Network intrusion detection method based on deep learning

Abstract

The invention relates to a network intrusion detection method based on deep learning, and the method comprises the steps: obtaining to-be-detected network flow data, inputting the to-be-detected network flow data into an encoder network in a trained variational auto-encoder, and extracting a representation vector; and inputting the representation vector into the trained classifier network for classification, and outputting a final detection result of the intrusion category. The classifier network post-training process comprises the following steps: acquiring a second training data set with a specific label, preprocessing the second training data set, inputting the preprocessed second training data set into an encoder network in the trained variational auto-encoder, and extracting a representation vector; respectively carrying out clustering, filtering and oversampling processing on the characterization vector to obtain an enhanced characterization vector; respectively carrying out feature extraction and feature fusion on the enhanced representation vectors; and inputting the fusion features into a classifier network for classification prediction, calculating classification loss, and iteratively optimizing the classifier network according to the classification loss. According to the invention, the detection performance of network intrusion detection can be improved.

Description

Technical Field

[0001] The present invention belongs to the technical field of network information security, and in particular relates to a network intrusion detection method based on deep learning. Background Art

[0002] With the popularization of the Internet and the improvement of information technology, network attacks and intrusion incidents are becoming more and more frequent. Network intrusion detection technology can help organizations and individuals to timely discover and respond to network threats, protect network security, and prevent risks such as data leakage and service interruption.

[0003] At present, many methods are studying how to better apply deep learning to the field of network intrusion detection, especially focusing on improving the detection performance of network intrusion detection. However, the datasets currently used in the research of network intrusion detection methods generally have the problem of sample data imbalance. When the amount of sample data is small, the network intrusion detection method cannot learn the characteristics of this type of sample well, resulting in poor performance of network intrusion detection and extremely high network security risks. Summary of the invention

[0004] In order to solve the above technical problems, the purpose of the present invention is to provide a network intrusion detection method based on deep learning, which can solve the problems of poor data quality and low detection rate generated by traditional methods.

[0005] The present invention provides a network intrusion detection method based on deep learning, which comprises: obtaining network traffic data to be detected and preprocessing the data; extracting a representation vector from the preprocessed network traffic data to be detected through an encoder network in a trained variational autoencoder; inputting the representation vector into a trained classifier network for classification, and outputting a final detection result of the intrusion category;

[0006] The training process of the classifier network includes:

[0007] Obtain a second training data set with specific labels and preprocess it;

[0008] Mapping the preprocessed second training data to the latent space through the encoder network in the trained variational autoencoder, extracting the latent variable representation, and obtaining the representation vector of the second training data;

[0009] Performing clustering, filtering and oversampling processing on the representation vectors respectively to obtain enhanced representation vectors;

[0010] Extracting spatial features and temporal features of the enhanced representation vector;

[0011] Fusing the spatial features and the temporal features to obtain fused features;

[0012] The fused features are input into the classifier network for classification prediction, the classification loss of the predicted label and the true label is calculated, and the classifier network is iteratively optimized according to the classification loss.

[0013] Furthermore, the training process of the variational autoencoder includes:

[0014] Obtain a first training data set and preprocess it;

[0015] The preprocessed training data is fed into the encoder network of the variational autoencoder to map it to the latent space;

[0016] Calculate the mean and variance of the latent space, sample latent variables from it, and calculate the KL divergence loss of the latent space;

[0017] Input the latent variables into the decoder network of the variational autoencoder, remap them into reconstructed data, and calculate the reconstruction loss between the reconstructed data and the training data;

[0018] According to the sum of KL divergence loss and reconstruction loss, the variational autoencoder is iteratively optimized using the back-propagation algorithm.

[0019] Beneficial effects of the present invention:

[0020] Firstly, the present invention pre-trains a variational autoencoder, and uses the encoder network in the trained variational autoencoder as the encoder network of the intrusion detection network; the encoder network is used to extract a representation vector from the pre-processed network traffic data to be detected, and the representation vector well retains the important features of the network intrusion detection training sample data, reduces the dimension of the network intrusion data to be detected, thereby solving the problem of sparse data distribution caused by the high dimension of the current network intrusion data set, and is beneficial to improving the prediction performance of network intrusion detection.

[0021] Secondly, when training the classifier network, the present invention extracts a representation vector from the preprocessed second training data (with a specific label) through the encoder network in the trained variational autoencoder; k-means clustering, unstable cluster filtering and borderlineSMOTE oversampling are performed on the representation vector respectively, so that the category distribution in the second training data set (i.e., the network intrusion data sample set) is more balanced, and low-frequency attack samples (i.e., a minority of samples) will not be regarded as noise data and ignored, thereby achieving the effect of data sample enhancement, thereby improving the detection capability of low-frequency attack behaviors and improving the prediction performance of network intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] Figure 1 It is the overall flow chart of the present invention;

[0023] Figure 2Schematic diagram of the variational autoencoder training and testing process in an embodiment of the present invention;

[0024] Figure 3 Schematic diagram of the filtering process in an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The terms "first", "second", etc. in the specification and claims of this application are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the terms used in this way can be interchangeable under appropriate circumstances. This is just a way of distinguishing objects with the same attributes when describing the embodiments of this application.

[0026] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0027] Terminology explanation:

[0028] SMOTE (Synthetic Minority Oversampling Technique) algorithm: Synthetic minority oversampling algorithm, which is an oversampling algorithm improved on the basis of random sampling.

[0029] The borderlineSMOTE algorithm is an improved oversampling algorithm based on the SMOTE algorithm. This algorithm only uses minority class samples on the boundary to synthesize new samples, thereby improving the category distribution of samples.

[0030] The embodiment of the present invention proposes a network intrusion detection method based on deep learning. Figure 1 As shown, the method includes: obtaining network traffic data to be detected and preprocessing it; extracting a representation vector from the preprocessed network traffic data to be detected through an encoder network in a trained variational autoencoder; inputting the representation vector into a trained classifier network for classification, and outputting a final detection result of the intrusion category;

[0031] The training process of the classifier network includes:

[0032] S1: obtain a second training data set with specific labels and preprocess it;

[0033] S2: Map the preprocessed second training data to the latent space through the encoder network in the trained variational autoencoder, extract the latent variable representation, and obtain the representation vector of the second training data;

[0034] S3: performing clustering, filtering and oversampling processing on the representation vectors respectively to obtain enhanced representation vectors;

[0035] S4: extracting spatial features and temporal features of the enhanced representation vector;

[0036] S5: Fusing the spatial features and the temporal features to obtain fused features;

[0037] S6: Input the fusion features into the classifier network for classification prediction, calculate the classification loss of the predicted label and the true label, and iteratively optimize the classifier network according to the classification loss.

[0038] The intrusion detection network in the embodiment of the present invention includes an encoder network and a classifier network. The encoder network can adopt the encoder network in the variational autoencoder.

[0039] Figure 1 It is the overall flow chart of the present invention. Figure 1 In the intrusion detection network, there are two training stages: the first training stage is to train the variational autoencoder using the first training data set, and the encoder network in the variational autoencoder after training is used as the encoder network in the second training stage and the detection stage respectively; the second training stage is to train the classifier network using the second training data set with specific labels, and this specific label can be set according to actual needs or the detection classification target of intrusion detection. The classifier network training process includes: obtaining the second training data set and preprocessing it; inputting the preprocessed data into the trained encoder network (i.e., the encoder network in the variational autoencoder after training) for encoding to obtain the representation vector of the data; clustering, filtering, and oversampling the representation vector, and then extracting and fusing features, inputting the fused features into the classifier, calculating the classification loss, and iteratively optimizing the classifier. In the intrusion detection stage, the network traffic data to be detected is obtained and preprocessed; the preprocessed data is encoded using the trained encoder network (i.e., the encoder network in the variational autoencoder after training) to extract the representation vector of the data; the representation vector is input into the trained classifier network for classification, and the final detection result of the intrusion category is output.

[0040] For example: In the vehicle-to-everything (V2X) scenario, deploying the intrusion detection model on the edge computing unit (MEC) requires real-time processing of a large amount of data to ensure traffic safety and efficiency. According to the characteristics of the vehicle-to-everything (V2X) and the communication interaction between MEC and other devices (such as cameras, radars, cloud servers, and RSUs), the data characteristics in this field are: high real-time requirements, diversity and heterogeneity, high bandwidth and low latency, higher security and privacy requirements, and strong mobility. Therefore, in the vehicle-to-everything (V2X) scenario, intrusion detection is difficult and the detection performance is poor.

[0041] For example, the original network data packets of the UNSW-NB15 dataset are created by the IXIA PerfectStorm tool of the Cyber ​​Scope Laboratory of the Australian Cyber ​​Security Center, which can be used to generate mixed data of modern normal activities and synthetic contemporary attack behaviors. Based on the UNSW-NB15 dataset (a total of 49 features), combined with the characteristics of the Internet of Vehicles, the features that need special attention are explained:

[0042] srcip (Source IP address): The IP address of the vehicle or device, which helps to identify the source of the data packet.

[0043] dstip (Destination IP address): The IP address of the destination device or server, which helps to identify the destination of the data packet.

[0044] sport (Source port number): Source port number, which helps identify different services or applications.

[0045] dsport (Destination port number): Destination port number, which helps identify different services or applications.

[0046] proto (Transaction protocol): transport protocol (such as TCP, UDP). Different protocols have different security vulnerabilities.

[0047] state(Connection state): Connection state, which can identify whether the connection is normal.

[0048] dur(Duration): Communication duration, used to identify persistent connections or abnormally long connections.

[0049] sbytes (Source to destination bytes): The size of the data packet from the source to the destination, identifying data leaks or DDoS attacks.

[0050] dbytes (Destination to source bytes): The size of the packet from the destination to the source, identifying anomalies in reverse traffic.

[0051] sload (Source bits per second): Source data traffic rate, used to identify high-traffic attacks.

[0052] dload (Destination bits per second): target data traffic rate, used to identify reverse high-traffic attacks.

[0053] spkts (Source to destination packet count): Source to destination packet count, used to identify scanning attacks.

[0054] dpkts (Destination to source packet count): Destination to source packet count, used to identify reverse scan attacks.

[0055] In some embodiments, the preprocessing specifically includes: screening, one-hot encoding and normalization of the input data.

[0056] Specifically, if the input data includes some irrelevant information, remove the irrelevant information;

[0057] If the input data includes character data (such as categorical data), One-Hot Encoding is used to convert it into an independent binary feature, where only one feature is 1 and the rest are 0;

[0058] The Min-Max normalization method is used to map each feature data to the [0,1] interval. The normalization formula is as follows:

[0059]

[0060] In the formula, x i represents the i-th sample in the input data, y i Represents the normalized data, min(x) represents the minimum value in the input data set x, and max(x) represents the maximum value in the input data set x.

[0061] For example, in the Internet of Vehicles scenario, considering its dynamics, real-time nature, and the particularity of the communication mode, the following features may not be applicable to this scenario and will be discarded in the preprocessing stage;

[0062] ct_srv_src: This feature is used to detect the connection mode. The connection mode of the Internet of Vehicles may be different from that of traditional networks. In particular, the dynamics and heterogeneity of Internet of Vehicles data traffic are high, and the relevance of this feature is low.

[0063] ct_srv_dst: Same as ct_srv_src. The communication mode of the Internet of Vehicles may make this feature less useful in real-time detection.

[0064] ct_dst_ltm: Similarly, the dynamic traffic and high mobility in connected vehicles may make this feature of limited use.

[0065] ct_src_ltm: High mobility IoV scenarios may make this feature inapplicable because the connection statistics of the source address may change frequently.

[0066] ct_src_dport_ltm: In the Internet of Vehicles, frequent port and source address changes make this statistical feature potentially unstable.

[0067] ct_dst_sport_ltm: Same as above. This feature has low stability and reliability in the Internet of Vehicles scenario.

[0068] ct_dst_src_ltm: In the connected vehicle scenario, this feature may not be applicable due to the high dynamics and heterogeneous data sources.

[0069] In an embodiment of the present invention, the variable self-decomposition encoder includes an encoder network and a decoder network. The encoder network includes an input layer, three hidden layers and an output layer, which maps the input data to the mean and variance parameters of the latent space; the decoder network includes an input layer, three hidden layers and an output layer, and the input layer receives the output results from the encoding layer network (i.e., samples of the latent space) and remaps the latent variables back to the reconstructed data. After training the variable self-decomposition encoder. In network intrusion detection, only the encoder network in the trained variable self-decomposition encoder is used to extract the representation vector of the network traffic data to be detected.

[0070] In some embodiments, the training process of the variational autoencoder includes:

[0071] S101: Obtain a first training data set and preprocess it.

[0072] The first training data is used to train the variational autoencoder, with or without labels.

[0073] For example, in an embodiment of the present invention, the first training data set is derived from the open source data set UNSW-NB15, which has a total of 175,341 data records and 10 categories, wherein the name and quantity of each category are shown in Table 1.

[0074] Table 1 Dataset UNSW-NB15

[0075]

[0076]

[0077] Each data has 49 features. The drop() method is used to delete the ["label", "id"] features and other inapplicable features of the data. The "proto", "service", "state", and "attack_cat" character features in the data set are converted into numerical values ​​using One-Hot encoding. Finally, all the data are filled with missing values, and the Min-Max normalization method is used to map each feature data to the [0,1] interval to obtain the preprocessed training set.

[0078] S102: Input the preprocessed training data into the encoder network of the variational autoencoder to map it to a latent space.

[0079] The latent space is a multidimensional Gaussian distribution with mean μ and variance σ generated by the encoder network.

[0080] S103: Calculate the mean and variance of the latent space, sample latent variables from it, and calculate the KL divergence loss of the latent space.

[0081] KL divergence loss is used to measure the difference between the latent variable distribution and the standard normal distribution.

[0082] S104: Input the latent variables into the decoder network of the variational autoencoder, remap them into reconstructed data, and calculate the reconstruction loss between the reconstructed data and the training data.

[0083] The reconstruction loss is used to measure the difference between the reconstructed data and the original data.

[0084] S105: According to the sum of the KL divergence loss and the reconstruction loss, the variational autoencoder is iteratively optimized using the back propagation algorithm.

[0085] The variational autoencoder parameters are optimized by minimizing the reconstruction loss and the KL divergence loss so that the reconstructed data can be as close as possible to the first training data set (ie, the original input data).

[0086] In step S1, the second training data set is labeled, and is a data set with specific labels for training a specific type of classifier.

[0087] In the embodiment of the present invention, the second training data set is derived from the open source data set UNSW-NB15, which has 10 data categories. In order to more conveniently process the category labels in model training, the category labels are converted into numbers (0-9), and the digital labels corresponding to each category are: 'Normal': 0, 'Generic': 1, 'Exploits': 2, 'Fuzzers': 3, 'DoS': 4, 'Reconnaissance': 5, 'Analysis': 6, 'Backdoors': 7, 'Shellcode': 8, 'Worms': 9.

[0088] After processing in step S2, the high-dimensional representation space of the input data (ie, the second training data set) is reduced to a low-dimensional representation of the latent space, thereby reducing the complexity and dimension of the data and making it easier to process later.

[0089] In some embodiments, the K-means algorithm is used to perform clustering on the representation vectors, and the specific process is as follows:

[0090] S201 Initialize cluster centers: randomly select K initial cluster centers.

[0091] From the representation vectors extracted by the encoder network in the variational autoencoder VAE, K points are randomly selected as the initial cluster centers. Appropriate evaluation indicators are selected to evaluate the clustering effect under different numbers of clusters. Common evaluation indicators include elbow rule, silhouette coefficient and Gap statistic, that is, to determine the number of clusters K. These representation vectors represent the characteristics of network traffic data after dimensionality reduction, which can better represent the potential structure of the data.

[0092] S202 Assigning clusters: For each representation vector, calculate its Euclidean distance with each cluster center; assign each representation vector to the cluster to which the cluster center closest to it belongs.

[0093] S203 Update cluster center: For each cluster, calculate the mean of all points in the cluster, that is, calculate the average value of all characterization vectors, and update the cluster center position to this mean point.

[0094] S204 Iteratively update cluster centers: Repeat steps S202 and S203, that is, reallocate each characterization vector to the nearest cluster and update the cluster center position. This process is iterated until the cluster center position no longer changes significantly or reaches a preset maximum number of iterations.

[0095] After clustering, each cluster will contain different categories (UNSW-NB15 dataset has 10 categories). K-means clustering does not group data based on the original category labels, but rather based on the feature similarity of data points. Therefore, data points in a cluster may come from different original categories. For example, a cluster may contain both normal traffic representation vectors and several different types of attack traffic representation vectors.

[0096] After the previous k-means clustering, clusters need to be screened to improve the quality of generated samples. Since most traditional methods do not have clearly defined cluster screening criteria, the generation of synthetic samples is usually based on the global data distribution. When screening clusters, it is more effective to consider clusters that are included in each minority class, so as to ensure that subsequent oversampling can evenly increase the amount of data for each minority class, avoiding some minority classes from being unbalanced in the final data set.

[0097] In some embodiments, the clustered results are filtered, and the specific process is as follows:

[0098] Pre-count the number of each category in the second training data set with specific labels and calculate the median. According to this median, the category with a number less than the median is regarded as a minority category.

[0099] Traverse each cluster after clustering, and filter out the representation vector data belonging to the cluster according to the cluster identifier;

[0100] Calculate the total number of filtered representation vectors, the number of representation vectors for each category, and the proportion of each category in the current cluster;

[0101] Traverse the category distribution of each cluster and check whether the current cluster contains all minority categories. If so, record the cluster;

[0102] Calculate the sum of the proportions of all minority class samples in each cluster, sort them from high to low according to the sum of the proportions of minority class samples, and select the top n clusters with the highest sum of proportions.

[0103] Figure 3 Schematic diagram of the filtering process in an embodiment of the present invention.

[0104] For example, refer to Figure 3 As shown, the clustering results are filtered, and the specific process is as follows:

[0105] S301 calculates the median and identifies the minority class:

[0106] Pre-count the number of each category in the second training data set with specific labels, calculate the median of the number of these 10 categories, and regard the categories with a number less than the median as minority categories. The median of the number is calculated to be 15224.0. Based on this median, the minority categories (categories with a number less than the median) are determined as follows: 'Reconnaissance': 5, 'Analysis': 6, 'Backdoors': 7, 'Shellcode': 8, 'Worms': 9.

[0107] S302 counts the category distribution within each cluster:

[0108] S302a Initialize dictionary:

[0109] Create an empty dictionary cluster_category_distribution to store the distribution of categories in each cluster. The key of this dictionary will be the identifier of each cluster, and the value will be another dictionary to record the proportion of each category in the cluster.

[0110] S302b traverses each cluster:

[0111] Get all unique cluster identifiers in the data frame and iterate over them. There is a column in the data frame that contains the cluster identifier to which each sample belongs. By getting the unique values ​​of this column, you can get the identifiers of all clusters.

[0112] S302c filters the sample data belonging to the current cluster:

[0113] In each iteration, the sample data belonging to the current cluster is filtered out. The specific method is to select all samples of the current cluster by judging whether the cluster identifier of each sample is equal to the cluster identifier of the current iteration. In this way, a sub-data frame containing only the samples of the current cluster can be obtained.

[0114] S302d calculates the total number of samples in the current cluster:

[0115] For the filtered sample data of the current cluster, calculate the total number of samples. The specific method is to calculate the number of rows in the sub-data frame, that is, the number of samples contained in the cluster.

[0116] S302e counts the number of samples in each category in the current cluster:

[0117] The specific method is to obtain the category label column in the current cluster sample data and calculate the number of occurrences of each category label. This will get a dictionary where the key is the category label and the value is the number of samples in that category.

[0118] S302f calculates the proportion of each category in the current cluster:

[0119] The specific method is to traverse the statistically obtained category sample digital dictionary, and for each category, calculate its proportion of the total number of samples in the current cluster. In this way, a new dictionary can be obtained, in which the key is the category label and the value is the corresponding proportion.

[0120] S302g stores the category distribution information of the current cluster:

[0121] The category distribution information of the current cluster is stored in the cluster_category_distribution dictionary. The specific method is: use the identifier of the current cluster as the key and the calculated category ratio dictionary as the value to store it in the cluster_category_distribution dictionary.

[0122] When all the above steps are completed, the cluster_category_distribution dictionary will contain the category distribution information of all clusters. For each cluster identifier, the corresponding value is a dictionary that records the proportion of each category in the cluster. In this way, we can clearly know which category representation vectors are contained in each cluster and their proportions.

[0123] S303 filters out clusters where all minority categories exist:

[0124] S303a defines a minority category list: minority_categories = ['5','6','7','8','9']

[0125] S303b Initialize the list valid_clusters:

[0126] Create an empty list valid_clusters to store the cluster identifiers that meet the conditions.

[0127] S303c traverses the cluster_category_distribution dictionary:

[0128] Iterate over each cluster in the cluster_category_distribution dictionary.

[0129] S303d checks whether all minority categories are included in the current cluster:

[0130] Use the generator expression all(minority_category in ratios for minority_categoryin minority_categories) to check whether all minority categories are included in the current cluster.

[0131] S303e stores the cluster identifiers that meet the conditions:

[0132] If the current cluster contains all minority classes, add the identifier of the cluster, cluster_id, to the valid_clusters list.

[0133] S304 filters clusters with high proportion of minority class samples:

[0134] S304a Initialize the list selected_clusters:

[0135] Create an empty list selected_clusters to store cluster identifiers and the sum of their minority class proportions.

[0136] S304b traverses the valid_clusters list:

[0137] Iterate over each cluster identifier cluster_id in the valid_clusters list.

[0138] S304c obtains the category ratio of the current cluster:

[0139] Get the category ratio dictionary ratios of the current cluster through cluster_category_distribution[cluster_id].

[0140] S304d calculates the sum of the proportions of the minority class:

[0141] Use the list derivation [ratios[minority_category]for minority_category inminority_categories] to get the ratio of all minority categories in the current cluster and get the list minority_ratios. Use sum(minority_ratios) to calculate the total_minority_ratio of all minority category ratios in the current cluster.

[0142] S304f stores the sum of cluster identifiers and their proportions of minority class samples:

[0143] Add the tuple (cluster_id, total_minority_ratio) to the selected_clusters list.

[0144] S304g is sorted from high to low by the total proportion of minority class samples:

[0145] Sort the selected_clusters list from high to low according to the sum of the proportions of minority class samples, and then select the first few clusters with the highest sum of proportions.

[0146] The screening criteria of the embodiment of the present invention first ensures that each minority class exists, and then selects clusters with a higher proportion of minority class samples from the clusters that meet the conditions. The reason is that there are relatively more minority class samples in these clusters, the structure of the clusters is more stable, and it is not easily affected by oversampling, which helps to optimize the effect of subsequent oversampling.

[0147] In some embodiments, the borderlineSMOTE algorithm is used to oversample the filtered clusters, and the specific process is as follows:

[0148] S401 selects the representation vector of a minority category as the reference vector:

[0149] A random selection is made from the representation vectors of the minority class as the base vector.

[0150] S402 Find nearest neighbor:

[0151] For the selected reference vector, find its k nearest neighbor vectors, where k is a predefined parameter (the optimal value can be selected by cross-validation or experimenting with different k values). These nearest neighbor vectors must be the representation vectors of the minority class.

[0152] S403 linear interpolation generates a new representation vector:

[0153] For the reference vector and each of its nearest neighbor vectors, a new representation vector is generated using linear interpolation. The newly generated representation vector is located between the reference vector and its neighbor vector, thereby enhancing the representation of the minority category.

[0154] In some embodiments, a one-dimensional convolutional neural network 1DCNN is used to extract the spatial features of the representation vector to obtain a spatial feature representation, and the specific process is as follows:

[0155] The enhanced representation vector is input into the first convolutional layer of 1DCNN, the convolution operation extracts local features, and the nonlinear transformation is performed through the ReLU activation function.

[0156] The feature map after the ReLU activation function is downsampled through the maximum pooling layer to reduce the dimension of the feature map and retain important feature information.

[0157] The downsampled feature map then passes through the second convolutional layer, which will further extract higher-level spatial feature representations.

[0158] The bidirectional gated recurrent unit BiGRU is used to extract the temporal features of the representation vector to obtain a temporal feature representation. Specifically, the BiGRU model consists of two layers of bidirectional GRU, which can better capture the temporal features in the input data by stacking and bidirectionally connecting these two layers of GRU units; the first layer of bidirectional GRU processes the input sequence to capture the local features and order information in the sequence, and the second layer of bidirectional GRU processes the sequence again based on the output of the first layer to further extract higher-level temporal features.

[0159] In some embodiments, the spatial features and temporal features are fused using a trained scaled dot product attention network, and the specific process is as follows:

[0160] Using the trained scaled dot product attention network to calculate the attention weights between the feature representations of the spatial features and the temporal features;

[0161] The calculated attention weights are applied to the spatial features and temporal features, and the spatial features and temporal features are fused by weighted summation to obtain the fused features.

[0162] Specifically: first, the spatial features and temporal features are projected to the same dimension, and then the projection results of the same dimension are input into the scaled dot product attention (where the three parameters are the query value as the projection of the spatial features, the key value as the projection of the temporal features, and the value as the projection of the temporal features). Finally, the scaled dot product attention mechanism is used to effectively integrate the spatial features and the temporal features.

[0163] In the scaled dot product attention mechanism, the dot product between the query and the key is calculated to obtain the similarity between each pair of features; then the dot product result is scaled to prevent the gradient from vanishing or exploding due to excessive values ​​when calculating the softmax. The scaling factor here is the square root of the dimension of the key; then, the scaled result is converted into a probability distribution by applying the softmax function, that is, the final attention weight is obtained; finally, the value is weighted and summed using the attention weight to obtain the final attention output.

[0164] In step S6, the classifier adopts a softmax classifier. The softmax layer output and the real sample label calculate the loss value, and the loss value is used to adjust the network parameters. Through multiple iterative training, the network parameters are continuously optimized to reduce the loss and make the classification result closer to the real label.

[0165] A person skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by instructing the relevant hardware through a program, and the program can be stored in a computer-readable storage medium, which can include: ROM, RAM, disk or CD, etc.

[0166] Although embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to the embodiments without departing from the principles and spirit of the present invention, and that the scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A network intrusion detection method based on deep learning, characterized in that: include: Obtaining the network traffic data to be detected and preprocessing it; extracting a representation vector from the preprocessed network traffic data to be detected through an encoder network in the trained variational autoencoder; Inputting the representation vector into the trained classifier network for classification, and outputting the final detection result of the intrusion category; The training process of the classifier network includes: Obtain a second training data set with specific labels and preprocess it; Mapping the preprocessed second training data to the latent space through the encoder network in the trained variational autoencoder, extracting the latent variable representation, and obtaining the representation vector of the second training data; Performing clustering, filtering and oversampling processing on the representation vectors respectively to obtain enhanced representation vectors; Extracting spatial features and temporal features of the enhanced representation vector; Fusing the spatial features and the temporal features to obtain fused features; The fused features are input into the classifier network for classification prediction, the classification loss of the predicted label and the true label is calculated, and the classifier network is iteratively optimized according to the classification loss.

2. According to a deep learning-based network intrusion detection method according to claim 1, it is characterized in that: The training process of the variational autoencoder includes: Obtain a first training data set and preprocess it; The preprocessed training data is fed into the encoder network of the variational autoencoder to map it to the latent space; Calculate the mean and variance of the latent space, sample latent variables from it, and calculate the KL divergence loss of the latent space; Input the latent variables into the decoder network of the variational autoencoder, remap them into reconstructed data, and calculate the reconstruction loss between the reconstructed data and the training data; According to the sum of KL divergence loss and reconstruction loss, the variational autoencoder is iteratively optimized using the back-propagation algorithm.

3. A network intrusion detection method based on deep learning according to claim 1 or 2, characterized in that: The preprocessing specifically includes: screening, one-hot encoding and normalization of the input data.

4. According to a deep learning-based network intrusion detection method according to claim 1, it is characterized in that: The K-means algorithm is used to cluster the representation vectors, and the specific process is as follows: Randomly select K initial cluster centers; Calculate the Euclidean distance from each representation vector to the initial cluster center, and assign each representation vector to the cluster center closest to it; Calculate the mean of all points in each cluster, update the mean as the cluster center, iteratively calculate and update the cluster center until the cluster center position is stable or the maximum number of iterations is reached, and obtain the final clustering result.

5. A network intrusion detection method based on deep learning according to claim 1 or 4, characterized in that: The clusters after clustering are screened, and the specific process is as follows: Pre-count the number of each category in the second training data set with specific labels and calculate the median. According to this median, the category with a number less than the median is regarded as a minority category. Traverse each cluster after clustering, and filter out the representation vector data belonging to the cluster according to the cluster identifier; Calculate the total number of filtered representation vectors, the number of representation vectors for each category, and the proportion of each category in the current cluster; Traverse the category distribution of each cluster and check whether the current cluster contains all minority categories. If so, record the cluster; Calculate the sum of the proportions of all minority class samples in each cluster, sort them from high to low according to the sum of the proportions of minority class samples, and select the top n clusters with the highest sum of proportions.

6. A network intrusion detection method based on deep learning according to claim 5, characterized in that: The borderlineSMOTE algorithm is used to oversample the filtered clusters. The specific process is as follows: Randomly select one of the representation vectors of the minority categories in the cluster as the reference vector; For the selected reference vector, find its k nearest neighbor vectors, which must be the representation vectors of the minority class; For the reference vector and each of its nearest neighbor vectors, a new representation vector is generated using a linear interpolation method. The newly generated representation vector is located between the reference vector and its neighbor vector, thereby enhancing the representation of the minority category.

7. A network intrusion detection method based on deep learning according to claim 1, characterized in that: A one-dimensional convolutional neural network (1DCNN) is used to extract the spatial features of the representation vector to obtain a spatial feature representation; A bidirectional gated recurrent unit BiGRU is used to extract the temporal features of the representation vector to obtain a temporal feature representation.

8. A network intrusion detection method based on deep learning according to claim 1, characterized in that: The spatial features and temporal features are fused using the trained scaled dot product attention network. The specific process is as follows: Using the trained scaled dot product attention network to calculate the attention weights between the feature representations of the spatial features and the temporal features; The calculated attention weights are applied to the spatial features and temporal features, and the spatial features and temporal features are fused by weighted summation to obtain the fused features.

Images