A network intrusion detection method, system, medium and device based on K-means and CNN

Abstract

The present invention provides a network intrusion detection method, system, medium and device based on K-means and CNN. The method includes: a network attack learning phase: first, using the K-means algorithm to cluster traffic features, then using CNN to extract spatial features for each cluster data, and finally establishing a correspondence between the CNN feature learning results and the network attack pattern through supervised learning, ultimately outputting the K-means cluster center and the learned CNN model to obtain network attack identification knowledge; a network attack identification phase: based on the network attack identification knowledge, analyzing unknown traffic, completing network attack identification and realizing network intrusion detection by determining the cluster to which the unknown traffic belongs and weighted fusion of the output results of multiple CNN models. The present invention adopts K-means clustering and multi-CNN model fusion to improve network intrusion detection performance.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method, system, medium and device based on K-means and CNN. Background Art

[0002] With the rapid development of artificial intelligence technology, machine learning and deep learning algorithms are playing an increasingly important role in network intrusion detection. From the perspective of network traffic analysis, both supervised and unsupervised learning are based on the extraction and learning of sample features. The effectiveness of feature extraction and learning directly correlates to the accuracy of intrusion detection results. Typically, network environments have a wide variety of attack patterns, and some attacks exhibit similar data characteristics, which can easily lead to errors in attack pattern identification. The feature extraction and learning process also involves many difficult issues, such as feature construction methods, data cleaning methods, data sampling techniques, deep learning model construction, and learning parameter optimization. Therefore, network attack pattern feature extraction and learning are key to network intrusion detection.

[0003] Currently, in network intrusion detection based on deep learning, a widely used neural network is the Convolutional Neural Network (CNN). In specific implementations, researchers usually characterize traffic data and then directly use CNN for spatial feature extraction. It is rare to cluster traffic features and then perform spatial feature extraction separately before CNN feature processing. To this end, based on this research idea, the present invention proposes a network intrusion detection method based on K-means and CNN, which adds a K-means feature clustering process to the CNN front end, and uses clustered features for further feature learning and network attack identification, thereby improving network intrusion detection performance. Summary of the Invention

[0004] The present invention aims to provide a network intrusion detection method, system, medium and device based on K-means and CNN to solve: (1) the problem of effectively combining the K-means algorithm and CNN to realize network intrusion detection; (2) the problem of selecting CNN and calculating the weight factor when weighted fusion of each CNN is performed when identifying network attacks.

[0005] The present invention provides a network intrusion detection method based on K-means and CNN, comprising:

[0006] (1) Network attack learning:

[0007] Step 11: training data preprocessing;

[0008] Step 12: Cluster the preprocessed training data according to the K-means clustering principle to obtain multiple clusters of training data and corresponding cluster centers;

[0009] Step 13: Build multiple CNN models to learn the training data under different clusters;

[0010] Step 14: Perform multiple rounds of training according to step 13 to obtain multiple CNN model weights under corresponding training data;

[0011] Step 15: Output the multiple cluster centers obtained in step 12 and the multiple CNN model weights obtained in step 14 for subsequent network attack identification;

[0012] (2) Network attack identification:

[0013] Step 21: Test data preprocessing;

[0014] Step 22: Determine the cluster to which the preprocessed test data belongs;

[0015] Step 23: Select a CNN model based on the cluster to which the test data belongs and perform network attack identification;

[0016] Step 24: Calculate the weights for weighted fusion of the CNN model network attack recognition results;

[0017] Step 25: Based on the weights of the weighted fusion of the CNN models obtained in step 24, perform a weighted sum of the network attack recognition result scores of the selected CNN model, and then select the attack type with the highest score after the weighted sum as the final identified attack type.

[0018] Furthermore, training data preprocessing and test data preprocessing include:

[0019] The non-numerical features in the traffic features in the training data or test data are digitized by label encoding, and then the Min-Max method is used to normalize each traffic feature.

[0020] Furthermore, the Min-Max method is used to normalize each traffic feature and express it as:

[0021]

[0022] Where x ij is the value of the feature of the jth column of the i-th data.

[0023] Furthermore, in step 13, when learning the training data under different clusters, the CNN model parameters are adjusted according to the cross entropy of the feature learning results as the loss value.

[0024] Furthermore, in step 22, determining the cluster to which the preprocessed test data belongs includes:

[0025] Calculate the distance between the test data and the cluster center. The distance between the i-th test data and the cluster center j is expressed as L ij , and then the category represented by the shortest distance is taken as the cluster to which the test data belongs.

[0026] Furthermore, in step 23, selecting a CNN model based on the cluster to which the test data belongs and performing network attack identification includes:

[0027] Assume that the number of CNN models involved in network attack identification is m. For the i-th test data, select the distance L ij The minimum m CNN models participate in network attack recognition and output network attack recognition results.

[0028] Furthermore, in step 24, the weights for calculating the weighted fusion of the CNN model network attack recognition results include:

[0029] According to the distance L ij The weight of the CNN model when identifying the i-th test data is calculated as follows:

[0030]

[0031] Among them, w CNN-j It represents the weight of the weighted fusion of the output results of the j-th CNN model when identifying the i-th test data, and N is the total number of clusters.

[0032] The present invention also provides a network intrusion detection system based on K-means and CNN, which is used to execute the above-mentioned network intrusion detection method based on K-means and CNN;

[0033] The system comprises:

[0034] A network attack learning module, used for executing the steps of network attack learning;

[0035] The network attack identification module is used to perform the steps of network attack identification.

[0036] The present invention also provides a computer terminal storage medium storing computer terminal executable instructions, wherein the computer terminal executable instructions are used to execute the above-mentioned network intrusion detection method based on K-means and CNN.

[0037] The present invention further provides a computing device, comprising:

[0038] At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the above-mentioned network intrusion detection method based on K-means and CNN.

[0039] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are:

[0040] First, we introduce the K-means algorithm to perform coarse learning of attack pattern features, and then use CNN to perform fine learning of features to improve the ability to learn traffic features.

[0041] Second, it makes full use of the characteristics of K-means clustering, and calculates the weights of each CNN model involved in network attack identification based on the distance between the traffic characteristics to be identified and the centers of the K-means clustering, so as to facilitate the weighted fusion of the output results of multiple CNN models. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings in the embodiments will be briefly introduced below. It should be understood that the following drawings only illustrate certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without paying any creative work.

[0043] Figure 1 Flowchart of a network intrusion detection method based on K-means and CNN in an embodiment of the present invention. DETAILED DESCRIPTION

[0044] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions of the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Generally, the components of the embodiments of the present invention described and shown in the drawings herein can be arranged and designed in various different configurations.

[0045] Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the invention as claimed, but rather merely represents selected embodiments of the present invention. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without creative effort are intended to fall within the scope of protection of the present invention.

[0046] Example

[0047] like Figure 1As shown, this embodiment proposes a network intrusion detection method based on K-means and CNN. Its core idea is to divide the learning of traffic features in the network into two stages. First, the K-means algorithm is used to cluster the traffic features. Then, the CNN model is used to extract spatial features for each cluster data. Finally, the feature learning results of the CNN model are correlated with the network attack pattern through supervised learning to obtain a network attack recognition model. The network attack recognition model is then used to identify network attacks, thereby completing network intrusion detection. Specifically, it includes:

[0048] (1) Network attack learning:

[0049] Step 11: Training data preprocessing.

[0050] Input the training data, perform label encoding on the non-numerical features in the traffic features in the training data to complete the numerical conversion, and then normalize each traffic feature using the Min-Max method, which is expressed as:

[0051]

[0052] Where x ij is the value of the feature of the jth column of the i-th data.

[0053] Step 12: Clustering of training data.

[0054] According to the K-means clustering principle, the preprocessed training data is clustered to obtain multiple clusters of training data and corresponding cluster centers.

[0055] Step 13: Feature learning.

[0056] Construct multiple CNN models to learn the training data under different clusters respectively, and adjust the CNN model parameters based on the cross entropy of the feature learning results as the loss value.

[0057] Step 14: Perform multiple rounds of training according to step 13 to obtain multiple CNN model weights under corresponding training data;

[0058] Step 15: Output the multiple cluster centers obtained in step 12 and the multiple CNN model weights obtained in step 14 for subsequent network attack identification.

[0059] (2) Network attack identification:

[0060] Step 21: Data preprocessing.

[0061] Input the test data, perform label encoding on the non-numerical features in the traffic features to be tested in the test data to complete the digitization, and then normalize each traffic feature to be tested using the Min-Max method.

[0062] Step 22: Determine the cluster to which the preprocessed test data belongs.

[0063] Calculate the distance between the test data and the K-means cluster center. The distance between the i-th test data and the cluster center j is expressed as L ij , and then the category represented by the shortest distance is taken as the cluster to which the test data belongs.

[0064] Step 23: Select a CNN model based on the cluster to which the test data belongs and perform network attack identification.

[0065] Assume that the number of CNN models involved in network attack identification is m. For the i-th test data, select the distance L ij The minimum m CNN models participate in network attack recognition and output network attack recognition results.

[0066] Step 24: Calculate the weights for weighted fusion of the CNN model network attack recognition results.

[0067] According to the distance L ij The weight of the CNN model when identifying the i-th test data is calculated as follows:

[0068]

[0069] Among them, w CNN-j It represents the weight of the weighted fusion of the output results of the j-th CNN model when identifying the i-th test data, and N is the total number of clusters.

[0070] Step 25: Fusion of network attack identification results.

[0071] According to the weights of the weighted fusion of the CNN models obtained in step 24, the network attack recognition result scores of the selected CNN model are weighted summed, and then the attack type with the highest score after the weighted sum is selected as the final identified attack type.

[0072] At this point, network intrusion detection is completed.

[0073] Experimental analysis:

[0074] Table 1, experimental data set:

[0075] Dataset training set Validation set Test set UNSW-NB15 140273 35068 82332 CICIDS2017 1008392 252097 840325

[0076] The experimental conditions were set as follows:

[0077] (1) The experimental hardware is: 11th Gen Intel(R) Core(TM) i9-11900, 2.50GHz CPU, 64.0GB RAM; the software environment is: Windows 10 operating system, TensorFlow-CPU 2.2.0 deep learning framework, Python 3.6.13.

[0078] (2) Experiments were conducted using the UNSW-NB15 and CICIDS2017 datasets, see Table 1 for details;

[0079] (3) The baseline method performs intrusion detection based on a single CNN. The multiple CNN structures used in this method are consistent with the CNN structure of the baseline method. The CNN structures are shown in Table 2.

[0080] Table 2, CNN structure:

[0081]

[0082]

[0083] (4) The evaluation indicators are F1 value and accuracy;

[0084] (5) The number of K-means clusters is set to 4, so the total number of CNNs is also 4.

[0085] (6) When analyzing the UNSW-NB15 dataset, the batch size is set to 25, and when analyzing the CICIDS2017 dataset, the batch size is set to 128.

[0086] (7) The learning rate is set to 0.0001, the number of training epochs is set to 30, and the optimizer is Adam().

[0087] Table 3 presents the network intrusion detection results for different datasets. The results demonstrate that compared to baseline methods, the proposed method achieves superior F1 and accuracy for intrusion detection. For example, on the UNSW-NB15 dataset, the proposed method achieves an F1 value and accuracy of 74.97% and 77.24% (weighted sum of two CNNs from similar clusters), respectively, representing improvements of 11.11% and 15.1% over the baseline method. On the CICIDS2017 dataset, the proposed method achieves an F1 value and accuracy of 99.13% and 99.21%, respectively, representing improvements of 0.27% and 0.21% over the baseline model (selecting only one CNN from the same cluster). This demonstrates that the proposed network intrusion detection method is feasible and effective, and that K-means clustering and multi-CNN fusion can improve the model's network intrusion detection performance.

[0088] Table 3, Network intrusion detection results:

[0089]

[0090] In addition, in some embodiments, a network intrusion detection system based on K-means and CNN is proposed to perform the above-mentioned network intrusion detection method based on K-means and CNN;

[0091] The system comprises:

[0092] The network attack learning module is used to perform the steps of network attack learning. The detailed steps are as mentioned above and will not be repeated here;

[0093] The network attack identification module is used to perform the steps of network attack identification. The detailed steps are as mentioned above and will not be repeated here.

[0094] In addition, in some embodiments, a computer terminal storage medium is provided, which stores computer terminal executable instructions, wherein the computer terminal executable instructions are used to execute the network intrusion detection method based on K-means and CNN as described in the above embodiments. Examples of computer storage media include magnetic storage media (e.g., floppy disks, hard disks, etc.), optical recording media (e.g., CD-ROMs, DVDs, etc.), or memories such as memory cards, ROMs, or RAMs. Computer storage media can also be distributed on network-connected computer systems, such as application stores.

[0095] In addition, some embodiments provide a computing device comprising: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network intrusion detection method based on K-means and CNN as described in the above embodiments. Examples of computing devices include PCs, tablet computers, smartphones, or PDAs.

[0096] The foregoing description is merely a preferred embodiment of the present invention and is not intended to limit the present invention. Those skilled in the art will readily appreciate that various modifications and variations of the present invention are possible. Any modifications, equivalent substitutions, or improvements made within the spirit and principles of the present invention are intended to be within the scope of protection of the present invention.

Claims

1. A network intrusion detection method based on K-means and CNN, characterized in that: include: (1) Network attack learning: Step 11: training data preprocessing; Step 12: Cluster the preprocessed training data according to the K-means clustering principle to obtain multiple clusters of training data and corresponding cluster centers; Step 13: Build multiple CNN models to learn the training data under different clusters; Step 14: Perform multiple rounds of training according to step 13 to obtain multiple CNN model weights under corresponding training data; Step 15: Output the multiple cluster centers obtained in step 12 and the multiple CNN model weights obtained in step 14 for subsequent network attack identification; (2) Network attack identification: Step 21: Test data preprocessing; Step 22: Determine the cluster to which the preprocessed test data belongs; Step 23: Select a CNN model based on the cluster to which the test data belongs and perform network attack identification; Step 24: Calculate the weights for weighted fusion of the CNN model network attack recognition results; Step 25: Based on the weights of the weighted fusion of the CNN models obtained in step 24, perform a weighted sum of the network attack recognition result scores of the selected CNN model, and then select the attack type with the highest score after the weighted sum as the final identified attack type.

2. The network intrusion detection method based on K-means and CNN according to claim 1 is characterized in that: Training data preprocessing and test data preprocessing include: The non-numerical features in the traffic features in the training data or test data are digitized by label encoding, and then the Min-Max method is used to normalize each traffic feature.

3. The network intrusion detection method based on K-means and CNN according to claim 2 is characterized in that: The Min-Max method is used to normalize each flow characteristic and express it as: Where x ij is the value of the feature of the jth column of the i-th data.

4. The network intrusion detection method based on K-means and CNN according to claim 1, characterized in that: In step 13, when learning the training data under different clusters, the CNN model parameters are adjusted according to the cross entropy of the feature learning results as the loss value.

5. The network intrusion detection method based on K-means and CNN according to claim 1, characterized in that: In step 22, determining the cluster to which the preprocessed test data belongs includes: Calculate the distance between the test data and the cluster center. The distance between the i-th test data and the cluster center j is expressed as L ij , and then the category represented by the shortest distance is taken as the cluster to which the test data belongs.

6. The network intrusion detection method based on K-means and CNN according to claim 1, characterized in that: In step 23, selecting a CNN model based on the cluster to which the test data belongs and performing network attack identification includes: Assume that the number of CNN models involved in network attack identification is m, and the distance L is selected for the i-th test data. ij The minimum m CNN models participate in network attack recognition and output network attack recognition results.

7. The network intrusion detection method based on K-means and CNN according to claim 1, characterized in that: In step 24, the weights for calculating the weighted fusion of the CNN model network attack recognition results include: According to the distance L ij The weight of the CNN model when identifying the i-th test data is calculated as follows: Among them, w CNN-j It represents the weight of the weighted fusion of the output results of the j-th CNN model when identifying the i-th test data, and N is the total number of clusters.

8. A network intrusion detection system based on K-means and CNN, characterized by: Used to execute the network intrusion detection method based on K-means and CNN according to any one of claims 1 to 7; The system comprises: A network attack learning module, used for executing the steps of network attack learning; The network attack identification module is used to perform the steps of network attack identification.

9. A computer terminal storage medium storing computer terminal executable instructions, characterized in that: The computer terminal executable instructions are used to execute the network intrusion detection method based on K-means and CNN as described in any one of claims 1 to 8.

10. A computing device, characterized in that: include: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the network intrusion detection method based on K-means and CNN according to any one of claims 1 to 8.

Images