Network intrusion detection method based on BiGRU and Inception-CNN

Abstract

The invention provides a network intrusion detection method based on BiGRU and Inception-CNN. The method comprises the following steps: acquiring a network traffic data sample; carrying out mixed sampling and denoising on the network flow data samples to obtain a balanced data set; performing dimension reduction operation on the balanced data set to obtain a dimension-reduced data set; constructing a network intrusion detection model by using the dimensionality reduction data set to obtain a constructed network intrusion detection model; the network intrusion detection model comprises a BiGRU network with an attention mechanism and an Inception-CNN (Convolutional Neural Network) network; and inputting to-be-detected network intrusion detection data into the constructed network intrusion detection model, and detecting a network attack behavior through the model. According to the method, the BiGRU and the Inception-CNN are introduced, so that the detection accuracy of the model on the attack traffic is improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method based on BiGRU and Inception-CNN. Background Art

[0002] The rapid development of the Industrial Internet of Things has brought tremendous growth to the global economy, but it is also accompanied by security risks such as the leakage of industrial core data and illegal manipulation of interconnected terminals. Industrial firewalls are a common means of protecting the Industrial Internet of Things. However, industrial firewall technology only provides a passive defense mechanism and may not be able to effectively block files and programs containing threat codes.

[0003] To address these issues, intrusion detection technology is deployed as a proactive network security measure. By continuously monitoring the network, it provides immediate protection against internal and external intrusions. The characteristics of intrusion detection include proactiveness, real-timeness, and dynamism, making it a promising research direction in the field of industrial IoT security.

[0004] Intrusion detection technology uses classifiers to distinguish between normal and abnormal data flows and generate alerts for potential attack behaviors. Currently, researchers have developed various intrusion detection models for specific network attacks and incorporated machine learning algorithms into these frameworks. These classifiers use a variety of algorithms, including Bayesian, decision trees, neural networks, and support vector machines. It is worth noting that intrusion detection algorithms based on deep learning have shown strong capabilities in feature extraction and classification, and have therefore attracted widespread attention in this field.

[0005] Compared with traditional intrusion detection methods, deep learning technology can show more efficient and accurate performance when analyzing the characteristics of large amounts of network traffic data. At present, the deep learning methods widely used in the field of intrusion detection include convolutional neural networks (CNN), recurrent neural networks (RNN) and long short-term memory networks (LSTM). Domestic and foreign scholars have conducted a lot of research in this field, promoting the application and development of deep learning technology in intrusion detection.

[0006] However, existing deep learning models face several challenges in detecting attack traffic: low accuracy, difficulty in capturing key information due to feature redundancy when dealing with high-dimensional complex attack traffic, and the model tends to learn a larger number of categories when dealing with imbalanced data. Summary of the invention

[0007] The present invention provides a network intrusion detection method based on BiGRU and Inception-CNN to solve the problems of low detection accuracy, feature redundancy and data imbalance in the prior art, thereby improving the network intrusion detection capability in the industrial Internet of Things environment.

[0008] A network intrusion detection method based on BiGRU and Inception-CNN, comprising:

[0009] Step 1: Obtain network traffic data samples;

[0010] Step 2: performing mixed sampling and denoising on the network traffic data samples to obtain a balanced data set;

[0011] Step 3: performing a dimensionality reduction operation on the balanced data set to obtain a dimensionality reduced data set;

[0012] Step 4: construct a network intrusion detection model using the dimension reduction data set to obtain a constructed network intrusion detection model; the network intrusion detection model includes: a BiGRU network with an attention mechanism and an Inception-CNN network;

[0013] Step 5: Input the network intrusion detection data to be detected into the constructed network intrusion detection model, and detect the network attack behavior through the model.

[0014] Furthermore, in the above-mentioned network intrusion detection method based on BiGRU and Inception-CNN, the step 2 includes:

[0015] Step 201: Divide the network traffic data samples into an original majority class sample set R and an original minority class sample set A;

[0016] Step 202: using the ADASYN algorithm to oversample the original minority class sample set A to generate a new minority class sample set A; using the RENN algorithm to undersample the original majority class sample set R to generate a new majority class sample set R;

[0017] Step 203: using the LOF algorithm to remove the noise of the new majority class sample set R and the new minority class sample set A, to obtain the denoised majority class sample set R and the minority class sample set A;

[0018] Step 204: Merge the denoised majority class sample set R and the minority class sample set A to obtain the balanced data set.

[0019] Furthermore, in the above-mentioned network intrusion detection method based on BiGRU and Inception-CNN, step 201 includes:

[0020] The network traffic data samples are classified according to attack categories, and then according to the classification results, the categories whose proportion after classification exceeds a preset proportion are classified as the majority class sample set R, and the remaining categories are classified as the minority class sample set A.

[0021] Further, in the above-mentioned network intrusion detection method based on BiGRU and Inception-CNN, step 202 includes:

[0022] (1) calculating the imbalance degree d of the network traffic data sample;

[0023] (2) Unbalanced degree d <d th , where d th is the predefined maximum allowable imbalance, then calculate the number of samples G that need to be generated for the minority class;

[0024] (3) For each sample in the original majority class sample set R, determine its k i nearest neighbors and calculate the ratio r i , where D i represents the number of samples belonging to the majority class among the k nearest neighbors, X| represents the total number of samples; for r i Normalized to Finally, calculate the number of samples that need to be synthesized for each minority class sample;

[0025] (4) Generate g for each sample in the original majority class sample set R i samples to form a new minority class sample set newA;

[0026] (5) Select k2 nearest neighbors from newR for each sample in the original minority class sample set A;

[0027] (6) Identify the number of minority samples in the k2 nearest neighbors of each majority sample. If the number exceeds e, where e = 1, exclude the sample;

[0028] (7) Repeat steps (5) and (6) until a stable majority class sample set newR is generated.

[0029] Furthermore, in the network intrusion detection method based on BiGRU and Inception-CNN as described above, the network traffic data samples come from Edge-IIoTset, CIC-IDS2017 and CIC IoT 2023 data sets.

[0030] Furthermore, in the above-mentioned network intrusion detection method based on BiGRU and Inception-CNN, the step three includes:

[0031] Step 301: using the random forest algorithm to evaluate the importance of sample features of the balanced data set, and then analyzing the correlation between features in combination with the Pearson correlation coefficient, and finally obtaining the dimension-reduced data set.

[0032] Furthermore, in the above-mentioned network intrusion detection method based on BiGRU and Inception-CNN, step 301 includes:

[0033] (1) According to the balanced data set, select corresponding out-of-bag data;

[0034] (2) Calculate the error of this part of the out-of-bag data and mark it as error a ;

[0035] (3) determining a complete out-of-bag data sample based on the balanced data set, and randomly introducing a disturbance to the complete out-of-bag data sample;

[0036] (5) Calculate the out-of-bag data error after the disturbance is introduced and mark it as error b ;

[0037] (6) If the random forest contains M trees, the feature importance score is calculated using the following formula:

[0038] (7) For two variables X and Y, calculate the covariance cov(X,Y) and standard deviation S between X and Y X and S Y ;

[0039] (8) Then, the Pearson correlation coefficient r is calculated using the following formula X,Y :

[0040]

[0041] (9) According to the importance score I and correlation coefficient r of the feature X,Y , and finally determine the reduced dimension data set.

[0042] Furthermore, the network intrusion detection method based on BiGRU and Inception-CNN as described above is characterized in that the use of the reduced dimension data set to construct a network intrusion detection model comprises:

[0043] Initialization: The weights of the BiGRU layer are randomly initialized, and the query vector in the attention mechanism is assigned a random weight;

[0044] Forward propagation: A forward GRU layer with 128 units is defined and the input data X is passed to this layer to obtain the forward information representation The input data X is a certain data in the dimension reduction data set;

[0045] Backward propagation: A reverse GRU layer with 128 units is defined and the input data X is passed to this layer to obtain the reverse information representation

[0046] Merge output: Merge bidirectional information by adding the outputs of the forward and backward GRU layers to form the final output representation h t ;

[0047] Attention mechanism: Use the attention mechanism to calculate the attention weight of each time step of the input data to strengthen the model's attention to key information;

[0048] Inception module: The Inception module contains four branches. The first branch only performs a 1×1 convolution operation, and the following three branches perform convolution and pooling operations to extract features at different levels.

[0049] Final layer: The output of the model is converted into a class probability distribution by applying a softmax layer.

[0050] Beneficial effects:

[0051] The network intrusion detection method based on BiGRU and Inception-CNN provided by the present invention has the following advantages:

[0052] 1. By introducing BiGRU and Inception-CNN, the model’s detection accuracy for attack traffic is improved.

[0053] 2. By adopting the feature selection method combining Pearson correlation coefficient and random forest, feature redundancy is effectively eliminated and the model's ability to capture key information is enhanced.

[0054] 3. Through the mixed sampling strategy, the data imbalance problem is solved and the biased learning of the model is reduced.

[0055] 4. The local outlier factor algorithm is used to process the potential noise data introduced in the mixed sampling process, thereby improving the robustness and reliability of the model. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0057] Figure 1 It is a flow chart of the network intrusion detection method provided by the present invention;

[0058] Figure 2 It is a schematic diagram of the structure of the network intrusion detection model provided by the present invention;

[0059] Figure 3 It is a comparison of the category proportions of the data set before and after the application of the ARL algorithm in the implementation of the present invention;

[0060] Figure 4 It is a comparison of the data set before and after the data noise points are deleted before and after the ARL algorithm is applied in the implementation of the present invention;

[0061] Figure 5 The importance of the features calculated by the random forest algorithm using the RF-P feature selection algorithm in the implementation of the present invention;

[0062] Figure 6 is the correlation of each feature analyzed by the result of Pearson correlation analysis using the RF-P feature selection algorithm in the embodiment of the present invention;

[0063] Figure 7 It is a comparison of the training performance of the model with and without the ARL algorithm applied in the embodiment of the present invention;

[0064] Figure 8 It is a classification report heat map of the model with and without the ARL algorithm applied in the embodiment of the present invention;

[0065] Fig. 9 is the model training performance of NIDS-BAI in the embodiment of the present invention;

[0066] Fig.10 is a bar chart of the model classification report of NIDS-BAI in an embodiment of the present invention;

[0067] Fig.11 It is a ROC curve area diagram of NIDS-BAI in the embodiment of the present invention. DETAILED DESCRIPTION

[0068] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] The method provided by the present invention aims to solve the problems of low detection accuracy, feature redundancy and data imbalance faced in intrusion detection of industrial Internet of Things (IIoT). The method comprises the following steps: first, preprocessing the original network traffic data, including data cleaning, normalization and data enhancement. Then, the adaptive synthetic sampling (ADASYN) and repeated edited nearest neighbor (RENN) algorithms are applied to perform mixed sampling of the data to solve the problem of data imbalance, and the local outlier factor (LOF) algorithm is used to process the potential data set noise introduced by mixed sampling to improve data quality. Then, a feature selection method combining Pearson correlation coefficient and random forest is adopted to eliminate feature redundancy and extract key features. On this basis, an intrusion detection model based on BiGRU and Inception-CNN is constructed, wherein the BiGRU module is used to capture the bidirectional time-dependent features of the input data, the Inception-CNN module is used to perform multi-scale feature extraction, and the attention mechanism module is used to enhance the model's attention to key features and improve the detection accuracy. Afterwards, the model is trained using the processed data, and the performance is evaluated on the validation set to optimize the model parameters. Finally, the detection performance of the model is verified on the test set, and the trained model is deployed in the actual industrial Internet of Things environment for intrusion detection. Experimental results show that this method exhibits excellent detection performance on the Edge-IIoTset, CIC-IDS2017, and CIC IoT 2023 datasets, verifying its application value and potential in industrial Internet of Things security.

[0070] Figure 1 It is a flow chart of the network intrusion detection method provided by the present invention. Figure 1 As shown, the network intrusion detection method based on BiGRU and Inception-CNN provided by the present invention includes:

[0071] Step 1: Obtain network traffic data samples.

[0072] Step 2: Perform mixed sampling and denoising on the network traffic data samples to obtain a balanced data set.

[0073] Specifically, a hybrid sampling method named ARL (ADASYN-RENN-LOF) is constructed, which combines the ADASYN, RENN and LOF algorithms to solve the class imbalance and noise problems in the data. The method mainly includes the following main steps: First, the original data set is divided into majority and minority classes. Then, the minority class samples are oversampled using the ADASYN algorithm to generate a new set of minority class samples. At the same time, the majority class samples are undersampled using the RENN algorithm to generate a new set of majority class samples. Next, the LOF algorithm is used to eliminate the noise in the sampled data set. Finally, the resampled and denoised majority and minority class samples are merged to form a balanced data set, thereby avoiding the model's bias towards learning features of a larger number of categories, which helps to train a network intrusion detection model with better generalization capabilities. The detailed steps of the ARL algorithm are as follows:

[0074] The algorithm accepts the original majority class sample set R and the minority class sample set A as input. The output is the balanced majority class sample set, labeled newR, and the minority class sample set, labeled newA. The steps are as follows:

[0075] (1) Calculate the imbalance degree d of the data set.

[0076] (2) If d <d th (where d th is the predefined maximum allowable imbalance), the following steps are performed:

[0077] (3) Calculate the number of samples G that need to be generated for the minority class.

[0078] (4) For each sample in R, determine its k i nearest neighbors and calculate the ratio r i , where D i represents the number of samples belonging to the majority class among the k nearest neighbors, and |X| represents the total number of samples. i Normalized to Finally, the number of samples that need to be synthesized for each minority class sample is calculated.

[0079] (5) Generate g for each sample in R i samples to form a new minority class sample set.

[0080] (6) Select k2 nearest neighbors from newR for each sample in A.

[0081] (7) Identify the number of minority samples among the k2 nearest neighbors of each majority sample, and exclude the sample if the number exceeds e (where e=1).

[0082] (8) Repeat steps (6) and (7) until a stable majority class sample set is generated.

[0083] (9) Eliminate the noise in newA and newR to obtain the final newA and newR.

[0084] The method of dividing the network traffic data samples into an original majority class sample set R and an original minority class sample set A specifically includes:

[0085] The network traffic data samples are classified according to attack categories, and then according to the classification results, the categories whose proportion after classification exceeds a preset proportion are classified as the majority class sample set R, and the remaining categories are classified as the minority class sample set A.

[0086] Specifically, Figure 3 Take this as an example to illustrate, first classify the network traffic data samples, Figure 3 The left side shows eight classification categories, including "benign", "DoS", "DDoS"... "BruteForce", etc. Then, the top three categories with the highest percentage, namely "DoS", "DDoS" and "Mirai", are divided into the majority class sample set R, and the remaining categories are classified as the minority class sample set A. Another thing to note is that "benign" represents normal network traffic, not attack traffic. When training the model, it is necessary not only to identify attack traffic, but also to accurately identify normal traffic, otherwise the model may misjudge normal traffic as attack traffic.

[0087] The method provided by the present invention realizes balanced sampling by adopting mixed sampling technology, which effectively avoids the potential damage to the internal structure of the data set caused by single oversampling or undersampling. The core idea of ​​mixed sampling is to maintain the natural characteristics of data distribution while ensuring the balance of the number of samples in each category.

[0088] Step three: Perform a dimensionality reduction operation on the balanced data set to obtain a dimensionality reduced data set.

[0089] Specifically, after the mixed sampling is completed, a feature selection algorithm called RF-P (RandomForest-Pearson Correlation Coefficient) is used on the mixed sampling data set. It combines the random forest algorithm and the Pearson correlation coefficient to solve the problem of data feature redundancy. The algorithm first uses the random forest algorithm to evaluate the importance of sample features, and then combines the Pearson correlation coefficient to analyze the correlation between features. By combining these two methods, RF-P can more accurately identify features related to attack behavior, thereby improving the robustness and performance of the model.

[0090] Random forest is a powerful machine learning algorithm that can effectively handle high-dimensional data and nonlinear relationships. The Pearson correlation coefficient is used to accurately measure the linear correlation between features. In the field of industrial IoT security, attack traffic data is usually highly complex. Traditional feature selection techniques may not be able to fully capture this complexity. By combining these two methods, the present invention can more accurately identify features related to attack behaviors, thereby improving the robustness and performance of the model. The detailed steps of the algorithm are as follows:

[0091] (1) Select the corresponding out-of-bag data based on the balanced data set, that is, those data that are not used as training samples when building a specific tree.

[0092] (2) Calculate the error of this part of the out-of-bag data and mark it as error a .

[0093] (3) Next, for the complete out-of-bag data sample, perform the following operations:

[0094] (4) Randomly introduce perturbations to these out-of-bag data samples.

[0095] (5) Calculate the out-of-bag data error after the disturbance is introduced and mark it as error b .

[0096] (6) If the random forest contains M trees, the feature importance score is calculated using the following formula:

[0097]

[0098] For two variables X and Y:

[0099] (7) First, calculate the covariance cov(X,Y) between X and Y.

[0100] (8) Next, calculate the standard deviation S of X and Y respectively X and S Y .

[0101] (9) Then, the Pearson correlation coefficient was calculated using the following formula:

[0102]

[0103] The value range of Pearson correlation coefficient is between -1 and 1. If it is close to ±1, it means that there is a high linear correlation between the two features; if it is close to 0, it means that there is no linear correlation between the two features.

[0104] (10) According to the importance score I and the correlation coefficient r of the feature X,Y , and finally determine the reduced dimension data set.

[0105] Specifically, Figure 5 and Figure 6 The analysis results are given below to illustrate how to determine the dimension reduction dataset:

[0106] For features with strong linear correlation, important features were retained based on their importance measure. For features with weak linear correlation, their correlation scores were analyzed and if the score was below zero, the feature was removed. For features with correlation scores outside the range of analysis, their feature importance from random forest was considered and if the importance measure was greater than 0.01, the feature was retained.

[0107] Step 4: Use the reduced dimension data set to construct a network intrusion detection model to obtain a constructed network intrusion detection model; the network intrusion detection model includes: a BiGRU network with an attention mechanism and an Inception-CNN network.

[0108] Specifically, a BiGRU network and an Inception-CNN network with an attention mechanism are constructed based on the dimension reduction dataset. First, the BiGRU network performs bidirectional data analysis to effectively capture the long-term dependencies between the two ends of the data, thereby enhancing the model's ability to identify complex attack traffic. Next, an attention mechanism is introduced to dynamically adjust the importance of different time steps in the output of the BiGRU network to improve the output quality of the BIGRU network. The attention mechanism enables the model to focus on analyzing the key parts of the attack traffic, improving the accuracy and adaptability of detection. Subsequently, the Inception-CNN network is used to optimize the output features of the attention mechanism and enhance the representation ability of the model by extracting multi-scale spatial information. Inception-CNN uses convolution kernels of different sizes to extract features and fuses them together, enhancing the model's understanding of features at different levels. Finally, the network traffic is classified through the decision layer.

[0109] like Figure 2 As shown in Figure 1, the modeling process of the network intrusion detection model is as follows:

[0110] Initialization: The weights of the BiGRU layers are randomly initialized and the query vectors in the attention mechanism are assigned random weights.

[0111] Forward propagation: A forward GRU layer with 128 units is defined and the input data X is passed to this layer to obtain the forward information representation

[0112] Backward propagation: A reverse GRU layer with 128 units is defined and the input data X is passed to this layer to obtain the reverse information representation

[0113] Merge output: Merge bidirectional information by adding the outputs of the forward and backward GRU layers to form the final output representation h t .

[0114] Attention Mechanism: Using the attention mechanism, the attention weight of each time step of the input data is calculated to strengthen the model's attention to key information.

[0115] Inception module: The Inception module contains four branches. The first branch only performs a 1×1 convolution operation, and the following three branches perform convolution and pooling operations to extract features at different levels.

[0116] Final layer: The output of the model is converted into a class probability distribution by applying a softmax layer.

[0117] Step 5: Input the network intrusion detection data to be detected into the constructed network intrusion detection model, and detect the network attack behavior through the model.

[0118] The network intrusion detection model (NIDS-BAI) provided by the present invention includes a BiGRU network with an attention mechanism and an Inception-CNN network. The two networks work together to improve the model's ability to identify attacks in network traffic.

[0119] The following is a detailed introduction to the construction process of the network intrusion detection model:

[0120] The test environment of the embodiment of the present invention is shown in Table 1 below:

[0121] Table 1 Experimental environment

[0122]

[0123] This paper uses three datasets, Edge-IIoTset, CIC-IDS2017 and CIC IoT 2023, to evaluate the performance of the NIDS-BAI model in handling intrusion detection in industrial Internet of Things environments.

[0124] First, the Edge-IIoTset dataset is designed for industrial IoT applications and includes 2,219,200 records and 60 features. The dataset covers 6 different types of attacks as well as normal traffic data. In addition, the CIC-IDS2017 dataset contains 2,597,119 records and 79 features, including 15 different types of attacks as well as normal traffic data. CICIoT Dataset 2023 includes 2,219,200 records and 46 features, covering 8 different types of attacks as well as normal traffic data.

[0125] The Edge-IIoTset dataset covers data from various IoT devices (more than 10 types), such as low-cost digital sensors for sensing temperature and humidity, ultrasonic sensors, water level sensors, pH sensors, soil moisture sensors, heart rate sensors, flame sensors, etc. The CIC IoT 2023 dataset is the data obtained from 33 attacks executed on a topology consisting of 105 IoT devices. Finally, the CIC-IDS2017 dataset is generated based on real network traffic and simulated attacks to evaluate the performance of intrusion detection systems (IDS) in detecting various network attacks, including DoS, DDoS, malicious code, and botnet attacks. The diversity of these datasets helps to evaluate the effectiveness of the proposed model in different network attack scenarios. Please refer to Table 2, which provides a detailed breakdown of the entire network traffic for each dataset.

[0126] Table 2 Dataset division

[0127]

[0128]

[0129] In network intrusion detection, normal network activities are usually regarded as negative samples, while malicious attacks are regarded as positive samples. When evaluating model performance, the present invention focuses on several evaluation indicators: True Positives (TP): The model correctly classifies malicious attack samples as positive samples, showing its ability to detect actual attack behaviors. False Positives (FP): The model incorrectly classifies normal network activities as positive samples, which may lead to false alarms. True Negatives (TN): The model correctly classifies normal network activities as negative samples, indicating the model's ability to identify the lack of actual attacks. False Negatives (FN): The model incorrectly classifies malicious attack samples as negative samples, resulting in missed detections. As shown in the confusion matrix in Table 3.

[0130] Table 3 Confusion matrix

[0131]

[0132] (1) Accuracy (ACC) refers to the ratio of the number of samples that can be correctly predicted to the total number of samples. It is the most common evaluation indicator. The larger the ACC, the better the performance. The formula is:

[0133]

[0134] (2) Recall (Rec), also known as True Positive Rate (TPR), is the ratio of the number of positive samples judged as positive samples to the number of positive samples, which can reflect the ability of the classifier to correctly predict the full degree of positive samples. The larger the R, the better the performance. The formula is:

[0135]

[0136] (3) Precision (Pre) indicates how many positive samples are actually positive samples, which can reflect the ability of the classifier to correctly predict the accuracy of positive samples. The larger the P, the better the performance. The formula is:

[0137]

[0138] (4) The comprehensive evaluation index F1 (F-Measure) is used to comprehensively consider precision and recall rate, which is a weighted average of recall rate and precision. The larger the F1, the better the performance. The formula is:

[0139]

[0140] The embodiment of the present invention designs four parts of experiments: data mixed sampling experimental analysis, feature selection algorithm experimental analysis, performance comparison before and after mixed sampling, comparative evaluation of different feature selection methods, comparative experiment between single model and mixed model, and model performance verification and comparison experiment.

[0141] 1. Data mixed sampling experiment analysis: By comparing the distribution of original data and resampled data, ensure that the model does not favor the category with more data during training.

[0142] 2. Experimental analysis of feature selection algorithm: Taking the CIC-IoT 2023 dataset as an example, the feature selection of the RF-P algorithm is explained, so that the model can accurately identify attack features and prevent the redundancy between high-dimensional complex traffic features from causing the problem of reduced model performance.

[0143] 3. Performance comparison before and after hybrid sampling: By evaluating the impact of the ARL algorithm on model performance, the positive effect of the ARL algorithm in improving the generalization ability of the model is emphasized.

[0144] 4. Comparative evaluation of different feature selection methods: The purpose of the experiment is to compare the feature selection technique (RF-P) proposed in this paper with the principal component analysis (PCA) and information gain (IG) methods to evaluate the improvement of the model performance by the proposed feature selection technique.

[0145] 5. Comparative experiment between single model and hybrid model: The present invention independently evaluates the two modules of BiGRU-Attention (abbreviated as BGA) and Inception-CNN (abbreviated as ICNN). Then, their performance is compared with that of the NIDS-BAI model to verify the performance enhancement of the NIDS-BAI model.

[0146] 6. Model performance verification and comparative experiments: In a multi-classification scenario, the classification accuracy of various traffic types is evaluated and compared with the methods proposed in previous studies. The results show that NIDS-BAI performs better than other models under the same benchmark.

[0147] In the data mixed sampling experiment, the category distribution was significantly optimized for the CIC IoT 2023 dataset by applying the ARL algorithm. In this process, the minority class samples were expanded using the ADASYN algorithm, including 'Benign', 'Spoofing', 'Recon', 'Web', and 'BruteForce', thereby enhancing the model's recognition ability for these categories. At the same time, the RENN algorithm effectively undersampled the majority class samples, namely 'DoS', 'DDoS', and 'Mirai', reducing their number of samples. The ARL algorithm alleviates the phenomenon of class imbalance in the dataset. Figure 3 The changes in the distribution of the dataset before and after applying the ARL algorithm are shown, demonstrating its effectiveness in solving the class imbalance problem.

[0148] Figure 3 The left figure shows the significant imbalance in the proportion of classes in the original data. The 'DDoS' class dominates, accounting for about 72.79%, while the proportions of 'Benign', 'Spoofing', 'Recon', 'Web', and 'BruteForce' classes are smaller, accounting for 2.35%, 1.04%, 0.76%, 0.05%, and 0.03%, respectively. Data imbalance causes the model to tend to learn the features of common categories, while ignoring the learning of uncommon categories. Figure 3 The figure on the right shows that after applying the ARL algorithm, the proportion of each category in the dataset becomes relatively balanced. The proportion of the 'DDoS' class drops to 12.74%, while the proportions of the 'Benign', 'Spoofing', 'Recon', 'Web', and 'BruteForce' classes increase to 6.82%, 13.28%, 13.46%, 13.60%, and 13.77%, respectively. The ARL algorithm avoids the model from over-learning common category features and improves the model's generalization ability and detection rate for all categories.

[0149] After mixed sampling, the LOF algorithm is used to deal with the potential dataset noise introduced. LOF is an algorithm for anomaly detection that measures the density of each sample point relative to its neighboring sample points. By using LOF to identify and remove potential noise in the dataset, samples that deviate from the original data distribution can be prevented from affecting the model's learning process. Figure 4 The distribution of outliers before and after LOF processing is shown. Figure 4 The left image shows the data distribution after mixed sampling, where the noise marked in red is calculated by the LOF algorithm. The right image represents the data distribution after removing the red noise. Figure 4 It can be clearly seen that the LOF algorithm does not change the overall distribution of the data set. This further ensures that the model can better capture meaningful features during training, helps to strengthen the robustness of the model, and improves the generalization ability of the model.

[0150] Experimental analysis of feature selection algorithm,Taking the CIC-IoT 2023 dataset as an example, the feature selection process of the RF-P algorithm is illustrated.,First, the importance of each feature in the CIC-IoT 2023 dataset is calculated using the random forest algorithm.,Then, the features are ranked according to their importance, such as Figure 5 As shown. Figure 5 ,The importance of the IAT feature is 0.5163, making it the most critical feature. In addition, the importance measures of several other features are zero, indicating that they have the least impact on the target variable. Therefore, in the modeling process, it is possible to consider excluding these features to reduce the computational complexity and reduce the risk of overfitting. However, relying solely on the importance of features to select features is a single criterion, and the results may lack persuasiveness. Therefore, the present invention also uses the results of Pearson correlation analysis and combines them with the feature importance results to perform feature selection. Figure 5 Pearson correlation results between these features are presented.

[0151] In order to further explore whether there is a correlation between two-dimensional distributions of different features, the present invention performs correlation analysis on different features. The results show that there are significant differences between these features. For example, the correlation score of the "Min" feature is 0.3087, while the "IRC" and "Telent" features are beyond the scope of the correlation analysis because they are unique values, and their correlation scores cannot be calculated. The correlation measurement range of all features is from -0.1249 to 0.3087.

[0152] The present invention is based on Figure 5 and Figure 6Feature selection was performed based on the analysis results. For features with strong linear correlation, important features were retained based on their importance measure. For features with weak linear correlation, their correlation scores were analyzed, and if the score was less than zero, the feature was deleted. For features with correlation scores outside the analysis range, their feature importance from random forest was considered, and if the importance measure was greater than 0.01, the feature was retained. In the end, 39 features were retained for the Edge-IIoTset dataset, 61 features were retained for the CIC-IDS2017 dataset, and 35 features were retained for the CIC-IoT 2023 dataset.

[0153] In order to evaluate the impact of the ARL algorithm on model performance, this paper uses two CIC IoT 2023 datasets: one with the ARL algorithm and the other without. By analyzing the key performance indicators of the two datasets under NIDS-BAI model training, including training accuracy, test accuracy, and classification report heat map, the effectiveness of the ARL algorithm on model training is evaluated, and the positive effect of the ARL algorithm in improving the generalization ability of the model is emphasized. For detailed experimental results, see Figure 7 .like Figure 7 As shown in (b), the dataset without the ARL algorithm has poor generalization ability between different categories. Observing the accuracy curve, we can find that some categories dominate the training process, causing the model to tend to learn some common network traffic. Therefore, after 50 trainings, the training accuracy of the dataset is only 0.905 and the test accuracy is 0.987. Figure 7 As shown in (a), after applying the ARL algorithm to the data set for experiment, observing the accuracy curve, it can be found that the generalization ability of the model between different categories has been significantly improved. After 50 trainings, the training accuracy of the model is 0.996 and the test accuracy is 0.995.

[0154] The experimental results of comparing the data sets with and without the ARL algorithm show that the generalization ability of the model is enhanced after the ARL algorithm is applied.

[0155] In order to more convincingly evaluate the enhancement effect of the ARL algorithm on model performance, the present invention presents the classification report of two data after 50 iterations, including precision, recall and F1 score. The experimental results clearly show the positive impact of the ARL algorithm on the generalization ability of the model. The specific classification report heat map is as follows Figure 8 As shown. Figure 8 In (a), it is obvious that the dataset with the ARL algorithm improves the generalization ability of the model and achieves higher precision, recall and F1 scores in most categories. Figure 8As shown in (b), when the model is trained on a dataset without the ARL algorithm, the precision, recall, and F1 score indicators for the “Web” and “BruteForce” categories are all zero, indicating that the model fails to correctly identify these two categories.

[0156] In summary, when the model is trained on a dataset without the ARL algorithm, the model tends to learn a larger number of categories, resulting in poor recognition and classification performance for a smaller number of categories. However, when the model is trained on a dataset with the ARL algorithm, it can learn each category in a more balanced manner, thereby improving the model's recognition and classification capabilities for a smaller number of categories. Therefore, using the ARL algorithm can enhance the robustness and generalization ability of the model, ensuring that it performs excellent performance on all categories.

[0157] In the comparative evaluation experiment of different feature selection methods, in this section, experiments are conducted on three data sets (Edge-IIoTset, CIC-IDS2017 and CIC IoT 2023). The purpose of the experiment is to compare the feature selection technology (RF-P) proposed in this paper with the principal component analysis (PCA) and information gain (IG) methods to evaluate the improvement of the proposed feature selection technology on the model performance. The key indicators of comparison include accuracy, recall, precision and F1 score. The specific experimental results are shown in Table 4.

[0158] Table 4 Comparative evaluation of different feature selection methods

[0159]

[0160] From the results in Table 4, it can be clearly observed that the use of the RF-P method for feature selection achieves better performance. This is because the PCA method usually reduces the dimension by retaining features with larger variance in the data, but sometimes ignores features with smaller variance but may contain important information, which may affect the overall performance of the model. The information gain method, on the other hand, relies too much on the information gain between attributes to select features, which may result in the selected features being not comprehensive enough to cover all information that may be useful to the model. In contrast, the RF-P algorithm used in the present invention takes into account the relevance and importance of features more comprehensively, thereby significantly improving model performance and accuracy.

[0161] In the comparative experiments between single models and hybrid models, the purpose of this paper is to verify whether the proposed NIDS-BAI model is superior to the separate use of its component modules in terms of performance. The two modules, BiGRU-Attention (abbreviated as BGA) and Inception-CNN (abbreviated as ICNN), were independently evaluated by conducting experiments on three datasets: Edge-IIoTset, CIC-ids2017, and CIC IoT 2023. Then, their performance was compared with that of the NIDS-BAI model to verify the performance enhancement of the NIDS-BAI model. The experimental results are shown in Table 5.

[0162] Table 5 Comparative experiments between single model and hybrid model

[0163]

[0164] According to the evaluation results in Table 5, the proposed NIDS-BAI model significantly outperforms the BGA and Inception-CNN models in terms of performance. The significant improvement in the performance of the NIDS-BAI model can be attributed to its integration of the core advantages of the other two models. The BGA layer introduces an attention mechanism to process sequence data, which enables the model to focus on key parts in a targeted manner, thereby improving the accuracy of predictions. On the other hand, the ICNN layer uses multi-scale convolution kernels to operate in parallel, which enhances the understanding of key features and thus improves the classification accuracy of the model. The NIDS-BAI model combines the characteristics of these two models, effectively utilizes their respective advantages, and achieves significant improvements in performance.

[0165] In the model performance verification and comparative experiments, the NIDS-BAI model was comprehensively evaluated on the Edge-IIoTset, CIC-IDS2017, and CIC-IoT 2023 datasets. The evaluation mainly focused on key indicators, including training accuracy, training loss, precision, recall, F1 score, and ROC curve to evaluate the performance of the NIDS-BAI model on these datasets.

[0166] For the Edge-IIoTset, CIC-IDS2017, and CIC-IoT 2023 datasets, the training accuracy of the NIDS-BAI model represents the proportion of correct predictions on the training set during the training process, while the training loss reflects the degree of error in the training phase. The validation accuracy and validation loss measure the prediction accuracy and degree of error of the model on the validation set. These indicators help evaluate the learning ability and fit of the model during the training process and provide important references for further performance analysis. Figure 8 As shown:

[0167] The training accuracy and loss curves of Edge-IIoTset, CIC-IDS2017, and CIC-IoT 2023 datasets are shown in Figure 2. Fig. 9 As shown in the figure. It can be observed from the curve that during the training process, the training accuracy of the NIDS-BAI model gradually increases, while the training loss gradually decreases. In addition, the validation accuracy and validation loss also show similar trends, indicating that the performance of the model on the training set and validation set is consistent. For example, during the training of the model on the Edge-IIoTset dataset, the model achieved a training accuracy of 0.9467 and a training loss of 0.1262 at the 200th iteration, while the validation accuracy was 0.9476 and the validation loss was 0.1218. This shows that the model can effectively learn the characteristics of the dataset and achieve a high accuracy on the test set. When the model was trained on the CIC-IDS2017 dataset, at the 200th iteration, the NIDS-BAI model showed excellent training performance, with a training accuracy of 0.9915, a training loss of 0.0369, a validation accuracy of 0.9936, and a validation loss of 0.0314. This shows that the model can classify the network traffic data in this dataset with high accuracy and low error rate. On the CIC-IoT 2023 dataset, the NIDS-BAI model showed a training loss of 0.0099, a training accuracy of 0.9977, a validation loss of 0.0226, and a validation accuracy of 0.9953 in the last iteration of training. Although there was some fluctuation in the initial 0-45 iterations, the accuracy and loss subsequently improved significantly in the 45-47 iterations, indicating that the model was able to skillfully learn and adapt to the unique characteristics of the CIC-IoT 2023 dataset.

[0168] In order to comprehensively evaluate the performance of the NIDS-BAI model on the Edge-IIoTset, CIC-IDS2017, and CIC-IoT 2023 datasets, this paper evaluates the recall, precision, and F1 score key indicators of the model for each network traffic in the three datasets. These indicators are crucial for comprehensively evaluating the overall performance of the model on different datasets. For detailed evaluation results, please see Fig.10 .

[0169] according to Fig.10 As shown in the figure, in the Edge-IIoTset dataset, the NIDS-BAI model shows high precision, recall, and F1 scores in categories such as "Benign" and "MITM", indicating that it has strong recognition capabilities. However, the precision, recall, and F1 scores in the "Injection" and "Scanning" categories are relatively low, indicating that the NIDS-BAI model still has challenges in accurately identifying certain attack traffic in this dataset.

[0170] In the CIC-IoT 2023 dataset, the NIDS-BAI model showed high performance on categories such as "DoS", "DDoS", "Mirai", and "BruteForce". However, in the "Spoofing" and "Recon" categories, although the precision is relatively high, the recall and F1 score are low. The performance in the "Benign" category is the worst because the data in this category has a high diversity, making it difficult for the model to accurately identify this category.

[0171] In the CIC-IDS2017 dataset, the NIDS-BAI model showed excellent capabilities in categories such as "DDoS", "DoS GoldenEye", "PortScan", "Bot", and "Heartbleed". However, the NIDS-BAI model performed poorly in categories such as "Web Attack_XSS", "Web Attack_Sql Injection", and "Infiltration". These results indicate that the model needs to be improved in these specific categories to improve performance.

[0172] In order to better evaluate the discrimination ability of the NIDS-BAI model, the present invention introduces the receiver operating characteristic (ROC) curve analysis. The ROC curve shows the balance between the true positive rate and the false positive rate at different classification thresholds, so as to gain a deeper understanding of the classification ability of the model. By adopting macro-average and micro-average indicators, the evaluation of the present invention becomes more comprehensive. ROC curve analysis provides a comprehensive perspective on the performance of the NIDS-BAI model, which helps to make more targeted improvements to meet the complex requirements of intrusion detection scenarios. Please refer to Fig.11 .

[0173] like Fig.11 As shown in the figure, the NIDS-BAI model shows excellent performance on the Edge-IIoTset dataset, especially in the MITM and Benign categories, with high AUC scores. Overall, the macro-average ROC curve area is 0.99277 and the micro-average ROC curve area is 0.99831.

[0174] For the CIC-IDS2017 dataset, the AUC scores of most categories remain at a high level, such as FTP-Patator, SSH-Patator, etc., but the AUC score of "Web Attack_Sql Injection" is relatively low. Overall, the macro-average ROC curve area of ​​the NIDS-BAI model on this dataset is 0.99647, and the micro-average ROC curve area is 0.99997.

[0175] On the CIC-IoT 2023 dataset, the NIDS-BAI model performs well in identifying categories such as DoS, DDoS, and Mirai (AUC = 1.00000), but the AUC score for the Spoofing category is slightly lower. Overall, the macro-average ROC curve area is 0.99876 and the micro-average ROC curve area is 0.99997.

[0176] Based on the above experimental analysis, according to the training accuracy and loss curve, the NIDS-BAI model has shown significant ability in effectively learning the features of different network traffic data sets and has achieved high accuracy in predicting malicious network traffic. This is thanks to the proposed RF-P algorithm, which can handle complex high-dimensional attack traffic and eliminate redundancy between features, so that the model can accurately extract key information.

[0177] Analysis of key indicators such as recall, precision, and F1 score for each type of network traffic in the three datasets shows that the model performs well in identifying most categories. This is because the ARL algorithm can learn each category in a more balanced way, thereby improving the model's ability to recognize and classify a smaller number of categories. Although the recognition ability in some categories still needs to be improved, the use of the ARL algorithm can enhance the robustness and generalization ability of the model, ensuring that it performs excellent performance on all categories.

[0178] In summary, the model provided by the present invention performs well in macro-average and micro-average indicators on the three data sets. These performance improvements are attributed to the present invention giving full play to the capabilities of the BiGRU network with attention mechanism and the Inception-CNN network, thereby improving the classification accuracy of the model.

[0179] To evaluate the feasibility of the NIDS-BAI model, the present invention adopts the method previously proposed on the Edge-IIoTset, CIC-IDS2107 and CIC IoT 2023 datasets, and compares the performance of the model with other previously proposed models in terms of accuracy (ACC), recall (Rec), precision (Pre) and F1 score. The comparison results are shown in Table 6.

[0180] Table 6 compares the performance of multiple models

[0181]

[0182]

[0183] In the Edge-IIoTset dataset, the recall, precision, and F1 of the NIDS-BAI model reached 0.947, 0.948, and 0.946, respectively, and there is still room for improvement in ACC. In the CIC-IDS2107 dataset, the overall performance of the DL-BiLSTM model is slightly higher. However, on the CIC IoT2023 dataset, the overall performance of the NIDS-BAI model far exceeds that of the DL-BiLSTM model.

[0184] Although the comprehensive index of the DL-BiLSTM model on the CIC-IDS2107 dataset is slightly higher, and the accuracy of the NIDS-BAI model on the Edge-IIoTset dataset is slightly lower than that of the DNN model, the NIDS-BAI model shows significantly superior robustness and generalization ability in complex network environments compared with other models. This highlights the great potential and practical value of the NIDS-BAI model in the field of IIOT intrusion detection.

[0185] Experimental results show that in the context of IIoT intrusion detection, the feature selection method combining Pearson correlation coefficient and random forest significantly improves performance. Random forest can effectively handle high-dimensional data and complex relationships. When combined with Pearson correlation coefficient, it eliminates feature redundancy, further improves the accuracy of feature selection of NIDS-BAI model, and reduces the risk of overfitting.

[0186] Combining ADASYN, RENN and LOF algorithms has multiple advantages. These algorithms effectively solve the problems of category imbalance and noise. Through oversampling by ADASYN algorithm and undersampling by RENN algorithm, the data set is balanced and the model's recognition and classification capabilities for a smaller number of categories are enhanced. In addition, the LOF algorithm can effectively identify and eliminate noise, further improving the accuracy and generalization ability of the model. However, these technologies also have a certain impact on the training efficiency and computing requirements of the model. The resampling and denoising process requires additional computing resources, including storage space and computing time. In the future, by optimizing the algorithm and parameter settings, the present invention can minimize these additional overheads while improving performance.

[0187] Finally, in IIoT intrusion detection, the BiGRU network with attention mechanism is combined with the Inception-CNN network. The BiGRU network can effectively capture the long-term dependencies in time series data, so it is suitable for processing time series information in IIoT data. By introducing the attention mechanism, the BiGRU network pays more attention to important features, so that it can effectively capture the complex time dependencies in the data and improve the model's detection accuracy of intrusion behaviors. The Inception-CNN network can extract features of different scales in parallel, which enhances the model's ability to understand features at different levels. Therefore, the NIDS-BAI model gives full play to the capabilities of the BiGRU network with attention mechanism and the Inception-CNN network, and jointly improves the model's ability to identify attacks in network traffic.

[0188] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network intrusion detection method based on BiGRU and Inception-CNN, characterized in that: include: Step 1: Obtain network traffic data samples; Step 2: performing mixed sampling and denoising on the network traffic data samples to obtain a balanced data set; Step 3: performing a dimensionality reduction operation on the balanced data set to obtain a dimensionality reduced data set; Step 4: constructing a network intrusion detection model using the dimension reduction data set to obtain a constructed network intrusion detection model; The network intrusion detection model includes: a BiGRU network with an attention mechanism and an Inception-CNN network; Step 5: Input the network intrusion detection data to be detected into the constructed network intrusion detection model, and detect the network attack behavior through the model.

2. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 1, characterized in that: The second step comprises: Step 201: Divide the network traffic data samples into an original majority class sample set R and an original minority class sample set A; Step 202: using the ADASYN algorithm to oversample the original minority class sample set A to generate a new minority class sample set A; using the RENN algorithm to undersample the original majority class sample set R to generate a new majority class sample set R; Step 203: using the LOF algorithm to remove the noise of the new majority class sample set R and the new minority class sample set A, to obtain the denoised majority class sample set R and the minority class sample set A; Step 204: Merge the denoised majority class sample set R and the minority class sample set A to obtain the balanced data set.

3. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 1, characterized in that: The step 201 includes: The network traffic data samples are classified according to attack categories, and then according to the classification results, the categories whose proportion after classification exceeds a preset proportion are classified as the majority class sample set R, and the remaining categories are classified as the minority class sample set A.

4. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 1, characterized in that: The step 202 includes: (1) calculating the imbalance degree d of the network traffic data sample; (2) Unbalanced degree d <d th , where d th is the predefined maximum allowable imbalance, then calculate the number of samples G that need to be generated for the minority class; (3) For each sample in the original majority class sample set R, determine its k i nearest neighbors and calculate the ratio r i , where D i represents the number of samples belonging to the majority class among the k nearest neighbors, |X| represents the total number of samples; for r i Normalized to Finally, calculate the number of samples that need to be synthesized for each minority class sample; (4) Generate g for each sample in the original majority class sample set R i samples to form a new minority class sample set newA; (5) Select k2 nearest neighbors from newR for each sample in the original minority class sample set A; (6) Identify the number of minority samples in the k2 nearest neighbors of each majority sample. If the number exceeds e, where e = 1, exclude the sample; (7) Repeat steps (5) and (6) until a stable majority class sample set newR is generated.

5. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 1, characterized in that: The network traffic data samples come from Edge-IIoTset, CIC-IDS2017 and CICIoT 2023 datasets.

6. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 1, characterized in that: The step three comprises: Step 301: using the random forest algorithm to evaluate the importance of sample features of the balanced data set, and then analyzing the correlation between features in combination with the Pearson correlation coefficient, and finally obtaining the dimension-reduced data set.

7. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 6, characterized in that: The step 301 includes: (1) According to the balanced data set, select corresponding out-of-bag data; (2) Calculate the error of this part of the out-of-bag data and mark it as error a ; (3) determining a complete out-of-bag data sample based on the balanced data set, and randomly introducing a disturbance to the complete out-of-bag data sample; (5) Calculate the out-of-bag data error after the disturbance is introduced and mark it as error b ; (6) If the random forest contains M trees, the feature importance score is calculated using the following formula: (7) For two variables X and Y, calculate the covariance Civ(X, Y) and standard deviation S between X and Y X and S Y ; (8) Then, the Pearson correlation coefficient r is calculated using the following formula X ,Y: (9) According to the importance score I and correlation coefficient r of the feature X ,Y, finally determine the reduced dimension data set.

8. The network intrusion detection method based on BiGRU and Inception-CNN according to claim 1, characterized in that: The use of the reduced dimension data set to construct a network intrusion detection model comprises: Initialization: The weights of the BiGRU layer are randomly initialized, and the query vector in the attention mechanism is assigned a random weight; Forward propagation: A forward GRU layer with 128 units is defined and the input data X is passed to this layer to obtain the forward information representation The input data X is a certain data in the dimension reduction data set; Backward propagation: A reverse GRU layer with 128 units is defined and the input data X is passed to this layer to obtain the reverse information representation Merge output: Merge bidirectional information by adding the outputs of the forward and backward GRU layers to form the final output representation h t ; Attention mechanism: Use the attention mechanism to calculate the attention weight of each time step of the input data to strengthen the model's attention to key information; Inception module: The Inception module contains four branches. The first branch only performs a 1×1 convolution operation, and the following three branches perform convolution and pooling operations to extract features at different levels. Final layer: The output of the model is converted into a class probability distribution by applying a softmax layer.

Images