Network intrusion detection method, terminal device and storage medium

Abstract

The present invention discloses a network intrusion detection method, terminal device and storage medium. It calculates the feature importance based on the LightGBM feature selection method, performs feature screening according to the importance score, improves the interpretability of the IDS, eliminates redundant features in the data to prevent the model from overfitting redundant data, and improves the generalization performance of the model. Experiments have verified that compared with other feature selection methods, the method of the present invention significantly improves the accuracy of the model. By enhancing the convolutional network, the present invention designs a dual-channel residual convolution module, which effectively solves the gradient disappearance problem, optimizes the feature fusion mechanism, and improves the generalization ability of the model. In addition, in response to the problems of high computational complexity and difficulty in capturing deep-level dependencies faced by ordinary attention modules when processing long sequences, a residual BA module is designed. By introducing residual connections, the model is easier to learn the residual between input and output, and the model's ability to capture deep-level features and dependencies is enhanced.

Description

Technical Field

[0001] The present invention relates to network security detection technology, in particular to a network intrusion detection method, terminal equipment and storage medium. Background Art

[0002] Traditional intrusion detection technologies are unable to cope with the increasingly complex network attack patterns. Traditional signature-based intrusion detection systems rely heavily on matching known attack patterns and are unable to detect unknown attack patterns. Traditional anomaly-based intrusion detection systems suffer from high false positive rates and high system resource consumption. While hybrid intrusion detection systems combine the advantages of both approaches, they still suffer from poor real-time performance and high complexity. Machine learning-based detection methods can, to a certain extent, address the increasing complexity of network attack patterns by automatically learning complex attack patterns in traffic. However, they still suffer from the limitations of manual feature extraction. With the development of deep learning, deep learning methods have been applied to network intrusion detection to automatically extract features. Although some deep learning models have been applied to network intrusion detection and have achieved some results, the presence of redundant features in the dataset can easily lead to overfitting to erroneous data, resulting in poor generalization. In addition, traditional network structures suffer from limitations such as vanishing gradients. Summary of the Invention

[0003] The technical problem to be solved by the present invention is to provide a network intrusion detection method, terminal equipment and storage medium to improve the accuracy of intrusion detection in view of the shortcomings of the existing technology.

[0004] To solve the above technical problems, the technical solution adopted by the present invention is: a network intrusion detection method, comprising the following steps:

[0005] S1. Preprocess the intrusion detection data set to obtain a preprocessed data set;

[0006] S2. Use the preprocessed data set to construct a training set, use the training set as the input of the LightGBM model, train the LightGBM model, obtain the importance score of each feature, select the features corresponding to the importance score greater than the set threshold, and construct a feature set;

[0007] S3. Use the feature set as the input of the intrusion detection network, train the intrusion detection network, and obtain an intrusion detection model; wherein, the intrusion detection network includes a dual-channel residual convolution module, and the dual-channel residual convolution module is connected to the residual BA module; the dual-channel residual convolution module includes a first convolution layer, a first maximum pooling layer, and a first batch of normalization layers connected in sequence, the first batch of normalization layers are connected to the second convolution layer and the third convolution layer, the second convolution layer is sequentially connected to the second batch of normalization layers, the fourth convolution layer, the second maximum pooling layer, and the third batch of normalization layers, and the third convolution layer is connected to the third maximum pooling layer; the outputs of the third batch of normalization layers and the third maximum pooling layers are spliced ​​as the input of the residual BA module.

[0008] This paper uses the LightGBM feature selection method to calculate feature importance and screens features based on importance scores, thereby improving the interpretability of IDS (Intrusion Detection System). Experimental verification shows that the method of the present invention significantly improves intrusion detection accuracy. The present invention uses an enhanced convolutional network to perform dual-channel convolution feature extraction and utilizes residual connections to ensure that the accuracy of the model increases with increasing depth. The dual-channel design of the present invention effectively solves the gradient vanishing problem, optimizes the feature fusion mechanism, and improves the generalization ability of the model.

[0009] The specific implementation process of step S1 includes:

[0010] Perform one-hot encoding on the categorical feature fields in the intrusion detection dataset to obtain numerical feature fields;

[0011] The numerical feature fields are normalized to obtain a preprocessed data set.

[0012] For categorical feature fields in the dataset, this paper converts them into numerical values ​​through one-hot encoding to serve as input for the network model. Since the dimensionality of different features varies significantly, this paper uses normalization techniques to convert the range of feature values ​​into standardized intervals, thereby reducing the impact of dimensionality differences.

[0013] The residual BA module consists of a sequentially connected BiGRU layer and a self-attention layer, with the output of the BiGRU layer concatenated with the output of the self-attention layer. To address the high computational complexity and difficulty capturing deep dependencies faced by conventional self-attention modules when processing long sequences, the residual BA module was designed. By introducing residual connections, the model is more easily able to learn the residual between input and output, enhancing its ability to capture deep features and dependencies.

[0014] The BiGRU layer includes a cascaded forward GRU and backward GRU.

[0015] When training the intrusion detection network, the process of optimizing the intrusion detection network parameters includes:

[0016] 1) Define the intrusion detection network parameter set P = {p1, p2, ..., p n}, where each parameter p i The domain of the i ; n is the number of intrusion detection network parameters; the initialization iteration number t is 0;

[0017] 2) Initialize the population G0 = {g1, g2, ... g n}, each individual g i ∈G0, each individual is a combination of elements in the parameter set P;

[0018] 3) For the population G of the tth iteration t Each individual g in i Calculate the fitness f(g i ), according to the fitness f(g i ), using the roulette algorithm from the population G t Select individuals to reproduce and generate population subsets

[0019] 4) From G t 'Select parent individuals g1 and g2 and generate offspring g3 through the crossover operator;

[0020] 5) Apply mutation operator to g3 to randomly change some of its parameters;

[0021] 6) Use the generated offspring g3 to replace or supplement the original population G t , forming a new generation of population G t+1 ;

[0022] 7) The value of t is increased by 1, and steps 3) to 6) are repeated until the maximum number of iterations is reached to obtain the final population;

[0023] 8) Select the individual g with the highest fitness from the final population * As the optimal solution.

[0024] The present invention optimizes network structure parameters and uses a genetic algorithm (GA) to determine the optimal parameter combination for the network. Determining the optimal parameter combination through GA can automatically determine the optimal parameter combination, eliminating the trouble of manually adjusting parameters one by one and improving the efficiency and reliability of parameter optimization.

[0025] As an inventive concept, the present invention also provides a terminal device, including a memory, a processor, and a computer program stored in the memory; the processor executes the computer program to implement the steps of the above method.

[0026] As an inventive concept, the present invention also provides a computer-readable storage medium having a computer program / instruction stored thereon; characterized in that the computer program / instruction implements the steps of the above method when executed by a processor.

[0027] As an inventive concept, the present invention also provides a computer program product, comprising a computer program / instruction; when the computer program / instruction is executed by a processor, the steps of the above method are implemented.

[0028] Compared with the prior art, the present invention has the following beneficial effects:

[0029] 1. This paper proposes a feature selection method based on LightGBM. By calculating feature importance and setting thresholds for feature screening, the interpretability of the model is ensured. Experiments have also verified that compared with other feature selection methods, the method of this paper significantly improves the accuracy of the model.

[0030] 2. This paper proposes a new deep learning model as a classifier for abnormal traffic detection. In this model, a new dual-channel residual convolution module is designed. This dual-channel design effectively solves the vanishing gradient problem, optimizes the feature fusion mechanism, and improves the model's generalization capability. Furthermore, to address the high computational complexity and difficulty capturing deep dependencies faced by conventional self-attention modules when processing long sequences, a residual BA module is designed. By introducing residual connections, the model is more easily able to learn the residual between input and output, enhancing the model's ability to capture deep features and dependencies.

[0031] 3. The present invention optimizes the complete network structure parameters and uses the genetic algorithm GA to determine the optimal parameter combination of the network.

[0032] 4. This paper validates the performance of the proposed model using the Network Intrusion Detection Benchmark Dataset (NSL-KDD). The experimental results demonstrate the effectiveness of the proposed model. The proposed model achieves an accuracy of 99.31% on the NSL-KDD dataset, with an extremely low false positive rate of only 0.22%. Its overall performance surpasses existing state-of-the-art work, reaching the state-of-the-art. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Figure 1 This is a flow chart of the detection method according to an embodiment of the present invention;

[0034] Figure 2 This is a structural diagram of GA-RCBA-Net according to an embodiment of the present invention;

[0035] Figure 3 This is a structural diagram of a dual-channel residual convolution block in an embodiment of the present invention;

[0036] Figure 4 This is a structural diagram of the residual BA module according to an embodiment of the present invention;

[0037] Figure 5 This is a BiGRU principle diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0038] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts shall fall within the scope of protection of the present invention.

[0039] In the embodiments of the present invention, the terms "first", "second" and other similar words are not intended to imply any order, quantity and importance, but are only used to distinguish different elements. In the embodiments of the present invention, the terms "one", "an" and other similar words are not intended to indicate that there is only one of the things described, but rather to indicate that the relevant description is only for one of the things described, and the things described may have one or more. In the embodiments of the present invention, the terms "comprise", "include" and other similar words are intended to indicate logical relationships, and cannot be regarded as indicating relationships in spatial structure. For example, "A includes B" is intended to indicate that B logically belongs to A, but does not mean that B is spatially located inside A. In addition, the meanings of the terms "comprise", "include" and other similar words should be regarded as open, not closed. For example, "A includes B" is intended to indicate that B belongs to A, but B does not necessarily constitute the whole of A, and A may also include other elements such as C, D, and E.

[0040] Example 1

[0041] The embodiment of the present invention provides an intrusion detection method, such as Figure 1 As shown, the following steps are included:

[0042] Step 1: Preprocess the data of the benchmark intrusion detection dataset NSL-KDD

[0043] (1) One-hot encoding: Let Represents a given dataset with n data points consisting of q features. The categorical feature fields in the dataset need to be converted to numerical values ​​through one-hot encoding to serve as input to the network model.

[0044] (2) Normalization: The dimensionality gap between different features is large. The min-max normalization technique is used to convert the range of feature values ​​into a standardized interval, thereby reducing the impact of the dimensional gap.

[0045]

[0046] (3) Dataset division

[0047] To ensure the distribution consistency among the training, validation, and test sets, we resampled and partitioned the dataset. The ratio of the training, validation, and test sets was 3:1:1.

[0048] Step 2: Feature selection based on LightGBM

[0049] LightGBM uses a gradient boosted decision tree (GBDT) to evaluate the importance of each feature, thereby identifying the features that contribute most to the prediction target. The goal of LightGBM is to build an additive model consisting of a series of decision trees, whose core goal is to minimize the loss function.

[0050] make Denotes the preprocessed dataset, let F(x) be the predicted value of the model, and the loss function is defined as L(y,F(x)), where. The training process of GBDT can be described as follows:

[0051] F t (x) = F t-1 (x)+ηh t (x)

[0052] Among them F t (x) is the model after the tth iteration, h t (x) represents the t-th decision tree, and η is the learning rate. The goal of each round of training is to find the decision tree that minimizes the loss function, which is mathematically expressed as:

[0053]

[0054] After training, LightGBM will output the importance score of each feature. This score is usually based on the number of splits or split gains of the feature in all trees. Let the importance score of the jth feature be I j , then the calculation method is:

[0055]

[0056] Where T represents the total number of trees, N t The set of nodes that constitute the t-th tree, Indicates the importance of feature j to node n in the tth tree.

[0057] Finally, the most important features are selected based on the feature importance scores. A threshold k is set and the top k most important features are selected to form a new feature subset.

[0058] Step 3: Build the intrusion detection model GA-RCBA-Net

[0059] The embodiment of the present invention proposes a new deep learning network architecture Genetic Algorithm-optimized Residual Convolutional-BiGRU-Attention network (GA-RCBA-Net), such as Figure 2 The network architecture consists of two main parts: a dual-channel residual convolution module and a residual BA module. In addition to improving the network structure, we optimized the model parameters and used the GA algorithm to determine the optimal parameter combination of the network.

[0060] 1) Dual-channel residual convolution module

[0061] The dual-channel residual convolution block is as follows Figure 3 shown.

[0062] The convolutional layer in the block has a kernel size of 3, and the filter size gradually increases to 64, 128, and 256 with the depth of the layer, which is used to quickly extract features. The dual-channel design effectively solves the gradient vanishing problem, optimizes the feature fusion mechanism, and ensures that the accuracy of the model increases with depth. The calculation of a single convolution layer is as follows:

[0063]

[0064] Where W represents the weight of the convolution kernel, b is the bias term, Represents the convolution operation, and σ represents the activation function. Here, the rectified linear unit (ReLU) is used. The ReLU function introduces nonlinear properties. If the input is negative, the output of the ReLU function is zero. This sparse activation property helps alleviate the problem of overfitting.

[0065] The convolutional layer is followed by a pooling layer and batch normalization (BN) to improve the stability of the model. Batch normalization (BN) adjusts the intermediate representation of the network by normalizing the input data of each batch to prevent its value from being too large or too small, accelerate network convergence, eliminate the problem of gradient disappearance, and improve the stability of the model. The calculation process is as follows:

[0066] h2=MaxPooling(h1)

[0067]

[0068] Among them, μ is the mean of h2, σ 2is the variance of h2, γ and β are learnable scaling and shift parameters, and ∈ is a small constant used to ensure numerical stability.

[0069] After dual-channel feature extraction, the outputs of the two channels are connected. The calculation process is as follows:

[0070] C3=C1(h3)+C2(h3)

[0071] C1(h3)=BN(MaxPooling(conv(BN(conv(h3)))))

[0072] C2(h3)=MaxPooling(conv(h3))

[0073] (2) Residual BA module

[0074] The residual BA module includes BiGRU layer and self-attention layer, such as Figure 4 As shown. BiGRU consists of a forward GRU and a reverse GRU. The forward GRU starts from the first time step of the sequence and processes each time step in sequence to calculate the forward hidden state sequence. In contrast, the reverse GRU starts from the last time step of the sequence and processes each time step in the sequence in reverse to calculate the backward hidden state sequence. The forward and backward hidden states are summed element by element to obtain a bidirectional hidden state sequence, as shown in Figure 5 shown.

[0075] The BiGRU layer enhances the model's understanding of context by combining forward and backward sequence information. Each GRU unit contains an update gate, a reset gate, and a hidden state. Through these gating mechanisms, the GRU can dynamically learn the long-term dependencies of the input sequence. Given the output C3 of the dual-channel residual convolution module = (x1, x2, ..., x t ), the calculation of the BiGRU unit is as follows:

[0076] z t =sigmoid(W z ·[h t-1 ,x t ]+b z );

[0077] r t =sigmoid(W r ·[h t-1 ,x t ]+b r );

[0078]

[0079]

[0080] Where W z ,W r ,W h is the weight parameter, b z ,b r ,b h is the bias term. [h t-1 ,x t ] represents the hidden layer state h of the previous time step t-1 and the input x at the current time step t A batch normalization layer is added after the BiGRU layer to prevent overfitting and enhance the stability of the model.

[0081] H=BN(h t )

[0082] Through the self-attention mechanism, the residual BA module focuses "attention" on the important parts of the sequence, thereby learning in a targeted manner and improving the model's ability to understand sequence data. In order to solve the problem that ordinary attention layers are difficult to capture deep dependencies, the model introduces residual connections, which makes it easier to learn the residual between input and output, thereby enhancing the model's ability to capture deep features and dependencies. Given the output of the BN layer H = (h1,h2,...h t ), and the query vector q used for attention calculation, the calculation method of additive attention is as follows:

[0083] e t =v T ·tanh(W1·h t +W2·q).

[0084] Where W1, W2 and v are all learnable parameters. The calculation process of attention weight is as follows:

[0085]

[0086] exp(e t )Calculate e t The exponential value of , produces a non-negative value about the attention score. These attention scores are then normalized into a probability distribution by dividing each score by the sum of all attention scores in all time steps to ensure that the sum of the attention weights is equal to 1. The weight vector c is defined as:

[0087] The output of the self-attention layer is connected to the input of the self-attention layer through a residual connection. This structure helps the model preserve information, promote gradient flow, and improve overall training and learning efficiency. The output vector O is defined as: t =c t +h t .

[0088] Step 4 GA parameter optimization

[0089] GA is used to select the parameter combination that optimizes the model effect. The optimized parameters include the kernel size of the Conv layer, the filter size, the number of units in the BiGRU layer, the dropout rate of the MLP module dropout layer, and other parameters.

[0090] First, initialize the parameters and define the parameter set P = {p1, p2, ..., p n}, where each parameter p i The domain of the i , indicating the selection range of the parameter.

[0091] Initialize the population G0 = {g1, g2, ... g n}, each individual g i ∈G0, is a combination of parameter set P, for population G t Each individual g in i Calculate the fitness f(g i ): Performance of the GA-RCBA-Net model on the validation set under this parameter combination.

[0092] f(g i )=PerformanceMeasure(g i )

[0093] According to the fitness f(g i ), using the roulette algorithm from the population G t Select individuals to reproduce and generate population subsets

[0094] From G t 'Select parent individuals g1 and g2 and generate offspring g3 through the crossover operator.

[0095] Apply a mutation operator to g3 to randomly change some of its parameters to increase the diversity of the population.

[0096] Use the generated offspring g3 to replace or supplement the original population G t , forming a new generation of population G t+1 .

[0097] The above process is repeated until the maximum number of iterations T is reached, at which point the algorithm stops.

[0098] From the final population G t Select the individual g with the highest fitness * As the optimal solution.

[0099]

[0100] The following experiments verify the effectiveness of the method of the embodiment of the present invention.

[0101] First, we use LightGBM for feature selection. In the NSL-KDD dataset, there are 41 features in total, and 20 key features are selected through LightGBM.

[0102] Subsequently, we compared the feature selection algorithm based on LightGBM with several classic feature selection algorithms, including RF (Random Forest), RFE (Recursive Feature Elimination), MI (Mutual Information), f-classif, Chi-Squre, and XGBoost algorithms. Table 1 shows the accuracy comparison results of different feature selection algorithms.

[0103] Table 1 Performance of GA-RCBA-Net using different feature selection methods on the NSL-KDD dataset

[0104]

[0105]

[0106] On the NSL-KDD dataset, GA-RCBA-Net achieved an accuracy of 99.31% on a simplified feature subset, which is 1%-2% higher than other classic feature selection methods.

[0107] Precision and recall are key metrics for evaluating classification techniques. Our model improved both precision and recall by approximately 1% on the NSL-KDD dataset, reaching 99.33% and 99.29% respectively.

[0108] The F1 score is an important metric for evaluating the performance of classification techniques on imbalanced datasets. It represents a trade-off between precision and recall. On the NSL-KDD dataset, our model achieved an F1 score of 99.31%, approximately 1% higher than other feature selection methods.

[0109] Compared to other feature selection techniques, our method significantly reduces the false positive rate (FPR), indicating that the number of false positives in our model is almost negligible. Our model achieves an FPR of 0.22% on the NSL-KDD dataset, which is the lowest false positive rate compared to other feature selection methods.

[0110] The model of the embodiment of the present invention is compared with existing advanced models, including the DNN model based on statistical importance feature selection (SI+DNN) (Thakkar A, Lohiya R. Fusion of statistical importance for feature selection in Deep Neural Network-based Intrusion Detection System[J]. Information Fusion, 2023, 90: 353-363.), the BWO-CONV-LSTM network based on ABC feature selection (Kanna PR, Santhi P. Hybrid Intrusion Detection using MapReduce based BlackWidow Optimized Convolutional Long Short-Term Memory Neural Networks[J]. Expert Systems with Applications, 2022, 194.), the DT based on PIO feature selection (Alazzam H, Sharieh A, Sabri K EA feature selection algorithm for intrusion detection system based on Pigeon Inspired Optimizer[J]. Expert Systems with Applications, 2020, 148.), the BiLSTM (Imrana Y, Xiang Y, Ali L,et al.A bidirectionalLSTM deep learning approach for intrusion detection[J].Expert Systems withApplications,2021,185.),DNN+Dropout(Thakkar A,Lohiya R.Analyzing fusion ofregularization techniques in the deep learning-based intrusion detectionsystem[J].International Journal of Intelligent Systems, 2021, 36(12):7340-7388.), RNN variant based on XGBoost feature selection (Kasongo S M.A deep learning technique for intrusion detection system using a Recurrent Neural Networks based framework[J].Computer Communications,2023,199:113-125.), optimized CNN (OCNN) and hierarchical multi-scale LSTM (HMLSTM) (Kanna PR, Santhi P. Unified deep learning approach for efficient intrusion detection system using integrated spatial–temporal features[J].Knowledge-Based Systems,2021,226:107-132.). Due to the excellent performance of these models, the present invention selected them for evaluation and comparison. Table 2 shows the comparison of the results of this model and existing methods on the NSL-KDD dataset.

[0111] Table 2 Performance comparison between the method of the embodiment of the present invention and the existing method on the NSL-KDD dataset

[0112]

[0113] On the NSL-KDD dataset, our model surpassed existing state-of-the-art models across all metrics. Accuracy improved by approximately 1% to 14%, precision by approximately 1% to 13%, recall by approximately 1% to 8%, and F1 score by approximately 1% to 11%. Our model achieved an FPR as low as 0.22% and a recall of 99.29%, demonstrating an extremely low false positive rate, a crucial metric for network intrusion detection.

[0114] Example 2

[0115] Embodiment 2 of the present invention provides a terminal device corresponding to the above-mentioned embodiment 1. The terminal device can be a processing device for a client, such as a mobile phone, a laptop computer, a tablet computer, a desktop computer, etc., to execute the method of the above-mentioned embodiment.

[0116] The terminal device of this embodiment includes a memory, a processor, and a computer program stored in the memory; the processor executes the computer program in the memory to implement the steps of the method in the above-mentioned embodiment 1.

[0117] In some implementations, the memory may be a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage.

[0118] In other implementations, the processor may be a central processing unit (CPU), a digital signal processor (DSP), or other general-purpose processors, which are not limited herein.

[0119] Example 3

[0120] Embodiment 3 of the present invention provides a computer-readable storage medium corresponding to the above-mentioned embodiment 1, on which a computer program / instruction is stored. When the computer program / instruction is executed by a processor, the steps of the method of the above-mentioned embodiment 1 are implemented.

[0121] Computer readable storage media can be tangible devices that hold and store instructions used by instruction execution devices. Computer readable storage media can be, for example, but not limited to, electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any combination thereof.

[0122] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the application can adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiment of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal translation scripting language JavaScript, etc.

[0123] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the steps in the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0124] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing the instructions executed on the computer or other programmable device for implementing the process. Figure 1 a process or multiple processes and / or boxes Figure 1 A step that specifies a function in one or more boxes.

[0125] Although the preferred embodiments of the present application have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present application.

[0126] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A network intrusion detection method, characterized in that: The following steps are involved: S1. Preprocess the intrusion detection data set to obtain a preprocessed data set; S2. Use the preprocessed data set to construct a training set, use the training set as the input of the LightGBM model, train the LightGBM model, obtain the importance score of each feature, select the features corresponding to the importance score greater than the set threshold, and construct a feature set; S3. Use the feature set as the input of the intrusion detection network, train the intrusion detection network, and obtain an intrusion detection model; wherein, the intrusion detection network includes a dual-channel residual convolution module, and the dual-channel residual convolution module is connected to the residual BA module; the dual-channel residual convolution module includes a first convolution layer, a first maximum pooling layer, and a first batch of normalization layers connected in sequence, the first batch of normalization layers are connected to the second convolution layer and the third convolution layer, the second convolution layer is sequentially connected to the second batch of normalization layers, the fourth convolution layer, the second maximum pooling layer, and the third batch of normalization layers, and the third convolution layer is connected to the third maximum pooling layer; the outputs of the third batch of normalization layers and the third maximum pooling layers are spliced ​​as the input of the residual BA module.

2. The network intrusion detection method according to claim 1, characterized in that: The specific implementation process of step S1 includes: Perform one-hot encoding on the categorical feature fields in the intrusion detection dataset to obtain numerical feature fields; The numerical feature fields are normalized to obtain a preprocessed data set.

3. The network intrusion detection method according to claim 1, wherein: The residual BA module includes a BiGRU layer and a self-attention layer connected in sequence, and the output of the BiGRU layer is spliced ​​with the output of the self-attention layer.

4. The network intrusion detection method according to claim 3, characterized in that: The BiGRU layer includes a cascaded forward GRU and backward GRU.

5. The network intrusion detection method according to claim 1, wherein: When training the intrusion detection network, the process of optimizing the intrusion detection network parameters includes: 1) Define the intrusion detection network parameter set P = {p1, p2, ..., p n }, where each parameter p i The domain of the i , represents the range of parameter selection; n is the number of intrusion detection network parameters; the initialization iteration number t is 0; 2) Initialize the population G0 = {g1, g2, ... g n }, each individual g i ∈G0, each individual is a combination of elements in the parameter set P; 3) For the population G of the tth iteration t Each individual g in i Calculate the fitness f(g i ), according to the fitness f(g i ), using the roulette algorithm from the population G t Select individuals to reproduce and generate population subsets 4) From G t 'Select parent individuals g1 and g2 and generate offspring g3 through the crossover operator; 5) Apply mutation operator to g3 to randomly change some of its parameters; 6) Use the generated offspring g3 to replace or supplement the original population G t , forming a new generation of population G t+1 ; 7) The value of t is increased by 1, and steps 3) to 6) are repeated until the maximum number of iterations is reached to obtain the final population; 8) Select the individual g with the highest fitness from the final population * As the optimal solution.

6. A terminal device comprising a memory, a processor, and a computer program stored in the memory; characterized in that: The processor executes the computer program to implement the steps of the method according to any one of claims 1 to 5.

7. A computer-readable storage medium having a computer program / instruction stored thereon; characterized in that: When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

8. A computer program product comprising a computer program / instructions; characterized in that When the computer program / instructions are executed by a processor, the steps of the method according to any one of claims 1 to 5 are implemented.

Images