Network intrusion detection method based on depth time sequence clustering

Abstract

The invention provides a network intrusion detection method based on depth time sequence clustering. The method comprises the following steps: performing dimensionality reduction and reconstruction on high-dimensional data by using a convolutional automatic encoder CAE; the self-supervised learning module performs feature transformation on the data, the training model classifies and identifies the transformation type of a sample as an auxiliary task, and learns generalized feature representation; global and local memory modules learn universal and specific features of data; the adaptive fusion module fuses the features to obtain a new feature representation for reconstruction; calculating the most suitable clustering feature of the positive sample data set; and identifying data different from the positive sample data set in the low-dimensional space by using a BIRCH clustering algorithm to realize anomaly detection. The self-supervised learning module is introduced to avoid the problem of data source limitation, the global and local memory modules are utilized to avoid the problems of poor model generalization ability and feature expression limitation, the BIRCH clustering is utilized to avoid the problem that the quantity of k needs to be determined in the traditional K-MEANS algorithm, and the method has higher efficiency.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, and in particular to a network intrusion detection method based on deep time series clustering. Background Art

[0002] Anomaly detection, also known as outlier detection or novelty detection, is the process of detecting data instances that significantly deviate from the majority of data instances. Anomaly detection has been an active research area for decades, with early explorations dating back to the 1960s. Due to the increasing demand and applications in a wide range of fields such as risk management, compliance, security, financial monitoring, health and medical risks, and artificial intelligence safety, anomaly detection plays an increasingly important role and has been prominent in different fields such as data mining, machine learning, computer vision, and statistics.

[0003] Networks play a vital role in modern society, so network security has become an important research field. Network intrusion has become a serious threat, affecting the sensitive data and business operations of individuals, enterprises and government agencies. Therefore, timely detection and response to network intrusion is one of the core tasks of network security. At present, the existing security methods are mainly passive defense, including security gateways, firewalls, code signing and encryption technologies, which cannot actively detect and respond. Intrusion Detection System (IDS) was first proposed in 1980 as a network security protection technology, which mainly detects network attacks or abnormal behaviors by capturing and analyzing network data traffic. When an attack occurs, IDS can respond in time, thereby effectively detecting and responding to the attack. This method provides a proactive security defense measure for the network, which is suitable for enhancing network security.

[0004] Compared with traditional signature-based detection methods, anomaly-based methods do not rely on known attack features, but instead detect potential unknown attacks by analyzing abnormal patterns in network traffic. Researchers have begun to use machine learning (ML) techniques to build anomaly-based intrusion detection systems, such as decision trees (DT), naive Bayes (NB), and support vector machines (SVM). Compared with traditional intrusion detection systems, ML methods provide better real-time performance and accuracy, which helps to identify and respond to evolving network threats in a timely manner. However, when dealing with large-scale or high-dimensional network data, the detection performance of these methods may drop significantly and lead to increased detection time. Therefore, in the face of increased traffic and bandwidth, ML methods may perform poorly in modern Internet environments.

[0005] In contrast, deep learning (DL) technology has more advantages in dealing with complex intrusion detection problems. Deep learning methods automatically extract abstract and advanced features from raw data through a multi-level neural network structure, which can process big data and improve the adaptability and generalization ability of the model. With the development of deep learning technology, its application in intrusion detection systems has gradually become a trend.

[0006] However, with the widespread application of IoT devices in various fields, new network intrusions continue to emerge. At the same time, the cost of obtaining a large amount of annotated abnormal data required to train machine learning models is extremely high. Supervised learning relies on rich annotated data for model training. If the training data does not cover a specific type of vulnerability, the model's effective recognition ability will be limited, making it difficult to deal with new vulnerabilities.

[0007] Moreover, due to the limitation of its data source, unsupervised learning usually only contains normal data, which leads to a relatively limited category of training data sets. Compared with unknown test data, this category limitation makes the model prone to "overfitting" during training.

[0008] For complex time series data, the feature representations learned by existing models lack sufficient representativeness and cannot effectively maintain the diversity of normal patterns. In addition, existing methods fail to capture diverse patterns. Therefore, due to the limitations of training data and feature representations, existing models show poor generalization performance when dealing with unseen normal and abnormal data. Summary of the invention

[0009] The present invention provides a network intrusion detection method based on deep time series clustering to solve the above problems, effectively avoid the problems of traditional models over-relying on labeled data and insufficient detection capabilities for new network intrusions, introduce a self-supervised learning module to avoid the problem of data source limitation, use global and local memory modules to avoid the problems of poor model generalization ability and feature expression limitations, use BIRCH clustering to avoid the problem of the traditional K-MEANS algorithm needing to determine the number of k, and has higher efficiency.

[0010] The present invention provides a network intrusion detection method based on deep time series clustering, comprising:

[0011] S1: Obtain a network operation data set, where the network operation data set only contains positive sample data sets;

[0012] S2: Input the sample data in the network operation data set into the normal data set: χ={X1,X2,…,X H},X∈R V×N , convert each sample into X = {x 1 ,x2 ,…,x K}∈R K×V×N ;

[0013] Among them, K is the number of self-supervised learning classes, including original data and 6 types of transformed data, K=7, V represents the length of the data, and N represents the total number of data;

[0014] S3: Control the encoder to map the original time series signal and its six transformations into the latent feature space Z←Encoder(X);

[0015] S4: Based on the self-supervised learning module, multiple classifiers are established to classify the mapping feature types and perform generalized feature representation learning and training;

[0016] S5: Input the mapping features into the global and local memory network modules to perform common feature and specific feature learning training;

[0017] S6: Integrate and reconstruct common features and specific features based on the adaptive fusion module to obtain low-dimensional fusion features;

[0018] S7: Input the low-dimensional fusion features into the BIRCH clustering algorithm and train the deep time series clustering model through multiple iterations;

[0019] S8: Save the trained deep time series clustering model, input the test data set into the deep time series clustering model, and calculate the anomaly points.

[0020] Preferably, in a network intrusion detection method based on deep time series clustering, S1 comprises:

[0021] When obtaining the network operation data set, determining the abnormal data points corresponding to the network operation data set based on the actual abnormal marking results corresponding to each network operation data set;

[0022] and synchronously obtain the basic operation framework of the operation data corresponding to the network operation data set, compare the operation data in the network operation data set with the basic data in the basic operation framework, and obtain framework difference data;

[0023] Based on the running subroutine segment type and data application scenario in the network running data set, determine whether the architecture difference data is a normal difference, and screen to obtain abnormal difference data;

[0024] Determine the abnormal position corresponding to the abnormal difference data, and make a one-to-one correspondence between the abnormal position and the position of the abnormal data point. When the two are inconsistent, determine that the current network operation data set is a negative sample data set, and remove the current network operation data set;

[0025] Otherwise, the current network operation data set is determined to be a positive sample data set, and the current network operation data set is retained.

[0026] Preferably, in a network intrusion detection method based on deep time series clustering, S2 comprises:

[0027] S21: Use Gaussian noise transformation to denoise the sample data in the network operation data set;

[0028] S22: Reverse the sample data along the time dimension, so as to obtain a sample data signal with the opposite time direction;

[0029] S23: Slicing the sample data signal and exchanging different time windows to generate a new data signal, and randomly perturbing the new data signal along the time dimension;

[0030] S24: completing the change of the amplitude of the new data signal within the time window by multiplying the random scalar;

[0031] S25: Scale the output signal of the time window by -1 to obtain a mirror image of the input signal;

[0032] S26: Smoothing the input signal based on Savitzky-Golay filter;

[0033] S27: Distinguishing transformed instances based on the cross entropy loss function:

[0034]

[0035] Among them, L CE is the cross entropy loss of sample data; y i is the pseudo label of the sample data and p i is the predicted probability of the label for the sample data;

[0036] Among them, the probability before the cross entropy loss is performed using the Softmax activation function:

[0037]

[0038] Among them, z i is the raw score of the i-th category, and the Softmax function converts the raw score into a probability distribution P = [P1, P2…, P K ], e is a mathematical constant with a value of 2.7183.

[0039] Preferably, in a network intrusion detection method based on deep time series clustering, S5 comprises:

[0040] S51: Instantiate the memory network module as a memory matrix M∈RC×F , used to store C vectors with F dimensions, let the row vector m i , Represented as the i-th row of M;

[0041] Where [C] represents the set of integers from 1 to N, and each m i Represents a memory item, given an input λ z ∈R F , where F represents the filter size of the last layer of the encoder, and the similarity between the input z and the memory matrix M is calculated:

[0042]

[0043] in, Represents the output of the memory network, which represents the memory item m i The weighted average of i represents the i-th weight of ω, ω∈R C ,||ω i ||=1; the weight vector ω is composed of the input z and the memory item m i The similarity calculation is:

[0044]

[0045] Score uses the cosine similarity measurement strategy:

[0046]

[0047] S52: In the learning and training phase, the memory matrix is ​​updated by reconstructing the error to control the memory network module to memorize the generalized features of normal data;

[0048] At the same time, the memory network module outputs the generalized features by combining all memory items and executes S6.

[0049] Preferably, in a network intrusion detection method based on deep time series clustering, S52 includes:

[0050] S521: learning the common features contained in all transformations based on a global memory network module, wherein the global memory network module is constructed using a shared memory matrix;

[0051] The encoded latent features are used as input, and the global memory network module records the common features in the memory matrix. The output obtained through the shared global memory network module is

[0052]

[0053] Among them, fg (·) is the function of the global memory network module, θ g is the shared parameter of the global memory network module, and [K] = {1, 2, …, K};

[0054] S522: learning specific features contained in all transformations based on a local memory network module, wherein the local memory network module is constructed using K memory matrices, each memory matrix recording specific features of a corresponding transformation in normal data;

[0055] The encoded potential features are used as input and the output is obtained through K local memory network modules.

[0056]

[0057] Among them, f l (·) is the functional form of the local memory network module, represents the parameters of K local memory network modules, and [K] = {1, 2, …, K}.

[0058] Preferably, in a network intrusion detection method based on deep time series clustering, S6 includes:

[0059] S61: Based on the feedforward layer, the features and free variables k∈K are taken as input, and the weights α∈R 2K Generate fused representation;

[0060] Among them, local memory and global memory each have 2 weights, and there are K transformations in total;

[0061] The weights are normalized based on batch normalization and sigmoid activation, and the output values ​​are controlled within the range of (0, 1), thereby obtaining the feature representation of the adaptive fusion module:

[0062]

[0063] in, represents the feature representation generated by the adaptive fusion module; represents the weight of the shared features; Indicates the weight of a specific feature;

[0064] S62: z and As the reconstructed original input data of the decoder, the reconstruction error L is obtained by minimizing the Euclidean distance (l2 norm) between the original input and the decoder output MSE :

[0065]

[0066] Among them, concat(·) represents the addition of z~ i and z i Series connection, represents the parameters of the i-th decoder; z represents the output result of the encoder;

[0067] S63: Based on the sparse loss method, the entropy of the weight ω is minimized to obtain the self-supervisory error L spar :

[0068]

[0069] Preferably, in a network intrusion detection method based on deep time series clustering, S7 includes:

[0070] By integrating the reconstruction error and the self-supervision error, the objective function is obtained, and the deep time series clustering model is trained end-to-end based on the objective function, where the objective function is:

[0071] J(θ)=L MSE +λ1L CE +λ2L spar

[0072] Among them, λ1 is the balancing weight of the cross entropy loss; λ2 is the balancing weight of the self-error.

[0073] Preferably, in a network intrusion detection method based on deep time series clustering, S8 includes:

[0074] S81: Input the test data set χ={X1,X2,…,X H},X∈R V×N , and related parameters for model training;

[0075] S82: Convert each input data to be tested into X={x 1 ,x 2 ,…,x K}∈R K×V×N , where K = 7, including original data and 6 transformed data, V represents the length of data, and N represents the total number of data;

[0076] S83: Load model training parameters θ and adaptive fusion weights α;

[0077] S84: Control the encoder to map high-dimensional data into a low-dimensional feature space Z, and output the feature matrix Z based on the local memory network module l , and output the feature matrix Z based on the global memory network module g Finally, the adaptive fusion module outputs the fusion features of common features and specific features.

[0078] S85: Fusion of low-dimensional features Input into the BIRCH clustering model, each time a new data point is added to the CF tree, the cluster radius is calculated, and the calculation formula of the cluster radius (R) is:

[0079]

[0080] Among them, the CF tree is a set of three data points in a cluster, and the data points are represented as:

[0081]

[0082] Where N is the number of data points; is the linear sum, i.e. the vector sum of all data points; SS is the square sum, i.e. the vector sum of the squares of all data points; Refers to the low-dimensional fusion feature data of the i-th category;

[0083] S86: If the clustering radius of a data point is greater than a threshold value T, the data point is regarded as an outlier.

[0084] Preferably, in a network intrusion detection method based on deep time series clustering, it also includes:

[0085] After determining the abnormal point, obtain the data position and data type of the abnormal point and record them, classify the abnormal data points based on the data position of each abnormal point and the running program segment where they are located, obtain multiple associated abnormal data groups, and determine the abnormal correlation relationship between each abnormal point in each associated abnormal data group in combination with the current network architecture;

[0086] Based on the abnormal association relationship, the security vulnerability type of the current network is determined, based on the security vulnerability type, a search is performed in a preset patch database to obtain a target patch, and the security vulnerability is repaired based on the target patch.

[0087] Preferably, in a network intrusion detection method based on deep time series clustering, based on the abnormal correlation relationship, the security vulnerability of the current network is determined, and a search is performed in a preset patch database to obtain a target patch, including:

[0088] Based on the abnormal correlation relationship, determine the operation order and operation logic between the associated abnormal data points, and divide the associated abnormal points into operation gradients according to the operation logic;

[0089] Based on the operation gradient division results, the abnormal points are clustered to obtain the operation logic abnormal clusters, and the operation subroutine segment types corresponding to each operation logic abnormal cluster are simultaneously obtained;

[0090] According to the operation business type corresponding to the associated abnormal data group, combined with the current network architecture and the operation subroutine segment type corresponding to each operation logic abnormal cluster, determine the vulnerability type corresponding to each logic abnormal cluster;

[0091] Obtain the vulnerability types corresponding to all logic anomaly clusters, combine the operation vulnerability logic types corresponding to the logic anomaly clusters with the operation gradient, and determine the security vulnerabilities of the current network;

[0092] Based on multiple data vulnerabilities contained in the security vulnerabilities of the current network, a search is performed in a preset patch database to obtain target sub-patches, and the target sub-patches are combined to generate a target patch.

[0093] Compared with the prior art, the present invention has at least the following beneficial effects:

[0094] The present invention is a network intrusion detection method based on deep time series clustering, comprising using convolutional autoencoder CAE to reduce the dimension and reconstruct high-dimensional data; a self-supervised learning module performs feature transformation on the data and trains the model to classify and identify the transformation type of the sample as an auxiliary task, and learns generalized feature representation; a global and local memory module learns the common and specific features of the data; an adaptive fusion module fuses the common and specific features to obtain a new feature representation for reconstruction; calculates the most suitable clustering features for the positive sample data set; and uses the BIRCH clustering algorithm to identify data in a low-dimensional space that is different from the positive sample data set to achieve anomaly detection. The present invention effectively avoids the problems of traditional models over-relying on labeled data and insufficient ability to detect new network intrusions. The introduction of the self-supervised learning module avoids the problem of data source limitation. The use of the global and local memory modules avoids the problem of poor model generalization ability and feature expression limitation. The use of BIRCH clustering avoids the problem of the need to determine the number of k in the traditional K-MEANS algorithm, and has higher efficiency.

[0095] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures specifically pointed out in this application document.

[0096] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0097] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0098] Figure 1A flowchart of a network intrusion detection method based on deep time series clustering of the present invention;

[0099] Figure 2 This is a flow chart of a network intrusion detection method S1 based on deep time series clustering of the present invention;

[0100] Figure 3 This is a discrimination flow chart of a network intrusion detection method based on deep time series clustering of the present invention. DETAILED DESCRIPTION

[0101] The preferred embodiments of the present invention are described below in conjunction with the accompanying drawings. It should be understood that the preferred embodiments described herein are only used to illustrate and explain the present invention, and are not used to limit the present invention.

[0102] Embodiment 1:

[0103] The present invention provides a network intrusion detection method based on deep time series clustering, comprising:

[0104] S1: Obtain a network operation data set, where the network operation data set only contains positive sample data sets;

[0105] S2: Input the sample data in the network operation data set into the normal data set: χ={X1,X2,…,X H},X∈R V×N , convert each sample into X = {x 1 ,x 2 ,…,x K}∈R K×V×N ;

[0106] Among them, K is the number of self-supervised learning classes including original data and 6 transformed data, K=7, V represents the length of data, and N represents the total number of data;

[0107] S3: Control the encoder to map the original time series signal and its six transformations into the latent feature space Z←Encoder(X);

[0108] S4: Based on the self-supervisory module, a multi-classifier is established to classify the mapping feature types and perform generalized feature representation learning and training;

[0109] S5: Input the mapping features into the global and local memory network modules to perform common feature and specific feature learning training;

[0110] S6: Integrate and reconstruct common features and specific features based on the adaptive fusion module to obtain low-dimensional fusion features;

[0111] S7: Input the low-dimensional fusion features into the BIRCH clustering algorithm and train the deep time series clustering model through multiple iterations;

[0112] S8: Save the trained deep time series clustering model, input the network intrusion data set to be tested into the deep time series clustering model, and calculate the anomaly points.

[0113] In this embodiment, the six transformations include noise, inversion, substitution, scaling, negation and smoothing feature transformation.

[0114] In this embodiment, the encoder refers to a CAE encoder, i.e., a convolutional autoencoder.

[0115] In this embodiment, the BIRCH path search tree is similar to the structure of the B+ tree. There are three types of nodes in the cluster feature (CF) tree: leaf nodes (Leaf), non-leaf nodes (NonLeaf) and minimum cluster nodes (Min Cluster); the model has the following three parameters: the first parameter is B (branching factor), which is the maximum number of child nodes that a non-leaf node can have. The second parameter is L, which is the maximum number of child nodes that a leaf node can accommodate. In addition, the third parameter is T (threshold), which is the most extreme span estimate of the cluster.

[0116] Beneficial effects of the above technical solution: The present invention is a network intrusion detection method based on deep time series clustering. Figure 1 As shown, it includes using convolutional autoencoder CAE to reduce the dimension and reconstruct high-dimensional data; the self-supervised learning module performs feature transformation on the data and trains the model to classify and identify the transformation type of the sample as an auxiliary task to learn generalized feature representation; the global and local memory modules learn the common and specific features of the data; the adaptive fusion module fuses the common and specific features to obtain a new feature representation for reconstruction; calculates the most suitable clustering features for the positive sample data set; uses the BIRCH clustering algorithm to identify data in the low-dimensional space that is different from the positive sample data set to achieve anomaly detection. The present invention effectively avoids the problems of excessive reliance on labeled data and insufficient detection capabilities for new network intrusions in traditional models. The introduction of the self-supervised learning module avoids the problem of data source limitation. The use of the global and local memory modules avoids the problem of poor model generalization ability and feature expression limitation. The use of BIRCH clustering avoids the problem of the need to determine the number of k in the traditional K-MEANS algorithm, and has higher efficiency.

[0117] Embodiment 2:

[0118] On the basis of Example 1, S1, such as Figure 2 As shown, including:

[0119] S11: when obtaining the network operation data set, determining the abnormal data points corresponding to the network operation data set based on the real abnormality marking results corresponding to each network operation data set;

[0120] S12: synchronously obtaining a basic operation framework of operation data corresponding to the network operation data set, comparing the operation data in the network operation data set with the basic data in the basic operation framework, and obtaining framework difference data;

[0121] S13: Based on the operation subroutine segment type and data application scenario in the network operation data set, determine whether the architecture difference data is a normal difference, and screen to obtain abnormal difference data;

[0122] S14: determining the abnormal position corresponding to the abnormal difference data, and making a one-to-one correspondence between the abnormal position and the position of the abnormal data point. When the two are inconsistent, determining that the current network operation data set is a negative sample data set, and removing the current network operation data set;

[0123] Otherwise, the current network operation data set is determined to be a positive sample data set, and the current network operation data set is retained.

[0124] The beneficial effects of the above technical solution are as follows: after obtaining the network operation data set, the present invention determines the abnormal data points corresponding to the network operation data set based on the real abnormal marking results corresponding to each network operation data set; and simultaneously obtains the basic operation framework of the operation data corresponding to the network operation data set, compares the operation data in the network operation data set with the basic data in the basic operation framework, and obtains the framework difference data; based on the operation subroutine segment type and the data application scenario in the network operation data set, determines whether the framework difference data is a normal difference, and obtains the abnormal difference data by screening; determines the abnormal position corresponding to the abnormal difference data, makes a one-to-one correspondence between the abnormal position and the abnormal data point position, verifies the samples in the operation data set, and ensures that the samples contained in the operation data set are all positive sample data sets, thereby improving the accuracy of the final model.

[0125] Embodiment 3:

[0126] On the basis of Example 1, S2 comprises:

[0127] S21: Use Gaussian noise transformation to denoise the sample data in the network operation data set;

[0128] S22: Reverse the sample data along the time dimension, so as to obtain a sample data signal with the opposite time direction;

[0129] S23: Slicing the sample data signal and exchanging different time windows to generate a new data signal, and randomly perturbing the new data signal along the time dimension;

[0130] S24: completing the change of the amplitude of the new data signal within the time window by multiplying the random scalar;

[0131] S25: Scale the output signal of the time window by -1 to obtain a mirror image of the input signal;

[0132] S26: Smoothing the input signal based on Savitzky-Golay filter;

[0133] S27: Distinguish the transformed instances based on the cross entropy loss function and learn the announcement features of the sample data:

[0134]

[0135] Among them, L CE is the cross entropy loss of sample data; y i is the pseudo label of the sample data and p i is the predicted probability of the label for the sample data;

[0136] Among them, the probability before the cross entropy loss is performed using the Softmax activation function:

[0137]

[0138] Among them, z i is the raw score of the i-th category, and the Softmax function converts the raw score into a probability distribution P = [P1, P2…, P K ], e is a mathematical constant with a value of 2.7183.

[0139] In this embodiment, [0.5, 0.8, 1.5, 2] may be selected as the random scalar value.

[0140] The beneficial effects of the above technical solution are as follows: the sample data is subjected to noise transformation to convert the noise into white noise, and the permutation change can reduce the permutation invariance of the obtained model by permuting the data; the sample data is scaled based on the scaling transformation and added to the training data to help the model learn scaling invariance; the present invention performs noise, inversion, permutation, scaling, negation and smoothing feature transformation on the original data, performs self-supervision, and classifies and identifies the transformation type of the sample as an auxiliary task for model training, avoiding the problem of data source limitation.

[0141] Embodiment 4:

[0142] On the basis of Example 1, S5 comprises:

[0143] S51: Instantiate the memory network module as a memory matrix M∈R C×F, used to store C vectors with F dimensions, let the row vector m i , Represented as the i-th row of M;

[0144] Where [C] represents the set of integers from 1 to N, and each m i Represents a memory item, given an input λ z ∈R F , where F represents the filter size of the last layer of the encoder, and the similarity between the input z and the memory matrix M is calculated:

[0145]

[0146] in, Represents the output of the memory network module, which represents the memory item m i The weighted average of i represents the i-th weight of ω, ω∈R C ,||ω i ||=1; the weight vector ω is composed of the input z and the memory item m i The similarity calculation is:

[0147]

[0148] Score uses the cosine similarity measurement strategy:

[0149]

[0150] S52: In the learning and training phase, the memory matrix is ​​updated by reconstructing the error to control the memory network module to memorize the common features and specific features of normal data;

[0151] At the same time, the memory network module outputs the common features and specific features by combining all memory items and executes S6.

[0152] The beneficial effect of the above technical solution: After the present invention instantiates the memory network module, it provides a basis for constructing and reconstructing the original data by calculating the output value and outputting the common features and specific features by combining all memory items.

[0153] Embodiment 5:

[0154] On the basis of Example 4, S52 includes:

[0155] S521: learning the common features contained in all transformations based on a global memory network module, wherein the global memory network module is constructed using a shared memory matrix;

[0156] The encoded latent features are used as input, and the global memory network module records the common features in the memory matrix. The output obtained through the shared global memory network module is

[0157]

[0158] Among them, f g (·) is the function of the global memory network module, θ g is the shared parameter of the global memory network module, and [K] = {1, 2, …, K};

[0159] S522: learning specific features contained in all transformations based on a local memory network module, wherein the local memory network module is constructed using K memory matrices, each memory matrix recording specific features of a corresponding transformation in normal data;

[0160] The encoded potential features are used as input and the output is obtained through K local memory network modules.

[0161]

[0162] Among them, f l (·) is the functional form of the local memory network module, represents the parameters of K local memory network modules, and [K] = {1, 2, …, K}.

[0163] The beneficial effect of the above technical solution is that the present invention uses the potential features obtained after encoding as input through the global memory network module, and the global memory network module records the common features in the memory matrix. The output obtained through the shared global memory network module is The model has completed the learning of specific features contained in all transformations; the encoded potential features are used as input through the local memory network module, and the output obtained through K local memory network modules is The model has completed the specific learning of all transformations. Learning the public features and specific features of the data through global and local memory modules can effectively improve the expressiveness and generalization ability of the trained model.

[0164] Embodiment 6:

[0165] On the basis of Example 1, S6 comprises:

[0166] S61: Based on the feedforward layer, the features and free variables k∈K are taken as input, and the weights α∈R 2K Generate fused representation;

[0167] Among them, local memory and global memory each have 2 weights, and there are K transformations in total;

[0168] The weights are normalized based on batch normalization and sigmoid activation, and the output values ​​are controlled within the range of (0, 1), thereby obtaining the feature representation of the adaptive fusion module:

[0169]

[0170] in, represents the feature representation generated by the adaptive fusion module; represents the weight of the shared features; Indicates the weight of a specific feature;

[0171] S62: z and As the reconstructed original input data of the decoder, the reconstruction error L is obtained by minimizing the Euclidean distance (l2 norm) between the original input and the decoder output MSE :

[0172]

[0173] Among them, concat(·) represents and z i Series connection, represents the parameters of the i-th decoder; z represents the output result of the encoder;

[0174] S63: Based on the sparse loss method, the entropy of the weight ω is minimized to obtain the self-supervisory error L spar :

[0175]

[0176] The beneficial effects of the above technical solution are as follows: the present invention uses a feedforward layer to take the feature and free variable k∈K as input, and uses a weight α∈R 2K Generate a fusion representation, then normalize the weights based on batch normalization and sigmoid activation, and control the output value within the range of (0, 1) to obtain the features of the adaptive fusion module, which is used to complete the fusion of common features and specific features, provide a basis for data reconstruction, and use the input features and fusion features as the basis to obtain the reconstruction error with the Euclidean distance. At the same time, by limiting the sparsity of the memory weight ω, excessive reconstruction of abnormal points due to the complex combination of memory items is avoided. Based on the sparse loss method, the entropy of the weight ω is minimized to obtain the self-supervision error, which provides a basis for automatic adjustment of parameters in the model training process and effectively improves the model performance.

[0177] Embodiment 7:

[0178] On the basis of Example 1, S7 includes:

[0179] By integrating the reconstruction error and the self-supervision error, the objective function is obtained, and the deep time series clustering model is trained end-to-end based on the objective function, where the objective function is:

[0180] J(θ)=L MSE +λ1L CE +λ2L spar

[0181] Among them, λ1 is the balancing weight of the cross entropy loss; λ2 is the balancing weight of the self-error.

[0182] Beneficial effects of the above technical solution: The present invention uses BIRCH clustering to avoid the problem of the traditional K-MEANS algorithm needing to determine the number of k, and can more efficiently complete the detection of outliers, thereby improving the efficiency of outlier detection.

[0183] In embodiment 8:

[0184] Based on the network intrusion detection method based on deep time series clustering described in any one of Embodiments 1-7, S8 includes:

[0185] S81: Input the test data set χ={X1,X2,…,X H},X∈R V×N , and related parameters for model training;

[0186] S82: Convert each input data to be tested into X={x 1 ,x 2 ,…,x K}∈R K×V×N , where K = 7, including original data and 6 transformed data, V represents the length of data, and N represents the total number of data;

[0187] S83: Load model training parameters θ and adaptive fusion weights α;

[0188] S84: Control the encoder to map high-dimensional data into a low-dimensional feature space Z, and output the feature matrix Z based on the local memory network module l , and output the feature matrix Z based on the global memory network module g Finally, the adaptive fusion module outputs the fusion features of common features and specific features.

[0189] S85: Input the low-dimensional fusion feature Z~ into the BIRCH clustering model. Each time a new data point is added to the CF tree, the cluster radius is calculated. The calculation formula of the cluster radius (R) is:

[0190]

[0191] Among them, the CF tree is a set of three data points in a cluster, and the data points are represented as:

[0192]

[0193] Where N is the number of data points; is the linear sum, i.e. the vector sum of all data points; SS is the square sum, i.e. the vector sum of the squares of all data points; Refers to the low-dimensional fusion feature data of the i-th category;

[0194] S86: If the clustering radius of a data point is greater than a threshold value T, the data point is regarded as an outlier.

[0195] In this embodiment, model training related parameters include but are not limited to model training parameters θ, B, T, and hyperparameters λ1 and λ2.

[0196] The beneficial effects of the above technical solution are as follows: Figure 3 As shown, after obtaining the data set to be tested, six data transformations are first performed, and after loading the model training parameter adaptive fusion weights, the control encoder is controlled to map the high-dimensional data to the low-dimensional feature space to map the potential fusion features; the BIRCH clustering algorithm is used to identify the data in the low-dimensional space that is different from the positive sample data set to achieve anomaly detection. The present invention effectively avoids the problems of excessive reliance on labeled data and insufficient detection of new network intrusions in traditional models. The introduction of the self-supervised learning module avoids the problem of data source limitation. The use of global and local memory modules avoids the problem of poor model generalization ability and feature expression limitation. The use of BIRCH clustering avoids the problem of the need to determine the number of k in the traditional K-MEANS algorithm, and has higher efficiency.

[0197] In embodiment 9:

[0198] On the basis of Example 1, a network intrusion detection method based on deep time series clustering further includes:

[0199] After determining the abnormal point, obtain the data position and data type of the abnormal point and record them, classify the abnormal data points based on the data position of each abnormal point and the running program segment where they are located, obtain multiple associated abnormal data groups, and determine the abnormal correlation relationship between each abnormal point in each associated abnormal data group in combination with the current network architecture;

[0200] Based on the abnormal association relationship, the security vulnerability type of the current network is determined, based on the security vulnerability type, a search is performed in a preset patch database to obtain a target patch, and the security vulnerability is repaired based on the target patch.

[0201] The intentional effect of the above technical solution is as follows: after the abnormal point is determined, the present invention obtains and records the data position and data type of the abnormal point, classifies the abnormal data points based on the data position of each abnormal point and the running program segment in which it is located, obtains multiple associated abnormal data groups, and determines the abnormal correlation relationship between each abnormal point in each associated abnormal data group in combination with the current network architecture; based on the abnormal correlation relationship, determines the security vulnerability type of the current network, based on the security vulnerability type, searches in a preset patch database to obtain a target patch, and repairs the security vulnerability based on the target patch, thereby realizing self-repair of network vulnerabilities and helping to improve the data security of the current network.

[0202] In embodiment 10:

[0203] On the basis of Example 9, based on the abnormal association relationship, the security vulnerability of the current network is determined, and a search is performed in a preset patch database to obtain a target patch, including:

[0204] Based on the abnormal correlation relationship, determine the operation order and operation logic between the associated abnormal data points, and divide the associated abnormal points into operation gradients according to the operation logic;

[0205] Based on the operation gradient division results, the abnormal points are clustered to obtain the operation logic abnormal clusters, and the operation subroutine segment types corresponding to each operation logic abnormal cluster are simultaneously obtained;

[0206] According to the operation business type corresponding to the associated abnormal data group, combined with the current network architecture and the operation subroutine segment type corresponding to each operation logic abnormal cluster, determine the vulnerability type corresponding to each logic abnormal cluster;

[0207] Obtain the vulnerability types corresponding to all logic anomaly clusters, combine the operation vulnerability logic types corresponding to the logic anomaly clusters with the operation gradient, and determine the security vulnerabilities of the current network;

[0208] Based on multiple data vulnerabilities contained in the security vulnerabilities of the current network, a search is performed in a preset patch database to obtain target sub-patches, and the target sub-patches are combined to generate a target patch.

[0209] In this embodiment, the preset patch database refers to a pre-established data resource library containing a variety of data vulnerability patches.

[0210] The beneficial effects of the above technical solution are as follows: based on the abnormal association relationship, the operation order and operation logic between the associated abnormal data points are determined, and according to the operation logic, the associated abnormal points are divided into operation gradients; based on the operation gradient division results, the abnormal points are clustered to obtain operation logic abnormal clusters, and the operation subroutine segment types corresponding to each operation logic abnormal cluster are simultaneously obtained; according to the operation business type corresponding to the associated abnormal data group, combined with the current network architecture and the operation subroutine segment types corresponding to each operation logic abnormal cluster, the vulnerability type corresponding to each logic abnormal cluster is determined; the vulnerability types corresponding to all logic abnormal clusters are obtained, and the operation vulnerability logic types corresponding to the logic abnormal clusters are combined in combination with the operation gradient to determine the security vulnerabilities of the current network; based on multiple data vulnerabilities contained in the security vulnerabilities of the current network, a search is performed in a preset patch database to obtain a target sub-patch, and the target sub-patch is combined to generate a target patch, thereby realizing the rapid determination of security vulnerability patches, effectively improving network repair efficiency, and reducing network intrusion losses.

[0211] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network intrusion detection method based on deep time series clustering, It is characterized in that include: S1: Obtain a network operation data set, where the network operation data set only contains positive sample data sets; S2: Input the sample data in the network operation data set into the normal data set: χ={X 1 ,X 2 ,…,X H },X∈R V×N , convert each sample into X = {x 1 ,x 2 ,…,x K }∈R K×V×N ; Among them, K is the number of self-supervised learning classes, including original data and 6 types of transformed data, K=7, V represents the length of the data, and N represents the total number of data; S3: Control the encoder to map the original time series signal and its six transformations into the latent feature space Z←Encoder(X); S4: Based on the self-supervised learning module, multiple classifiers are established to classify the mapping feature types and perform generalized feature representation learning and training; S5: Input the mapping features into the global and local memory network modules to perform common feature and specific feature learning training; S6: Integrate and reconstruct common features and specific features based on the adaptive fusion module to obtain low-dimensional fusion features; S7: Input the low-dimensional fusion features into the BIRCH clustering algorithm and train the deep time series clustering model through multiple iterations; S8: Save the trained deep time series clustering model, input the test data set into the deep time series clustering model, and calculate the anomaly points.

2. According to claim 1, a network intrusion detection method based on deep time series clustering, It is characterized in that S1, including: When obtaining the network operation data set, determining the abnormal data points corresponding to the network operation data set based on the actual abnormal marking results corresponding to each network operation data set; and synchronously obtain the basic operation framework of the operation data corresponding to the network operation data set, compare the operation data in the network operation data set with the basic data in the basic operation framework, and obtain framework difference data; Based on the running subroutine segment type and data application scenario in the network running data set, determine whether the architecture difference data is a normal difference, and screen to obtain abnormal difference data; Determine the abnormal position corresponding to the abnormal difference data, and make a one-to-one correspondence between the abnormal position and the position of the abnormal data point. When the two are inconsistent, determine that the current network operation data set is a negative sample data set, and remove the current network operation data set; Otherwise, the current network operation data set is determined to be a positive sample data set, and the current network operation data set is retained.

3. According to claim 1, a network intrusion detection method based on deep time series clustering, It is characterized in that S2, including: S21: Use Gaussian noise transformation to denoise the sample data in the network operation data set; S22: Reverse the sample data along the time dimension, so as to obtain a sample data signal with the opposite time direction; S23: Slicing the sample data signal and exchanging different time windows to generate a new data signal, and randomly perturbing the new data signal along the time dimension; S24: completing the change of the amplitude of the new data signal within the time window by multiplying the random scalar; S25: Scale the output signal of the time window by -1 to obtain a mirror image of the input signal; S26: Smoothing the input signal based on Savitzky-Golay filter; S27: Distinguishing transformed instances based on the cross entropy loss function: Among them, L CE is the cross entropy loss of sample data; y i is the pseudo label of the sample data and p i is the predicted probability of the label for the sample data; Among them, the probability before the cross entropy loss is performed using the Softmax activation function: Among them, z i is the raw score of the i-th category, and the Softmax function converts the raw score into a probability distribution P = [P 1 ,P 2 …,P K ], e is a mathematical constant with a value of 2.7183.

4. According to claim 1, a network intrusion detection method based on deep time series clustering, It is characterized in that S5, including: S51: Instantiate the memory network module as a memory matrix M∈R C×F , used to store C vectors with F dimensions, let the row vector m i , Represented as the i-th row of M; Where [C] represents the set of integers from 1 to N, and each m i Represents a memory item, given an input λ z ∈R F , where F represents the filter size of the last layer of the encoder, and the similarity between the input z and the memory matrix M is calculated: in, Represents the output of the memory network, which represents the memory item m i The weighted average of i represents the i-th weight of ω, ω∈R C ,||ω i ||=1; the weight vector ω is composed of the input z and the memory item m i The similarity calculation is: Score uses the cosine similarity measurement strategy: S52: In the learning and training phase, the memory matrix is ​​updated by reconstructing the error to control the memory network module to memorize the generalized features of normal data; At the same time, the memory network module outputs the generalized features by combining all memory items and executes S6.

5. According to claim 4, a network intrusion detection method based on deep time series clustering, It is characterized in that S52, including: S521: learning the common features contained in all transformations based on a global memory network module, wherein the global memory network module is constructed using a shared memory matrix; The encoded latent features are used as input, and the global memory network module records the common features in the memory matrix. The output obtained through the shared global memory network module is Among them, f g (·) is the function of the global memory network module, θ g is the shared parameter of the global memory network module, and [K] = {1, 2, …, K}; S522: learning specific features contained in all transformations based on a local memory network module, wherein the local memory network module is constructed using K memory matrices, each memory matrix recording specific features of a corresponding transformation in normal data; The encoded potential features are used as input and the output is obtained through K local memory network modules. Among them, f l (·) is the functional form of the local memory network module, represents the parameters of K local memory network modules, and [K] = {1, 2, …, K}.

6. A network intrusion detection method based on deep time series clustering according to claim 1, It is characterized in that S6, including: S61: Based on the feedforward layer, the features and free variables k∈K are taken as input, and the weights α∈R 2K Generate fused representation; Among them, local memory and global memory each have 2 weights, and there are K transformations in total; The weights are normalized based on batch normalization and sigmoid activation, and the output values ​​are controlled within the range of (0, 1), thereby obtaining the feature representation of the adaptive fusion module: in, represents the feature representation generated by the adaptive fusion module; represents the weight of the shared features; Indicates the weight of a specific feature; S62: Taking z and z~ as the reconstructed original input data of the decoder, based on minimizing the Euclidean distance (l 2 norm) to obtain the reconstruction error L MSE : Among them, concat(·) represents and z i Series connection, represents the parameters of the i-th decoder; z represents the output result of the encoder; S63: Based on the sparse loss method, the entropy of the weight ω is minimized to obtain the self-supervisory error L spar :

7. A network intrusion detection method based on deep time series clustering according to claim 1, It is characterized in that S7, including: By integrating the reconstruction error and the self-supervision error, the objective function is obtained, and the deep time series clustering model is trained end-to-end based on the objective function, where the objective function is: J(θ)=L MSE +λ 1 L CE +λ 2 L spar Among them, λ 1 is the balancing weight of the cross entropy loss; 2 is the balancing weight of the self-error.

8. A network intrusion detection method based on deep time series clustering according to any one of claims 1 to 7, It is characterized in that S8, including: S81: Input the test data set χ={X 1 ,X 2 ,…,X H },X∈R V×N , and related parameters for model training; S82: Convert each input data to be tested into X={x 1 ,x 2 ,…,x K }∈R K×V×N , where K = 7, including original data and 6 transformed data, V represents the length of data, and N represents the total number of data; S83: Load model training parameters θ and adaptive fusion weights α; S84: Control the encoder to map high-dimensional data into a low-dimensional feature space Z, and output the feature matrix Z based on the local memory network module l , and output the feature matrix Z based on the global memory network module g , finally, based on the adaptive fusion module, the fusion feature Z~ of common features and specific features is output; S85: Input the low-dimensional fusion feature Z~ into the BIRCH clustering model. Each time a new data point is added to the CF tree, the cluster radius is calculated. The calculation formula of the cluster radius (R) is: Among them, the CF tree is a set of three data points in a cluster, and the data points are represented as: Where N is the number of data points; is the linear sum, i.e. the vector sum of all data points; SS is the square sum, i.e. the vector sum of the squares of all data points; Refers to the low-dimensional fusion feature data of the i-th category; S86: If the clustering radius of a data point is greater than a threshold value T, the data point is regarded as an outlier.

9. A network intrusion detection method based on deep time series clustering according to claim 1, It is characterized in that Also includes: After determining the abnormal point, obtain the data position and data type of the abnormal point and record them, classify the abnormal data points based on the data position of each abnormal point and the running program segment where they are located, obtain multiple associated abnormal data groups, and determine the abnormal correlation relationship between each abnormal point in each associated abnormal data group in combination with the current network architecture; Based on the abnormal association relationship, the security vulnerability type of the current network is determined, based on the security vulnerability type, a search is performed in a preset patch database to obtain a target patch, and the security vulnerability is repaired based on the target patch.

10. A network intrusion detection method based on deep time series clustering according to claim 1, It is characterized in that Based on the abnormal correlation, determine the security vulnerabilities of the current network, search in the preset patch database, and obtain the target patch, including: Based on the abnormal correlation relationship, determine the operation order and operation logic between the associated abnormal data points, and divide the associated abnormal points into operation gradients according to the operation logic; Based on the operation gradient division results, the abnormal points are clustered to obtain the operation logic abnormal clusters, and the operation subroutine segment types corresponding to each operation logic abnormal cluster are simultaneously obtained; According to the operation business type corresponding to the associated abnormal data group, combined with the current network architecture and the operation subroutine segment type corresponding to each operation logic abnormal cluster, determine the vulnerability type corresponding to each logic abnormal cluster; Obtain the vulnerability types corresponding to all logic anomaly clusters, combine the operation vulnerability logic types corresponding to the logic anomaly clusters with the operation gradient, and determine the security vulnerabilities of the current network; Based on multiple data vulnerabilities contained in the security vulnerabilities of the current network, a search is performed in a preset patch database to obtain target sub-patches, and the target sub-patches are combined to generate a target patch.

Images