An intrusion detection system based on deep learning

Abstract

The present invention discloses an intrusion detection system based on deep learning, which belongs to the technical field of network intrusion detection. By setting a deep learning model library and a historical data acquisition module, users can customize data learning schemes to achieve highly customized intrusion detection. At the same time, a model algorithm library is provided. By learning data relationships through a new learning strategy, the effect of deep learning models on data relationship learning can be improved, thereby solving the technical problem of poor data learning effect in the existing deep learning process, and ultimately improving the accuracy and efficiency of network intrusion detection.

Description

Technical Field

[0001] The present invention belongs to the technical field of network intrusion detection, and in particular relates to an intrusion detection system based on deep learning. Background Art

[0002] In recent years, with the continuous development of big data and cloud computing technology, computer network technology has become popular in many fields such as economy, politics, medical care, and industry, providing convenience for people's daily life and production process. However, network security issues have also come along. More and more server devices and illegal programs have buried major hidden dangers for network security. Various private information is constantly uploaded to cloud databases by various rogue software and websites. At the same time, some criminals obtain people's personal information through illegal network attacks. Faced with the explosive growth of Internet data, traditional network security detection technology can no longer effectively cope with the current situation. Therefore, it has become an urgent need to use intrusion detection systems to prevent network intrusions. With the increase in people's demand for the Internet in recent years, hackers' means of network intrusion are also constantly iterating, and intrusion data also presents the characteristics of massive, high-dimensional and comprehensive. As an important branch of artificial intelligence, machine learning has been proven to be widely used in various classification problems in terms of performance and accuracy. Therefore, for the application scenario of network intrusion, it can promote a deeper analysis of network data and identify any anomalies more quickly. The commonly used learning method in existing machine learning is supervised learning. In the existing machine learning methods, the data learning efficiency is usually low, resulting in poor final intrusion detection effect. Summary of the invention

[0003] The present invention provides an intrusion detection system based on deep learning to solve the problems existing in the prior art.

[0004] A deep learning-based intrusion detection system, comprising: a deep learning model library, a model algorithm library, a historical data acquisition module, a monitoring data acquisition module and an intrusion detection module;

[0005] The deep learning model library is used to provide a variety of different deep learning models, and obtain a target deep learning model in response to a model determination instruction input by a user through human-computer interaction;

[0006] The historical data acquisition module is used to acquire historical network traffic characteristics and historical network intrusion results corresponding to the network traffic characteristics to obtain training data;

[0007] The model algorithm library is used to use a collaborative hyperparameter optimization algorithm to enable the target deep learning model to learn the training data, thereby obtaining a target deep learning model with network traffic feature detection capability;

[0008] The monitoring data acquisition module is used to collect current network traffic characteristics and obtain monitoring data;

[0009] The intrusion detection module is used to schedule the target deep learning model obtained by the model algorithm library to analyze the monitoring data to obtain network intrusion detection results.

[0010] Furthermore, the deep learning model library includes at least CNN, CNN-LSTM, LSTM and BP deep learning models.

[0011] Furthermore, the historical network traffic characteristics include basic attributes of TCP connections, content characteristics of TCP connections, time-based network traffic statistical characteristics, and host-based network traffic statistical characteristics.

[0012] Furthermore, a collaborative hyperparameter optimization algorithm is used to enable the target deep learning model to learn the training data, thereby obtaining a target deep learning model with network traffic feature detection capabilities, including:

[0013] Initialize the population to obtain multiple individuals to be trained; the individual to be trained is a vector containing the parameters to be optimized of the target deep learning model;

[0014] Based on the training data, the fitness value corresponding to each individual to be trained is obtained, and the individual to be trained with the largest fitness value is determined as the optimal individual;

[0015] For the best individual in the t-th training process, use the individual with the largest fitness value in the previous t training processes to search for the best position of the current best individual, and obtain the best individual after the optimal search;

[0016] For the individuals to be trained except the optimal individual, the spiral and information interaction strategies are used to search the local area of ​​the individuals to be trained, and the other individuals to be trained after the local area search are obtained;

[0017] For all individuals in the current population, the position change search strategy is used to search the unknown area for all individuals, and the greedy algorithm is used to control the search process to obtain the individuals after the unknown area search;

[0018] Based on the individuals after searching the unknown area, the best individual and the worst individual are obtained;

[0019] For the best individual and the worst individual, an adaptive perturbation search strategy is used to perform a global search to obtain the individual after the global search;

[0020] Determine whether the current number of iterations is greater than or equal to the maximum number of iterations. If so, re-obtain the optimal individual based on the individual after the global search, and use the re-obtained optimal individual as the final parameter of the target deep learning model to obtain the target deep learning model with network traffic feature detection capabilities. Otherwise, return to the optimal search step.

[0021] Furthermore, the individual with the largest fitness value in the previous t training processes is used to search the optimal position of the current optimal individual, and the optimal individual after the optimal search is obtained as:

[0022]

[0023] Among them, G t Represents the individual with the largest fitness value during the first t training processes; represents the best individual in the current training process, that is, the best individual in the t-th training process; γ represents a random number that obeys the N(0,1) distribution, Represents the optimal individual after optimal search.

[0024] Furthermore, for other individuals to be trained except the optimal individual, a spiral and information interaction strategy is used to perform a local area search on other individuals to be trained, and other individuals to be trained after the local area search are obtained, including:

[0025] Except for the best individual, the other individuals to be trained are randomly paired with each other, and the paired individual corresponding to the i-th individual to be trained is obtained as Where i = 1, 2, ..., I-1, I represents the total number of all individuals. When the number of other individuals to be trained is odd, the optimal individual is determined to be the paired individual corresponding to the last other individual to be trained;

[0026] The spiral search for each other individual to be trained is:

[0027]

[0028] α=exp(-5*(1-t / t max ))

[0029] in, represents the i-th other individual to be trained, represents the optimal individual after optimal search, express The corresponding spiral search value, π represents the ratio of circumference to circumference, e represents the natural constant, α represents the intermediate parameter, R represents the random number between (-1,1), t max Indicates the maximum number of training times;

[0030] Based on the spiral search value corresponding to each other individual to be trained, the information interaction between the paired individuals corresponding to the other individuals to be trained is:

[0031]

[0032] Among them, r1 represents a random number between (0,1); It represents other individuals to be trained after the local area search, that is, other individuals to be trained after the local area search.

[0033] Furthermore, for all individuals in the current population, the position transformation search strategy is used to search the unknown area for all individuals, and the greedy algorithm is used to control the search process to obtain the individuals after the unknown area search, including:

[0034] Based on the current number of training times, the adaptive search factor is determined as:

[0035] η t+1 =η t +sin(0.5π*(t / t max ) k )

[0036] Among them, η t represents the adaptive search factor in the t-th training process, η t+1 represents the adaptive search control factor in the t+1th training process, t max represents the maximum number of training times, k represents the control factor; when t is an odd number, k is 1; when t is an even number, k is 2;

[0037] Based on the adaptive search factor, the unknown area search for all individuals is:

[0038]

[0039] in, represents the jth individual in the population after the local area search in the tth training process, j = 1, 2, ..., I, H represents the upper bound vector, L represents the lower bound vector, c represents the learning factor between (0, 1), Represents the individual after searching the unknown area

[0040] Judging individuals Is the fitness value of If the fitness value is , then the individual after the unknown area search is accepted, otherwise the individual after the unknown area search is rejected.

[0041] Furthermore, for the best individual and the worst individual, an adaptive perturbation search strategy is used to perform a global search, and the individuals after the global search are obtained, including:

[0042]

[0043] in, It represents the optimal individual retrieved based on the individual after searching the unknown area during the t-th training process. represents the optimal individual after global search, f w Indicates the fitness value corresponding to the worst individual, f g represents the fitness value corresponding to the optimal individual, ξ represents the nonlinear control factor, r2 represents a random number between (0,1), V0 represents the initial update speed, β represents the speed increment, represents the worst individual in the tth training process, represents the worst individual after global search, t max represents the maximum number of training times, e represents a natural constant, V 0,d represents the d-th dimension parameter in the initial update speed, d = 1, 2, ..., D, D represents the total dimension of the hyperparameters in the individual, represents the d-th dimension parameter in the worst individual, represents random individuals other than the best individual and the worst individual, l wg represents the Euclidean distance between the best individual and the worst individual, ε represents the constant term, and ε=0.0001.

[0044] Furthermore, it also includes: an intelligent alarm module;

[0045] The intelligent alarm module is used to generate abnormal warning information when the network intrusion detection result is abnormal, and transmit the abnormal warning information to the device specified by the user.

[0046] Further, it also includes: strengthening monitoring module;

[0047] The enhanced monitoring module is used to increase the data sampling frequency of the monitoring data acquisition module when the network intrusion detection result is in an abnormal state, so that the data sampling frequency corresponds to the network intrusion detection result, thereby enhancing intrusion detection.

[0048] The present invention provides an intrusion detection system based on deep learning. By setting a deep learning model library and a historical data acquisition module, users can customize data learning plans to achieve highly customized intrusion detection. At the same time, a model algorithm library is provided. By learning data relationships through a new learning strategy, the effect of deep learning models on data relationship learning can be improved, thereby solving the technical problem of poor data learning effect in the existing deep learning process, and ultimately improving the accuracy and efficiency of network intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.

[0050] Figure 1 A schematic diagram of the structure of an intrusion detection system based on deep learning provided in an embodiment of the present invention.

[0051] Figure 2 A schematic diagram of the process flow of the collaborative hyperparameter optimization algorithm provided in an embodiment of the present invention.

[0052] The above drawings have shown clear embodiments of the present invention, which will be described in more detail below. These drawings and text descriptions are not intended to limit the scope of the present invention in any way, but to illustrate the concept of the present invention for those skilled in the art by referring to specific embodiments. DETAILED DESCRIPTION

[0053] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present invention. Instead, they are merely examples of devices and methods consistent with some aspects of the present invention as detailed in the appended claims.

[0054] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0055] like Figure 1 As shown, an embodiment of the present invention provides an intrusion detection system based on deep learning, including: a deep learning model library, a model algorithm library, a historical data acquisition module, a monitoring data acquisition module and an intrusion detection module;

[0056] The deep learning model library is used to provide a variety of different deep learning models, and obtain a target deep learning model in response to a model determination instruction input by a user through human-computer interaction;

[0057] Optionally, the deep learning model library includes at least CNN (Convolutional Neural Network), CNN-LSTM, LSTM (Long Short-Term Memory) and BP (back propagation) deep learning models.

[0058] It is worth noting that in addition to the above-mentioned deep learning models, other types of deep learning models can also be used to identify and analyze monitoring data to determine network intrusion detection results. When selecting different deep learning models, the data should be processed into corresponding input forms to ensure that the data can be correctly identified by the deep learning model.

[0059] By setting the deep learning model, users can select different deep learning models for data recognition, thereby achieving recognition of different data volumes.

[0060] The historical data acquisition module is used to acquire historical network traffic characteristics and historical network intrusion results corresponding to the network traffic characteristics to obtain training data;

[0061] Optionally, the historical network traffic characteristics include basic attributes of TCP (Transmission Control Protocol, transport layer communication protocol) connections, content characteristics of TCP connections, time-based network traffic statistical characteristics, and host-based network traffic statistical characteristics.

[0062] The basic properties of a TCP connection may include: connection duration, protocol type, target service type, connection status, number of bytes of data from the source host to the target host, number of bytes of data from the target host to the source host, whether the connection is to the same host or port, number of error segments, number of expedited packets, etc.

[0063] The content characteristics of TCP connections may include: the number of times system sensitive files and directories are accessed, the number of failed login attempts, whether a login is successful, the number of times compromised conditions occur, whether a root shell is obtained, whether a "suroot" command appears, the number of root user accesses, the number of file creation operations, the number of times shell commands are used, the number of times control files are accessed, whether the login belongs to the "hot" list, whether a "guest" user is logged in, etc.

[0064] Time-based network traffic statistical features may include: the number of connections with the same target host as the current connection in the past two seconds, the number of connections with the same service as the current connection in the past two seconds, the proportion of SYN errors in connections with the same target host as the current connection in the past two seconds, the proportion of SYN errors in connections with the same service as the current connection in the past two seconds, the proportion of REJ errors in connections with the same target host as the current connection in the past two seconds, the proportion of REJ errors in connections with the same service as the current connection in the past two seconds, the proportion of connections with the same host as the current connection with the same services in the past two seconds, the proportion of connections with different services with the same host as the current connection in the past two seconds, and the like.

[0065] Host-based network traffic statistical features may include: among the top 100 connections, the number of connections with the same target host as the current connection, the number of connections with the same service as the current connection, the proportion of connections with the same target host and service as the current connection, the proportion of connections with the same target host but different services as the current connection, the proportion of connections with the same target host and source port as the current connection, the proportion of connections with different source hosts among connections with the same target host and service as the current connection, the proportion of SYN errors in connections with the same target host as the current connection, the proportion of SYN errors in connections with the same target host and service as the current connection, the proportion of REJ errors in connections with the same target host and service as the current connection,

[0066] It is worth noting that the above features are merely examples of the embodiments of the present invention. When those skilled in the art implement the embodiments of the present invention, other features may be used for optimization, or learning may be performed based on user-defined data.

[0067] The above data should all be expressed in numerical values. If they are not numerical data, they should be converted into numerical values ​​so that the deep learning model can recognize the data normally.

[0068] The model algorithm library is used to use a collaborative hyperparameter optimization algorithm to enable the target deep learning model to learn the training data, thereby obtaining a target deep learning model with network traffic feature detection capability;

[0069] In the prior art, deep learning modules are often trained using intelligent optimization algorithms such as genetic algorithms and particle swarm algorithms, which are usually prone to localization, resulting in poor recognition of network traffic features by the deep learning model, ultimately leading to false detection and missed detection. Therefore, an embodiment of the present invention provides a collaborative hyperparameter optimization algorithm to improve the optimization speed and optimization effect of the algorithm, thereby improving the accuracy of network intrusion detection results.

[0070] The monitoring data acquisition module is used to collect current network traffic characteristics and obtain monitoring data;

[0071] The intrusion detection module is used to schedule the target deep learning model obtained by the model algorithm library to analyze the monitoring data to obtain network intrusion detection results.

[0072] In the embodiment of the present invention, the network intrusion detection result may be no intrusion, network detection (Probe), denial of service attack (Dos), remote user attack (R2L) and privilege escalation attack (U2R).

[0073] In order to help those skilled in the art better understand the technical solutions described in the embodiments of the present invention, some terms are now explained.

[0074] Probe: Network probing generally refers to an attack that scans a computer network to collect information or discover known vulnerabilities that are exploited by further or future attacks. The purpose of this information collection is to understand the computers and services that exist on the network. Network probing generally does not immediately harm the computer system, but it will expose the computer's internal information, such as IP addresses, port numbers, etc., in preparation for subsequent network attacks.

[0075] DoS: Denial of service attacks are designed to interfere with the normal operation of network services by flooding, exhausting, and overwhelming the resources of the target network or host. The resources may be network bandwidth, the packet forwarding capabilities of a router, a name server, memory / computing power on a server, or the data structures of an operating system. During a DoS attack, the attacker typically generates a large amount of meaningless traffic, such as incomplete TCP connections, malformed IP packets, bot-generated requests for web pages, and some other carefully crafted methods to cause a service or program to stop functioning or prevent others from using the service or program.

[0076] R2L: A remote user attack is an attack in which an attacker attempts to log into a local system from a remote system. This attack usually involves the attacker exploiting a vulnerability in the system to gain access to the local system through remote access. Once the attacker successfully gains access to the local system, they can perform a variety of malicious actions, such as installing malware, stealing sensitive information, or further damaging the system.

[0077] U2R: A privilege escalation attack (User To Root, U2R) is an attack in which an intruder exploits vulnerabilities in a software application to access resources that are usually protected by the application or user, thereby upgrading or exploiting the current privilege level to perform malicious operations, and the privileges exceed the intended privileges of the application developer and system administrator. This type of known attacks can generally be divided into two categories. One is vertical privilege escalation, which means that a low-privileged user with a normal user account on the system exploits some vulnerabilities to evaluate functions or content reserved for high-privileged users or super (root) users. The second is horizontal privilege escalation, which means that a normal user with a normal account or no account on the system exploits certain vulnerabilities in the system to evaluate functions or content reserved for other normal users.

[0078] The present invention provides an intrusion detection system based on deep learning. By setting a deep learning model library and a historical data acquisition module, users can customize data learning plans to achieve highly customized intrusion detection. At the same time, a model algorithm library is provided. By learning data relationships through a new learning strategy, the effect of deep learning models on data relationship learning can be improved, thereby solving the technical problem of poor data learning effect in the existing deep learning process, and ultimately improving the accuracy and efficiency of network intrusion detection.

[0079] In an embodiment of the present invention, a collaborative hyperparameter optimization algorithm is used to enable a target deep learning model to learn training data, thereby obtaining a target deep learning model with network traffic feature detection capability, including:

[0080] S1. Initialize the population to obtain multiple individuals to be trained; wherein the individual to be trained is a vector containing the parameters to be optimized of the target deep learning model;

[0081] Optionally, a random initialization method can be used to randomly initialize between the upper and lower limits of the parameters of the target deep learning model to obtain an individual, and repeatedly obtain multiple different individuals to obtain a population.

[0082] S2. Based on the training data, obtain the fitness value corresponding to each individual to be trained, and determine the individual to be trained with the largest fitness value as the optimal individual;

[0083] For example, after applying the hyperparameters contained in the individual to the target deep learning model, the historical network traffic characteristics can be used as input, and the historical network intrusion results corresponding to the network traffic characteristics can be used as the expected label to obtain the cross entropy loss function. After adding the cross entropy loss function to a very small constant (such as 0.0001), take the inverse to obtain the fitness value corresponding to the individual.

[0084] S3, for the best individual in the t-th training process, use the individual with the largest fitness value in the previous t-th training process to search the best position for the current best individual, and obtain the best individual after the optimal search;

[0085] S4, for other individuals to be trained except the optimal individual, use the spiral and information interaction strategy to perform local area search on other individuals to be trained, and obtain other individuals to be trained after the local area search;

[0086] S5. For all individuals in the current population, the position change search strategy is used to search the unknown area for all individuals, and the greedy algorithm is used to control the search process to obtain the individuals after the unknown area search;

[0087] S6. Based on the individuals after searching the unknown area, obtain the best individual and the worst individual;

[0088] S7, for the best individual and the worst individual, use the adaptive perturbation search strategy to perform global search to obtain the individual after the global search;

[0089] S8. Determine whether the current number of iterations is greater than or equal to the maximum number of iterations. If so, re-obtain the optimal individual based on the individual after the global search, and use the re-obtained optimal individual as the final parameter of the target deep learning model to obtain the target deep learning model with network traffic feature detection capabilities. Otherwise, return to the optimal search step.

[0090] In the embodiment of the present invention, the individual with the largest fitness value in the previous t training processes is used to search the optimal position of the current optimal individual, and the optimal individual after the optimal search is obtained as follows:

[0091]

[0092] Among them, G t Represents the individual with the largest fitness value during the first t training processes; represents the best individual in the current training process, that is, the best individual in the t-th training process; γ represents a random number that obeys the N(0,1) distribution, Represents the optimal individual after optimal search.

[0093] The optimal individual is the one with the best position. Developing it near its historical optimal position helps improve the algorithm's good development performance.

[0094] In the embodiment of the present invention, for other individuals to be trained except the optimal individual, a spiral and information interaction strategy is used to perform a local area search on other individuals to be trained, and other individuals to be trained after the local area search are obtained, including:

[0095] Except for the best individual, the other individuals to be trained are randomly paired with each other, and the paired individual corresponding to the i-th individual to be trained is obtained as Where i = 1, 2, ..., I-1, I represents the total number of all individuals. When the number of other individuals to be trained is odd, the optimal individual is determined to be the paired individual corresponding to the last other individual to be trained;

[0096] The spiral search for each other individual to be trained is:

[0097]

[0098] α=exp(-5*(1-t / t max ))

[0099] in, represents the i-th other individual to be trained, represents the optimal individual after optimal search, express The corresponding spiral search value, π represents the ratio of circumference to circumference, e represents the natural constant, α represents the intermediate parameter, R represents the random number between (-1,1), t max Indicates the maximum number of training times;

[0100] Based on the spiral search value corresponding to each other individual to be trained, the information interaction between the paired individuals corresponding to the other individuals to be trained is:

[0101]

[0102] Among them, r1 represents a random number between (0,1); It represents other individuals to be trained after the local area search, that is, other individuals to be trained after the local area search.

[0103] Using the variable spiral search strategy, individuals first perform variable spiral searches in different directions. While balancing the global and local search capabilities, the ability to explore unknown areas is increased. Finally, the two individuals exchange information, thereby improving the local search capability.

[0104] In the embodiment of the present invention, for all individuals in the current population, a position change search strategy is used to search all individuals in an unknown area, and a greedy algorithm is used to control the search process to obtain individuals after the unknown area search, including:

[0105] Based on the current number of training times, the adaptive search factor is determined as:

[0106] η t+1 =η t +sin(0.5π*(t / tmax ) k )

[0107] Among them, η t represents the adaptive search factor in the t-th training process, η t+1 represents the adaptive search control factor in the t+1th training process, t max represents the maximum number of training times, k represents the control factor; when t is an odd number, k is 1; when t is an even number, k is 2;

[0108] By setting the adaptive search factor, the diversity of the population can be increased, which can effectively prevent the algorithm from falling into the local optimum.

[0109] Based on the adaptive search factor, the unknown area search for all individuals is:

[0110]

[0111] in, represents the jth individual in the population after the local area search in the tth training process, j = 1, 2, ..., I, H represents the upper bound vector, L represents the lower bound vector, c represents the learning factor between (0, 1), Represents the individual after searching the unknown area

[0112] Through the above unknown area search strategy for all individuals, individuals can be mapped to unknown areas, which can effectively improve the search capability of unknown local areas and help find the global optimal solution.

[0113] Judging individuals Is the fitness value of If the fitness value is , then the individual after the unknown area search is accepted, otherwise the individual after the unknown area search is rejected.

[0114] In the embodiment of the present invention, an adaptive perturbation search strategy is used to perform a global search for the best individual and the worst individual, and the individuals after the global search are obtained, including:

[0115]

[0116] in, It represents the optimal individual retrieved based on the individual after searching the unknown area during the t-th training process. represents the optimal individual after global search, f w Indicates the fitness value corresponding to the worst individual, f grepresents the fitness value corresponding to the optimal individual, ξ represents the nonlinear control factor, r2 represents a random number between (0,1), V0 represents the initial update speed, β represents the speed increment, represents the worst individual in the tth training process, represents the worst individual after global search, t max represents the maximum number of training times, e represents a natural constant, V 0,d represents the d-th dimension parameter in the initial update speed, d = 1, 2, ..., D, D represents the total dimension of the hyperparameters in the individual, represents the d-th dimension parameter in the worst individual, represents random individuals other than the best individual and the worst individual, l wg represents the Euclidean distance between the best individual and the worst individual, ε represents the constant term, and ε=0.0001.

[0117] Through the variable speed search strategy, the two can interact with each other to different degrees, which increases the probability of global jumps, and thus increases the probability of the algorithm jumping out of the local optimum. The gradually increasing speed is also beneficial to reducing the probability of the algorithm falling into the local optimum in the later stage.

[0118] Optionally, out-of-bounds processing can be performed on each updated individual to ensure that all parameters are within the constraints.

[0119] In the embodiment of the present invention, it also includes: an intelligent alarm module;

[0120] The intelligent alarm module is used to generate abnormal warning information when the network intrusion detection result is abnormal, and transmit the abnormal warning information to the device specified by the user.

[0121] In the embodiment of the present invention, it also includes: an enhanced monitoring module;

[0122] The enhanced monitoring module is used to increase the data sampling frequency of the monitoring data acquisition module when the network intrusion detection result is in an abnormal state, so that the data sampling frequency corresponds to the network intrusion detection result, thereby enhancing intrusion detection.

[0123] By setting up intelligent alarm modules and enhanced monitoring modules, users can be assisted in exception handling to the greatest extent, thereby reducing network exception time and effectively ensuring system security.

[0124] Those skilled in the art will readily appreciate other embodiments of the present invention after considering the specification and practicing the invention disclosed herein. The present invention is intended to cover any variations, uses or adaptations of the present invention that follow the general principles of the present invention and include common knowledge or customary techniques in the art that are not disclosed by the present invention. It should be understood that the present invention is not limited to the precise structure described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from the scope thereof. The scope of the present invention is limited only by the appended claims.

Claims

1. A deep learning-based intrusion detection system, characterized in that: include: Deep learning model library, model algorithm library, historical data acquisition module, monitoring data acquisition module and intrusion detection module; The deep learning model library is used to provide a variety of different deep learning models, and obtain a target deep learning model in response to a model determination instruction input by a user through human-computer interaction; The historical data acquisition module is used to acquire historical network traffic characteristics and historical network intrusion results corresponding to the network traffic characteristics to obtain training data; The model algorithm library is used to use a collaborative hyperparameter optimization algorithm to enable the target deep learning model to learn the training data, thereby obtaining a target deep learning model with network traffic feature detection capability; The monitoring data acquisition module is used to collect current network traffic characteristics and obtain monitoring data; The intrusion detection module is used to schedule the target deep learning model obtained by the model algorithm library to analyze the monitoring data to obtain the network intrusion detection result; The collaborative hyperparameter optimization algorithm is used to enable the target deep learning model to learn the training data, and obtain the target deep learning model with network traffic feature detection capabilities, including: Initialize the population to obtain multiple individuals to be trained; the individual to be trained is a vector containing the parameters to be optimized of the target deep learning model; Based on the training data, the fitness value corresponding to each individual to be trained is obtained, and the individual to be trained with the largest fitness value is determined as the optimal individual; For the best individual in the t-th training process, use the individual with the largest fitness value in the previous t training processes to search for the best position of the current best individual, and obtain the best individual after the optimal search; For the individuals to be trained except the optimal individual, the spiral and information interaction strategies are used to search the local areas of the individuals to be trained, and the other individuals to be trained after the local area search are obtained; For all individuals in the current population, the position change search strategy is used to search the unknown area for all individuals, and the greedy algorithm is used to control the search process to obtain the individuals after the unknown area search; Based on the individuals after searching the unknown area, the best individual and the worst individual are obtained; For the best individual and the worst individual, an adaptive perturbation search strategy is used to perform a global search to obtain the individual after the global search; Determine whether the current number of iterations is greater than or equal to the maximum number of iterations. If so, re-obtain the optimal individual based on the individual after the global search, and use the re-obtained optimal individual as the final parameter of the target deep learning model to obtain the target deep learning model with network traffic feature detection capabilities. Otherwise, return to the optimal search step.

2. The deep learning-based intrusion detection system according to claim 1, characterized in that: The deep learning model library includes at least CNN, CNN-LSTM, LSTM and BP deep learning models.

3. The deep learning-based intrusion detection system according to claim 1, characterized in that: The historical network traffic characteristics include basic attributes of TCP connections, content characteristics of TCP connections, time-based network traffic statistical characteristics, and host-based network traffic statistical characteristics.

4. The deep learning-based intrusion detection system according to claim 1, characterized in that: The individual with the largest fitness value in the previous t training processes is used to search the optimal position of the current optimal individual. The optimal individual after the optimal search is: Among them, G t Represents the individual with the largest fitness value during the first t training processes; represents the best individual in the current training process, that is, the best individual in the t-th training process; γ represents a random number that obeys the N(0,1) distribution, Represents the optimal individual after optimal search.

5. The deep learning-based intrusion detection system according to claim 4, characterized in that: For the other individuals to be trained except the optimal individual, the spiral and information interaction strategies are used to search the local area of ​​the other individuals to be trained, and the other individuals to be trained after the local area search are obtained, including: Except for the best individual, the other individuals to be trained are randomly paired with each other, and the paired individual corresponding to the i-th individual to be trained is obtained as Where i = 1, 2, ..., I-1, I represents the total number of all individuals. When the number of other individuals to be trained is odd, the optimal individual is determined to be the paired individual corresponding to the last other individual to be trained; The spiral search for each other individual to be trained is: α=exp(-5*(1-t / t max )) in, represents the i-th other individual to be trained, represents the optimal individual after optimal search, express The corresponding spiral search value, π represents the circumference of a circle, e represents a natural constant, α represents an intermediate parameter, R represents a random number between (-1,1), t max Indicates the maximum number of training times; Based on the spiral search value corresponding to each other individual to be trained, the information interaction between the paired individuals corresponding to the other individuals to be trained is: Among them, r1 represents a random number between (0,1); It represents other individuals to be trained after the local area search, that is, other individuals to be trained after the local area search.

6. The deep learning-based intrusion detection system according to claim 5, characterized in that: For all individuals in the current population, the position transformation search strategy is used to search the unknown area for all individuals, and the greedy algorithm is used to control the search process to obtain the individuals after the unknown area search, including: Based on the current number of training times, the adaptive search factor is determined as: or t+1 =the t +sin(0.5π*(t / t max ) k ) Among them, η t represents the adaptive search factor in the t-th training process, η t+1 represents the adaptive search control factor in the t+1th training process, t max represents the maximum number of training times, k represents the control factor; when t is an odd number, k is 1; when t is an even number, k is 2; Based on the adaptive search factor, the unknown area search for all individuals is: in, represents the jth individual in the population after the local area search in the tth training process, j = 1, 2, ..., I, H represents the upper bound vector, L represents the lower bound vector, c represents the learning factor between (0, 1), Represents the individual after searching the unknown area Judging individuals Is the fitness value greater than that of individual If the fitness value is , then the individual after the unknown area search is accepted, otherwise the individual after the unknown area search is rejected.

7. The deep learning-based intrusion detection system according to claim 6, characterized in that: For the best individual and the worst individual, an adaptive perturbation search strategy is used to perform a global search to obtain the individuals after the global search, including: in, It represents the optimal individual retrieved based on the individual after searching the unknown area during the t-th training process. represents the optimal individual after global search, f w Indicates the fitness value corresponding to the worst individual, f g represents the fitness value corresponding to the optimal individual, ξ represents the nonlinear control factor, r2 represents a random number between (0,1), V0 represents the initial update speed, β represents the speed increment, represents the worst individual in the tth training process, represents the worst individual after global search, t max represents the maximum number of training times, e represents a natural constant, V 0,d represents the d-th dimension parameter in the initial update speed, d = 1, 2, ..., D, D represents the total dimension of the hyperparameters in the individual, represents the d-th dimension parameter in the worst individual, represents random individuals other than the best individual and the worst individual, l wg represents the Euclidean distance between the best individual and the worst individual, ε represents the constant term, and ε=0.0001.

8. The deep learning-based intrusion detection system according to claim 1, characterized in that: Also includes: Intelligent alarm module; The intelligent alarm module is used to generate abnormal warning information when the network intrusion detection result is abnormal, and transmit the abnormal warning information to the device specified by the user.

9. The deep learning-based intrusion detection system according to claim 1, characterized in that: Also includes: Enhanced monitoring module; The enhanced monitoring module is used to increase the data sampling frequency of the monitoring data acquisition module when the network intrusion detection result is in an abnormal state, so that the data sampling frequency corresponds to the network intrusion detection result, thereby enhancing intrusion detection.

Images