to process the imbalanced data set;

[0009] Step S3, improving the AOA algorithm through the mRMR algorithm strategy, Sigmoid transfer function, Lévy flight and Macro F1 score weighted fitness function to form an IBAOA model and screen out key features in the data set;

[0010] In step S4, the selected feature combination is input into the network intrusion detection classification model, and the parameters of the network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

[0011] Preferably, in step S1, the intrusion detection data set adopts NSL-KDD and CICDDoS2019, including relevant data of attack categories and normal traffic.

[0012] Preferably, in step S1, the preprocessing method includes null value processing, label encoding and maximum-minimum value scaling;

[0013] Among them, null value processing is to clean and filter data by removing missing values ​​and irrelevant parameters;

[0014] Label encoding is to encode the labels of all categorical features except the last one before applying normalization techniques;

[0015] After label encoding, the minimum-maximum normalization technique is applied to the obtained output to scale the value range of each feature to the [0,1] interval. The conversion formula is:

[0016] ;

[0017] In the formula, and are the minimum and maximum values ​​of the eigenvectors, respectively. and are the original value and normalized value of the feature sample respectively.

[0018] Preferably, in step S2, WCGAN introduces conditional information into the input of the generator and the discriminator. The discriminator not only needs to distinguish between generated data and real data, but also needs to determine whether the data is consistent with the given conditional information. That is, the objective function of CGAN is as follows:

[0019] ;

[0020] In the formula, and are the outputs of the discriminator and the generator, respectively. and are real samples and noise respectively, and They represent the expected values ​​of the real sample distribution and the noise distribution respectively, is conditional information;

[0021] The Wasserstein distance is introduced into WCGAN to replace the JS divergence in it, which is used to measure the To another distribution The minimum cost is as follows:

[0022] ;

[0023] In the formula, represents the lower bound of a set, Representation distribution The set of joint distributions of all possible combinations, for each possible joint distribution , calculate the sampling from of Distance Expectations , all different joint distributions The expected minimum value in the distribution is Wasserstein distance;

[0024] The Lipschitz constraint condition is used in the model, and its continuity theorem limits the maximum local change of the continuous function. The formula is as follows:

[0025] ;

[0026] In the formula, and Respectively represent functions In the input value and The function value at is the Lipschitz constant, which represents the function The maximum rate of change within the domain;

[0027] Then, the objective function of the WCGAN model is as follows:

[0028] ;

[0029] When dealing with Lipschitz distribution, weight clipping can easily lead to gradient vanishing or even gradient explosion. Introducing gradient penalty GP in the total loss function can form a WCGAN-GP network, making the training more stable. The objective function of WCGAN-GP is:

[0030] ;

[0031] ;

[0032] In the formula, is the penalty term coefficient, and Generate data for real data and generator respectively, is a random number that follows a uniform distribution on [0,1]. for The expected function of For the general The second norm of the gradient after entering the discriminator;

[0033] The inverse proportional weight idea is introduced to improve the objective function of WCGAN-GP to form the Balanced WCGAN-GP model. The weight in the loss function is adjusted according to the sample size of each category, so that the objective function pays more attention to the category with a small sample size during the optimization process. The improved objective function Such as:

[0034] ;

[0035] In the formula, is the total number of categories, For Category The inverse proportional weight is:

[0036] ;

[0037] In the formula, Yes Category The number of samples, the category with fewer sample numbers will have a higher weight, which will prompt the generator to pay more attention to these minority categories. At this time, the discriminator loss and the generator loss They are as follows:

[0038] ;

[0039] .

[0040] Preferably, in step S3, the population of AOA is initialized by the mRMR algorithm strategy, firstly, the correlation between the features and the labels and the redundancy between the features are calculated, and then the features with the maximum correlation and the minimum redundancy are selected by calculating the mRMR value and sorting the features, wherein the correlation between the features and the labels is calculated, and the formula is as follows:

[0041] ;

[0042] In the formula, Representative feature set With category The correlation between the various features and categories The mean of all mutual information values ​​between is defined as Represents the mutual information value of a single feature and a category, which is calculated as follows:

[0043] ;

[0044] In the formula, are two random variables, yes and The joint probability density function of and They are and The marginal probability density function of ;

[0045] The redundancy between features is calculated as follows:

[0046] ;

[0047] In order to eliminate redundant features and screen out feature sets with high correlation and low redundancy, by calculating the difference, features with greater correlation and smaller redundancy will obtain higher mRMR values. The formula is as follows:

[0048] ;

[0049] Sort the features to get the ranking of each feature ;

[0050] Ensure that the population has good coverage and initial solution quality during feature selection, and rank the features according to their mRMR values ​​in the dataset With the total number of features , set the selected The range of features is as follows:

[0051] ;

[0052] In the formula, Indicates rounding up. Indicates rounding down;

[0053] The values ​​are evenly distributed within a certain range, generating A collection of values, where each The value corresponds to a population individual, The value is generated by the following formula:

[0054] ;

[0055] In the formula, Indicates The number of characteristics of a population, that is, The population contains the mRMR value ranking forward The characteristics of is the total number of populations initialized by the AOA algorithm, is the index of the current population, ranging from 0 to .

[0056] Preferably, in step S3, in order to effectively map the continuous search space to the discrete search space, a Sigmoid transfer function is used to convert the AOA into a binary form, and the formula is as follows:

[0057] ;

[0058] In the formula, It means that in the iteration Secondary time dimension To map the position in the discrete space, the corresponding update formula is as follows:

[0059] .

[0060] Preferably, in step S3, Lévy flight is used to solve the problem that AOA may also fall into the local optimum value during the search process. The Lévy step length expression is as follows:

[0061] ;

[0062] In the formula, and is a variable that follows a normal distribution, that is, , , , Defined as:

[0063] ;

[0064] In the formula, is the standard gamma function, The value range is [0, 2];

[0065] Introducing Lévy flight into the survey phase of AOA to enhance its global search capability and ability to escape local optimality, and improve position update The formula is:

[0066] ;

[0067] In the formula, Indicates The solution The update of the position in the next iteration, is the best solution obtained so far. Locations, is a very small number. and Respectively represent The upper and lower bounds of the positions, is the control parameter, set to 0.5, is a random number, It is a scaling factor used to adjust the influence range of the Lévy flight step, and is usually taken as a small value of 0.01.

[0068] Preferably, in step S3, the Macro F1 score is introduced as an indicator of classification performance, and the fitness function is constructed in combination with the number of features to achieve the dual goals of feature selection, reducing the number of features and improving classification performance. The corresponding fitness function is expressed as follows:

[0069] ;

[0070] In the formula, is the number of features in the dataset, is the number of features selected, It is used to adjust the strength of the selected features. The setting range is [0, 1]. Compared with the compressed features, the purpose is to find the feature combination with the best generalization performance. is 0.01, is the number of classification categories, The calculation formula is as follows:

[0071] ;

[0072] In the formula, The model is The F1 score of each category is calculated as follows:

[0073] ;

[0074] In the formula, Representative The accuracy of each category, Representative The recall rate of each category.

[0075] Preferably, in step S4, the network intrusion detection classification model is constructed as a new feature set by the best features screened by the IBAOA method, and then these features are classified by the XGBoost classifier with a regularized loss function, wherein the XGBoost classifier training process includes two stages: regularization and boosting;

[0076] Regularization phase:

[0077] Suppose the network intrusion detection data feature set is ; Total samples, is the feature space, data subset The corresponding label is ,therefore The final prediction result of a regression tree is as follows:

[0078] ;

[0079] In the formula, , is the set of all regression trees, For the tree structure, is the number of leaf nodes in the tree;

[0080] In order to control the complexity of the model and prevent overfitting, a regularization term is introduced , and further get the expression of the objective function (O):

[0081] ;

[0082] In the formula, ;

[0083] For the The true label corresponding to each sample is is the loss function, and is the penalty term coefficient, For the The weight of a leaf node;

[0084] Promotion stage:

[0085] set up For the Samples in The predicted value at the iteration is added using the forward step-by-step addition algorithm. To learn new functions in the model, the objective function is converted to:

[0086] ;

[0087] Further Perform a second-order Taylor expansion, and the second-order approximate optimization of the objective function is:

[0088] ;

[0089] In the formula, , is the first-order derivative of the loss function, , is the second-order derivative of the loss function. After removing the constant term, the formula is as follows:

[0090] ;

[0091] For a fixed tree structure, the leaves The optimal weight calculation formula is:

[0092] ;

[0093] The corresponding optimal value calculation formula is:

[0094] ;

[0095] In the formula, is the target score of the tree. The smaller the value, the better. Use the greedy algorithm to iteratively add branches to the tree starting from the root node of the tree, gradually build the whole tree, enumerate the feasible split points, and select The segmentation point when the loss function is minimized and the loss function is reduced to the maximum is taken as the partition point. and is the sample set of the left and right nodes after splitting, let , then the loss function after splitting is reduced As shown below:

[0096] .

[0097] Preferably, in step S4, the specific steps of optimizing the network intrusion detection classification model structure and parameters by the TPE optimization algorithm are as follows:

[0098] Import the original data, set the classifier structure and hyperparameter range, and randomly generate a set of initialization parameter combinations;

[0099] Perform TPE probability density estimation, calculate the EI value through the sampling function, and select the next parameter combination to be evaluated based on the previously sampled EI value;

[0100] The parameter combination with the maximum EI value is input into the classifier for training, and the model prediction results under the current hyperparameters are output;

[0101] If the error of the newly selected parameter combination meets the accuracy requirements, the algorithm execution is terminated and the corresponding parameter combination and model prediction error are output;

[0102] If the accuracy requirement is not met, the sampling function is modified and the TPE probability density estimation is performed again until the set number of iterations is met;

[0103] Among them, through and Modeling is performed instead of A single modeling represents the distribution of solutions, Represents the parameters when the solution is known The distribution of to guide the search of the configuration space, The calculation of is as follows:

[0104] ;

[0105] In the formula, is a defined threshold. Represents the observed value The loss function is Small density estimates, Represents the observed value The loss function is Large density composition;

[0106] The definition is as follows:

[0107] ;

[0108] Through conversion , and construct the function :

[0109] ;

[0110] That is, in maximizing In the process of finding better hyperparameters, It should be gradually iterated to make Smaller values, that is, closer to the maximum probability and the minimum probability .

[0111] The beneficial effects of the present invention are as follows: the Balanced WCGAN-GP proposed in the present invention optimizes the loss function of WCGAN-GP by introducing inverse proportional weights, effectively overcomes the shortcomings of traditional conditional generative adversarial networks in generating minority class data, and significantly improves the quality of generated data; the improved binary arithmetic optimization algorithm enables the traditional arithmetic optimization algorithm to be applied to feature selection through the Sigmoid transfer function, and uses the mRMR initialization strategy to generate a better initial feature subset; the risk of the algorithm falling into local optimality is alleviated through the Lévy flight strategy, and the fitness function is adjusted to make it more suitable for data with imbalanced categories, and finally the optimal feature combination is extracted in fewer iterations; finally, the regularized XGBoost classifier further optimized by the TPE algorithm is combined to achieve accurate and robust classification of intrusion patterns. BRIEF DESCRIPTION OF THE DRAWINGS

[0112] Figure 1 It is a flow chart of a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection in the present invention;

[0113] Figure 2It is a schematic diagram of the generator loss and discriminator loss after the balanced WCGAN-GP is used to process the NSL-KDD dataset in category data imbalance in the present invention;

[0114] Figure 3 This is a schematic diagram of the generator loss and discriminator loss after the CICDDoS2019 dataset is processed for category data imbalance using Balanced WCGAN-GP in the present invention. DETAILED DESCRIPTION

[0115] The technical solution of the present invention will be described clearly and completely below in conjunction with the accompanying drawings. In the description of the present invention, it should be noted that the terms "center", "up", "down", "left", "right", "vertical", "horizontal", "inside", "outside" and the like indicate directions or positional relationships based on the directions or positional relationships shown in the accompanying drawings, which are only for the convenience of describing the present invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as a limitation on the present invention. In addition, the terms "first", "second", and "third" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0116] The present invention will be further described below in conjunction with the accompanying drawings.

[0117] like Figure 1 As shown in FIG. 1 , the network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection includes:

[0118] Step S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set.

[0119] In the embodiment, the intrusion detection dataset adopts NSL-KDD and CICDDoS2019, including relevant data of attack categories and normal traffic.

[0120] In the embodiment, the preprocessing method includes null value processing, label encoding and maximum-minimum value scaling; wherein, null value processing is to clean and filter data by deleting missing values ​​and irrelevant parameters; label encoding is to perform label encoding on all classification features except the last feature before applying the normalization technology; maximum-minimum value scaling is to apply the minimum-maximum normalization technology to the obtained output after label encoding to scale the value range of each feature to the [0,1] interval, and the conversion formula is:

[0121] ;

[0122] In the formula, and are the minimum and maximum values ​​of the eigenvectors, respectively. and are the original value and normalized value of the feature sample respectively.

[0123] Step S2: Use the Balanced WCGAN-GP model to perform imbalance processing on the dataset.

[0124] In the embodiment, WCGAN introduces conditional information into the input of the generator and the discriminator. The discriminator not only needs to distinguish between generated data and real data, but also needs to determine whether the data is consistent with the given conditional information. That is, the objective function of CGAN is as follows:

[0125] ;

[0126] In the formula, and are the outputs of the discriminator and the generator, respectively. and are real samples and noise respectively, and They represent the expected values ​​of the real sample distribution and the noise distribution respectively, is conditional information;

[0127] The Wasserstein distance is introduced into WCGAN to replace the JS divergence in it, which is used to measure the To another distribution The minimum cost is as follows:

[0128] ;

[0129] In the formula, represents the lower bound of a set, Representation distribution The set of joint distributions of all possible combinations, for each possible joint distribution , calculate the sampling from of Distance Expectations , all different joint distributions The expected minimum value in the distribution is Wasserstein distance;

[0130] The Lipschitz constraint condition is used in the model, and its continuity theorem limits the maximum local change of the continuous function. The formula is as follows:

[0131] ;

[0132] In the formula, and Respectively represent functions In the input value and The function value at is the Lipschitz constant, which represents the function The maximum rate of change within the domain;

[0133] Then, the objective function of the WCGAN model is as follows:

[0134] ;

[0135] When dealing with Lipschitz distribution, weight clipping can easily lead to gradient vanishing or even gradient explosion. Introducing gradient penalty GP in the total loss function can form a WCGAN-GP network, making the training more stable. The objective function of WCGAN-GP is:

[0136] ;

[0137] ;

[0138] In the formula, is the penalty term coefficient, and Generate data for real data and generator respectively, is a random number that follows a uniform distribution on [0,1]. for The expected function of For the general The second norm of the gradient after entering the discriminator;

[0139] The inverse proportional weight idea is introduced to improve the objective function of WCGAN-GP to form the Balanced WCGAN-GP model. The weight in the loss function is adjusted according to the sample size of each category, so that the objective function pays more attention to the category with a small sample size during the optimization process. The improved objective function Such as:

[0140] ;

[0141] In the formula, is the total number of categories, For Category The inverse proportional weight is:

[0142] ;

[0143] In the formula, Yes Category The number of samples, the category with fewer sample numbers will have a higher weight, which will prompt the generator to pay more attention to these minority categories. At this time, the discriminator loss and the generator loss They are as follows:

[0144] ;

[0145] .

[0146] The Balanced WCGAN-GP model is used to process the imbalanced category data of the NSL-KDD and CICDDoS2019 datasets, and the generator loss and discriminator loss on the NSL-KDD and CICDDoS2019 datasets are obtained as follows: Figure 2 , 3 Compared with the baseline WCGAN-GP, the Balanced WCGAN-GP model proposed in this invention pays more attention to the generation of a small number of categories and can effectively generate high-quality samples of a small number of categories.

[0147] In step S3, the AOA algorithm is improved by using the mRMR algorithm strategy, Sigmoid transfer function, Lévy flight and Macro F1 score weighted fitness function to form an IBAOA model and screen out the key features in the data set.

[0148] In the embodiment, AOA is inspired by basic arithmetic operators, namely addition, subtraction, multiplication and division. The search process of AOA is divided into three stages, initialization stage: In AOA, the optimization process in the initialization stage starts with a set of randomly generated candidate solutions, as shown in the following formula. In each iteration, the best candidate solution is regarded as the optimal solution or the near-optimal solution obtained so far.

[0149] ;

[0150] In the formula, is the population size, For dimension.

[0151] Before the arithmetic optimization algorithm starts searching, it is necessary to select the next search phase, namely the exploration phase or the development phase. To this end, the mathematical optimization accelerator (MOA) is introduced, and its mathematical expression is as follows:

[0152] ;

[0153] In the formula, Indicates The function value of the iteration, Indicates the current iteration number, represents the maximum number of iterations, and Respectively represent the minimum and maximum values ​​of the acceleration function;

[0154] Using MOA and random numbers To determine the entry into the exploration stage and development stage, the specific expression is as follows:

[0155] ;

[0156] when , it enters the exploration phase, during which multiplication and division operators are executed; otherwise, it enters the development phase, during which addition and subtraction operators are executed.

[0157] Exploration phase: In the exploration phase, whether using the division operator or the multiplication operator, the mathematical calculations of the arithmetic operators can obtain higher distribution values, which are dedicated to the exploration search mechanism. However, unlike the subtraction operator and the addition operator, the division operator and the multiplication operator are not so easy to approach the target because of their high-dimensional dispersion. Therefore, after several iterations, the exploration phase has the possibility of finding a solution close to the optimal one.

[0158] It is worth noting that in order to generate diverse solutions and explore different regions of the search space, random scaling coefficients are considered and simple rules that mimic the behavior of arithmetic operators are adopted. The mathematical expression of the position update in the exploration phase is as follows:

[0159] ;

[0160] In the formula, Indicates The solution The update of the position in the next iteration, is the best solution obtained so far. Locations, is a very small number. and Respectively represent The upper and lower bounds of the positions, is the control parameter, set to 0.5, Is a random number.

[0161] The mathematical expression of the mathematical optimizer probability (MOP) is as follows:

[0162] ;

[0163] In the formula, Indicates The function value of the iteration, It is a sensitive parameter with a range of (0,10) and controls the search accuracy of the optimization process in the search phase.

[0164] Development phase: In this phase, addition and subtraction operators are used for optimization search. Due to the search mechanism of addition and subtraction operators, more concentrated solutions are easier to find. Unlike division and multiplication operators, addition and subtraction operators are easier to approach the target solution due to their low dispersion. After several iterations, the development phase can derive a closer optimal solution; in the arithmetic optimization algorithm, addition and subtraction operators deeply explore the search area and find better solutions based on addition and subtraction search strategies. The relevant expressions are as follows:

[0165] ;

[0166] In the formula, Following the uniform distribution of (0,1), when The subtraction operator is executed when the value is equal to 0, otherwise the addition operator is executed.

[0167] In the embodiment, the population of AOA is initialized by the mRMR algorithm strategy. First, the correlation between the features and the labels and the redundancy between the features are calculated. Then, the features with the maximum correlation and the minimum redundancy are selected by calculating the mRMR value and sorting the features. The correlation between the features and the labels is calculated, and the formula is as follows:

[0168] ;

[0169] In the formula, Representative feature set With category The correlation between the various features and categories The mean of all mutual information values ​​between is defined as Represents the mutual information value of a single feature and a category, which is calculated as follows:

[0170] ;

[0171] In the formula, are two random variables, yes and The joint probability density function of and They are and The marginal probability density function of ;

[0172] The redundancy between features is calculated as follows:

[0173] ;

[0174] In order to eliminate redundant features and screen out feature sets with high correlation and low redundancy, by calculating the difference, features with greater correlation and smaller redundancy will obtain higher mRMR values. The formula is as follows:

[0175] ;

[0176] Sort the features to get the ranking of each feature ;

[0177] Ensure that the population has good coverage and initial solution quality during feature selection, and rank the features according to their mRMR values ​​in the dataset With the total number of features , set the selected The range of features is as follows:

[0178] ;

[0179] In the formula, Indicates rounding up. Indicates rounding down;

[0180] The values ​​are evenly distributed within a certain range, generating A collection of values, where each The value corresponds to a population individual, The value is generated by the following formula:

[0181] ;

[0182] In the formula, Indicates The number of characteristics of a population, that is, The population contains the mRMR value ranking forward The characteristics of is the total number of populations initialized by the AOA algorithm, is the index of the current population, ranging from 0 to .

[0183] In the embodiment, in order to effectively map the continuous search space to the discrete search space, the Sigmoid transfer function is used to convert the AOA into a binary form, and the formula is as follows:

[0184] ;

[0185] In the formula, It means that in the iteration Secondary time dimension To map the position in the discrete space, the corresponding update formula is as follows:

[0186] .

[0187] In the embodiment, Lévy flight is used to solve the dilemma that AOA may also fall into a local optimum value during the search process. The Lévy step length expression is as follows:

[0188] ;

[0189] In the formula, and is a variable that follows a normal distribution, that is, , , , Defined as:

[0190] ;

[0191] In the formula, is the standard gamma function, The value range is [0, 2];

[0192] Introducing Lévy flight into the survey phase of AOA to enhance its global search capability and ability to escape local optimality, and improve position update The formula is:

[0193] ;

[0194] In the formula, Indicates The solution The update of the position in the next iteration, is the best solution obtained so far. Locations, is a very small number. and Respectively represent The upper and lower bounds of the positions, is the control parameter, set to 0.5, is a random number, It is a scaling factor used to adjust the influence range of the Lévy flight step, and is usually taken as a small value of 0.01.

[0195] In the embodiment, the Macro F1 score is introduced as an indicator of classification performance, and the fitness function is constructed in combination with the number of features to achieve the dual goals of feature selection, reducing the number of features and improving classification performance. The corresponding fitness function is expressed as follows:

[0196] ;

[0197] In the formula, is the number of features in the dataset, is the number of features selected, It is used to adjust the strength of the selected features. The setting range is [0, 1]. Compared with the compressed features, the purpose is to find the feature combination with the best generalization performance. is 0.01, is the number of classification categories, The calculation formula is as follows:

[0198] ;

[0199] In the formula, The model is The F1 score of each category is calculated as follows:

[0200] ;

[0201] In the formula, Representative The accuracy of each category, Representative The recall rate of each category.

[0202] Thanks to the mRMR initialization strategy, the IBAOA algorithm has found a better feature combination in the first epoch, which significantly improves the quality of the algorithm's initial solution and accelerates the algorithm's convergence to the global optimal solution. By observing the global optimal fitness value curve, it can be found that the Lévy flight strategy improves the AOA algorithm, allowing the AOA algorithm to search for global solutions at a faster speed.

[0203] In step S4, the selected feature combination is input into the network intrusion detection classification model, and the parameters of the network intrusion detection classification model are optimized using the TPE optimization algorithm to perform the final intrusion detection and classification.

[0204] In the embodiment, the network intrusion detection classification model is constructed by using the best features screened by the IBAOA method as a new feature set, and then the XGBoost classifier with a regularized loss function is used to classify these features, wherein the XGBoost classifier training process includes two stages: regularization and boosting;

[0205] Regularization phase:

[0206] Suppose the network intrusion detection data feature set is ; Total samples, is the feature space, data subset The corresponding label is ,therefore The final prediction result of a regression tree is as follows:

[0207] ;

[0208] In the formula, , is the set of all regression trees, For the tree structure, is the number of leaf nodes in the tree;

[0209] In order to control the complexity of the model and prevent overfitting, a regularization term is introduced , and further get the expression of the objective function (O):

[0210] ;

[0211] In the formula, ;

[0212] For the The true label corresponding to each sample is is the loss function, and is the penalty term coefficient, For the The weight of a leaf node;

[0213] Promotion stage:

[0214] set up For the Samples in The predicted value at the iteration is added using the forward step-by-step addition algorithm. To learn new functions in the model, the objective function is converted to:

[0215] ;

[0216] Further Perform a second-order Taylor expansion, and the second-order approximate optimization of the objective function is:

[0217] ;

[0218] In the formula, , is the first-order derivative of the loss function, , is the second-order derivative of the loss function. After removing the constant term, the formula is as follows:

[0219] ;

[0220] For a fixed tree structure, the leaves The optimal weight calculation formula is:

[0221] ;

[0222] The corresponding optimal value calculation formula is:

[0223] ;

[0224] In the formula, is the target score of the tree. The smaller the value, the better. Use the greedy algorithm to iteratively add branches to the tree starting from the root node of the tree, gradually build the whole tree, enumerate the feasible split points, and select The segmentation point when the loss function is minimized and the loss function is reduced to the maximum is taken as the partition point. and is the sample set of the left and right nodes after splitting, let , then the loss function after splitting is reduced As shown below:

[0225] .

[0226] In the embodiment, the specific steps of the TPE optimization algorithm for optimizing the structure and parameters of the network intrusion detection classification model are as follows: importing the original data, setting the structure and hyperparameter range of the classifier, and randomly generating a set of initialization parameter combinations; performing TPE probability density estimation, calculating the EI value through the sampling function, and selecting the next parameter combination to be evaluated according to the previously sampled EI value; inputting the parameter combination with the maximum EI value into the classifier for training, and outputting the model prediction result under the current hyperparameters; if the error of the newly selected parameter combination meets the accuracy requirement, terminating the algorithm execution, and outputting the corresponding parameter combination and the prediction error of the model; if it does not meet the accuracy requirement, correcting the sampling function, and re-performing the TPE probability density estimation until the set number of iterations is met;

[0227] Among them, through and Modeling is performed instead of A single modeling represents the distribution of solutions, Represents the parameters when the solution is known The distribution of to guide the search of the configuration space, The calculation of is as follows:

[0228] ;

[0229] In the formula, is a defined threshold. Represents the observed value The loss function is Small density estimates, Represents the observed value The loss function is Large density composition;

[0230] The definition is as follows:

[0231] ;

[0232] Through conversion , and construct the function :

[0233] ;

[0234] That is, in maximizing In the process of finding better hyperparameters, It should be gradually iterated to make Smaller values, that is, closer to the maximum probability and the minimum probability .

[0235] The above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit the same. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that the technical solutions described in the above embodiments may still be modified, or some or all of the technical features may be replaced by equivalents. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection, characterized in that: include: Step S1, obtaining an intrusion detection data set and preprocessing the intrusion detection data set; Step S2, using the Balanced WCGAN-GP model to process the imbalanced data set; Step S3, improving the AOA algorithm through the mRMR algorithm strategy, Sigmoid transfer function, Lévy flight and Macro F1 score weighted fitness function to form an IBAOA model and screen out key features in the data set; Step S4, input the selected feature combination into the network intrusion detection classification model, and use the TPE optimization algorithm to optimize the parameters of the network intrusion detection classification model to perform the final intrusion detection and classification; In step S2, WCGAN introduces conditional information into the input of the generator and the discriminator. The discriminator not only needs to distinguish between generated data and real data, but also needs to determine whether the data is consistent with the given conditional information. That is, the objective function of WCGAN is as follows: ； In the formula, and are the outputs of the discriminator and the generator, respectively. and are real samples and noise respectively, and They represent the expected values ​​of the real sample distribution and the noise distribution respectively, and c is the conditional information; The Wasserstein distance is introduced into WCGAN to replace the JS divergence in it, which is used to measure the To another distribution The minimum cost is as follows: ； In the formula, represents the lower bound of a set, Representation distribution The set of joint distributions of all possible combinations, for each possible joint distribution , calculate the sampling from of Distance Expectations , all different joint distributions The expected minimum value in the distribution is Wasserstein distance; The Lipschitz constraint condition is used in the model, and its continuity theorem limits the maximum local change of the continuous function. The formula is as follows: ； In the formula, and Respectively represent functions In the input value and The function value at is the Lipschitz constant, which represents the function The maximum rate of change within the domain; Then, the objective function of the WCGAN model is as follows: ； When dealing with Lipschitz distribution, weight clipping can easily lead to gradient vanishing or even gradient explosion. Gradient penalty GP is introduced into the total loss function to form the WCGAN-GP network, making the training more stable. The objective function of WCGAN-GP is: ； ； In the formula, is the penalty term coefficient, and Generate data for real data and generator respectively, is a random number that follows a uniform distribution on [0,1]. for The expected function of For the general The second norm of the gradient after entering the discriminator; The inverse proportional weight idea is introduced to improve the objective function of WCGAN-GP to form the Balanced WCGAN-GP model. The weight in the loss function is adjusted according to the sample size of each category, so that the objective function pays more attention to the category with a small sample size during the optimization process. The improved objective function Such as: ； In the formula, is the total number of categories, For Category The inverse proportional weight is: ； In the formula, Yes Category The number of samples, the category with fewer sample numbers will have a higher weight, which will prompt the generator to pay more attention to these minority categories. At this time, the discriminator loss and the generator loss They are as follows: ； 。 2. According to claim 1, a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection is characterized in that: In step S1, the intrusion detection data set uses NSL-KDD and CICDDoS2019, including relevant data of attack categories and normal traffic.

3. According to claim 1, a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection is characterized in that: In step S1, the preprocessing method includes null value processing, label encoding and maximum-minimum value scaling; Among them, null value processing is to clean and filter data by removing missing values ​​and irrelevant parameters; Label encoding is to encode the labels of all categorical features except the last one before applying normalization techniques; After label encoding, the minimum-maximum normalization technique is applied to the obtained output to scale the value range of each feature to the [0,1] interval. The conversion formula is: ； In the formula, and are the minimum and maximum values ​​of the eigenvectors, respectively. and are the original value and normalized value of the feature sample respectively.

4. According to claim 1, a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection is characterized in that: In step S3, the population of AOA is initialized by the mRMR algorithm strategy. First, the correlation between features and labels and the redundancy between features are calculated. Then, the features with the maximum correlation and the minimum redundancy are selected by calculating the mRMR value and sorting the features. The correlation between features and labels is calculated, and the formula is as follows: ； In the formula, Representative feature set With category The correlation between the various features and categories The mean of all mutual information values ​​between is defined as Represents the mutual information value of a single feature and a category, which is calculated as follows: ； In the formula, are two random variables, yes and The joint probability density function of and They are and The marginal probability density function of ; The redundancy between features is calculated as follows: ； In order to eliminate redundant features and screen out feature sets with high correlation and low redundancy, by calculating the difference, features with greater correlation and smaller redundancy will obtain higher mRMR values. The formula is as follows: ； Sort the features to get the ranking of each feature ; Ensure that the population has good coverage and initial solution quality during feature selection, and rank the features according to their mRMR values ​​in the dataset With the total number of features , set the selected The range of features is as follows: ； In the formula, Indicates rounding up. Indicates rounding down; The values ​​are evenly distributed within a certain range, generating A collection of values, where each The value corresponds to a population individual, The value is generated by the following formula: ； In the formula, Indicates The number of characteristics of a population, that is, Populations contain mRMR value rankings forward The characteristics of is the total number of populations initialized by the AOA algorithm, is the index of the current population, ranging from 0 to .

5. According to claim 4, a network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection is characterized in that: In step S3, in order to effectively map the continuous search space to the discrete search space, the Sigmoid transfer function is used to convert the AOA into a binary form, and the formula is as follows: ； In the formula, It means that in the iteration Secondary time dimension To map the position in the discrete space, the corresponding update formula is as follows: 。 6. A network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection according to claim 5, characterized in that: In step S3, Lévy flight is used to solve the problem that AOA may also fall into the local optimal value during the search process. The Lévy step length expression is as follows: ； In the formula, and is a variable that follows a normal distribution, that is, , , , Defined as: ； In the formula, is the standard gamma function, The value range is [0, 2]; Introducing Lévy flight into the survey phase of AOA to enhance its global search capability and ability to escape local optimality, and improve position update The formula is: ； In the formula, Indicates The solution The update of the position in the next iteration, is the best solution obtained so far. position, MOP is The function value of the iteration, is a very small number. and Respectively represent The upper and lower bounds of the positions, is the control parameter, set to 0.5, is a random number, is a scaling factor used to adjust the range of influence of the Lévy flight step, with a value of 0.

01.

7. A network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection according to claim 6, characterized in that: In step S3, the Macro F1 score is introduced as an indicator of classification performance, and the fitness function is constructed in combination with the number of features to achieve the dual goals of feature selection, reducing the number of features and improving classification performance. The corresponding fitness function is expressed as follows: ； In the formula, is the number of features in the dataset, is the number of features selected, It is used to adjust the strength of the selected features. The setting range is [0, 1]. Compared with the compressed features, the purpose is to find the feature combination with the best generalization performance. is 0.01, is the number of classification categories, The calculation formula is as follows: ； In the formula, The model is The F1 score of each category is calculated as follows: ； In the formula, Representative The accuracy of each category, Representative The recall rate of each category.

8. A network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection according to claim 7, characterized in that: In step S4, the network intrusion detection classification model is constructed as a new feature set by the best features screened by the IBAOA method, and then the XGBoost classifier with a regularized loss function is used to classify these features, wherein the XGBoost classifier training process includes two stages: regularization and boosting; Regularization phase: Suppose the network intrusion detection data feature set is ; Total samples, is the feature space, R is the real number space, and the data subset The corresponding label is ,therefore The final prediction result of a regression tree is as follows: ； In the formula, , is the set of all regression trees, Regression Tree The predicted value given for the input sample x, For the tree structure, is the number of leaf nodes in the tree; In order to control the complexity of the model and prevent overfitting, a regularization term is introduced , and further get the expression of the objective function O: ； In the formula, ; For the The true label corresponding to each sample is is the loss function, and is the penalty term coefficient, For the The weight of a leaf node; Promotion stage: set up For the Samples in The predicted value at the iteration is added using the forward step-by-step addition algorithm. To learn new functions in the model, the objective function is converted to: ； Further Perform a second-order Taylor expansion, and the second-order approximate optimization of the objective function is: ； In the formula, , is the first-order derivative of the loss function, , is the second-order derivative of the loss function. After removing the constant term, the formula is as follows: ； For a fixed tree structure, the leaves The optimal weight calculation formula is: ； The corresponding optimal value calculation formula is: ； In the formula, is the target score of the tree. The smaller the value, the better. Use the greedy algorithm to iteratively add branches to the tree starting from the root node of the tree, gradually build the whole tree, enumerate the feasible split points, and select The segmentation point when the loss function is minimized and the loss function is reduced to the maximum is taken as the partition point. and is the sample set of the left and right nodes after splitting, let , then the loss function after splitting is reduced As shown below: 。 9. A network intrusion detection method integrating Balanced WCGAN-GP and IBAOA feature selection according to claim 8, characterized in that: In step S4, the specific steps of optimizing the network intrusion detection classification model structure and parameters by the TPE optimization algorithm are as follows: Import the original data, set the classifier structure and hyperparameter range, and randomly generate a set of initialization parameter combinations; Perform TPE probability density estimation, calculate the EI value through the sampling function, and select the next parameter combination to be evaluated based on the previously sampled EI value; The parameter combination with the maximum EI value is input into the classifier for training, and the model prediction results under the current hyperparameters are output; If the error of the newly selected parameter combination meets the accuracy requirements, the algorithm execution is terminated and the corresponding parameter combination and model prediction error are output; If the accuracy requirement is not met, the sampling function is modified and the TPE probability density estimation is performed again until the set number of iterations is met; Among them, through and Modeling is performed instead of A single modeling represents the distribution of solutions, Represents the parameters when the solution is known The distribution of to guide the search of the configuration space, The calculation of is as follows: ； In the formula, is a defined threshold. Represents the observed value The loss function is Small density estimates, Represents the observed value The loss function is Large density composition; The definition is as follows: ； Through conversion , and construct the function : ； That is, in maximizing In the process of finding better hyperparameters, It should be gradually iterated to make Smaller values, that is, closer to the maximum probability and the minimum probability .

Images