Ocean network intrusion detection method and system based on feature dimensionality reduction and graph convolution

Abstract

The invention provides an ocean network intrusion detection method and system based on feature dimensionality reduction and graph convolution. The method comprises the following steps: analyzing an ocean meteorological sensor network framework and features; preprocessing the network traffic data set to obtain a preprocessed network traffic data set; constructing a GARF algorithm to carry out feature dimension reduction on the network flow data set, searching an optimal feature subset, and reducing the feature dimension of the original network intrusion detection data set; constructing an ANN algorithm to obtain an optimal approximate nearest neighbor node set of the optimal feature subset, and converting network flow data into graph structure type data; and finally, constructing a graph convolutional network to carry out network traffic classification prediction on the graph structure type data to obtain a classification result. And training a pre-established ocean network intrusion detection model by using a loss function as an evaluation standard and using an optimization algorithm as an optimizer in combination with a classification result, so as to obtain a trained ocean network intrusion detection model and realize an ocean network intrusion detection function.

Description

Technical Field

[0001] The present invention relates to the field of network technology, and in particular to a marine network intrusion detection method and system based on feature dimension reduction and graph convolution. Background Art

[0002] As a rapidly developing emerging technology, the Internet of Things plays an important role in promoting the informatization and intelligence of the marine Internet of Things. As an important part of the marine Internet of Things, the marine meteorological sensor network provides valuable meteorological and oceanographic data for marine aquaculture, marine navigation, and marine energy exploitation. The marine meteorological sensor network is vulnerable to attacks from illegal access to the network, which poses a serious threat to the network security of the marine Internet of Things. This requires timely detection and analysis of marine network behavior and network traffic. By establishing a marine meteorological sensor network intrusion detection system, the offensive network abnormal traffic in the marine meteorological sensor network can be identified, and the reliability and security of the marine meteorological sensor network can be improved.

[0003] In recent years, traditional machine learning methods have been widely used in the field of network intrusion detection. However, traditional shallow machine learning cannot automatically learn features and requires artificial feature extraction. In addition, when faced with high-dimensional large-scale network data traffic, its detection performance is poor and cannot meet the needs of new network environments. Deep learning can learn features autonomously and performs better in intrusion detection performance. In addition, due to the imbalance of traffic data distribution in real network environments, normal traffic behavior is much higher than abnormal traffic behavior, and the model trained based on data sets with imbalanced data classes has poor detection performance for abnormal samples. To address the problem of data class imbalance, traditional methods use undersampling, oversampling, and mixed sampling techniques to solve the class imbalance problem, but these methods have the risk of overfitting and losing useful information.

[0004] Common network intrusion detection methods include machine learning methods and deep learning methods. Common machine learning-based intrusion detection methods include: support vector machine, logistic regression, random forest, extreme gradient boosting, etc. Machine learning-based intrusion detection methods have the advantage of fast computing speed, but also have the problem of poor intrusion detection performance. Deep learning-based intrusion detection methods have better intrusion detection performance than machine learning-based intrusion detection methods. Common deep learning-based intrusion detection methods include: long short-term memory neural network, convolutional neural network, etc. Subsequent researchers have made a series of improvements based on basic networks such as CNN and LSTM to improve intrusion detection performance, but deep learning-based intrusion detection methods have the disadvantages of difficult model training and occupying more computing resources.

[0005] At present, some methods still find it difficult to balance intrusion detection performance and intrusion detection efficiency. There are problems such as poor intrusion detection performance, complex models, and high detection time cost. In addition, the generalization ability of the model is insufficient and cannot effectively detect unknown network attacks. Summary of the invention

[0006] Purpose of the invention: The technical problem to be solved by the present invention is to provide a marine network intrusion detection method and system based on feature dimensionality reduction and graph convolution in view of the shortcomings of the prior art.

[0007] The method comprises the following steps:

[0008] Step 1, constructing a marine network intrusion detection model;

[0009] Step 2, receiving an ocean network traffic data set, and preprocessing the ocean network traffic data set, wherein the ocean network traffic data set includes an ocean network traffic sample, and the ocean network traffic sample includes a normal traffic sample and an attack sample;

[0010] Step 3, input the preprocessed ocean network traffic data set into the pre-established genetic random forest GARF feature dimensionality reduction algorithm, perform feature dimensionality reduction on the ocean network traffic data set, obtain the best feature subset, reduce the feature dimension of the original ocean network traffic data set, and improve the running speed of the model;

[0011] Step 4: Input the best feature subset into the pre-established approximate nearest neighbor algorithm ANN to obtain the optimal approximate nearest neighbor node set of the best feature subset, and convert the network traffic data into a graph structured data set;

[0012] Step 5: Input the graph structure data set into the pre-established graph convolutional neural network GCN to obtain traffic features, and input the traffic features into the preset classification network to obtain classification results;

[0013] Step 6, combined with the classification results, the loss function binary crossentropy is used as the evaluation criterion, and the optimization algorithm Adam is used as the optimizer to train the pre-established marine network intrusion detection model to obtain the trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

[0014] Step 1 includes:

[0015] Marine Meteorological Sensor Networks (MMSN) are mainly composed of marine servers (coastal servers, marine base station servers, etc.), marine mobile terminal nodes (meteorological buoys, meteorological drones, etc.), marine switches (ship meteorological stations, meteorological detection ships, etc.) and satellites.

[0016] Each marine mobile terminal node can transmit and forward network traffic, and the mobile terminal node has limited computing resources, making it impossible to implement large-scale network protection mechanisms. The marine base station server has sufficient computing power to deploy network security mechanisms. The marine switch close to the marine mobile terminal node can capture the network traffic of the marine mobile terminal node of the marine base station server.

[0017] Marine mobile terminal nodes have the characteristics of diverse node types, complex structural levels, large data transmission volume, and harsh deployment environment. In MMSN, the marine switch is the main forwarding device, which can forward or discard traffic based on the flow table.

[0018] In addition, the marine base station server and marine switch have strong computing power and computing resources, and both can be deployed with advanced defense. Assume that criminals invade the network nodes of the marine network intrusion detection model from the external network by launching malicious network traffic, and further endanger and control the vulnerable MMSN network nodes, making the MMSN network nodes untrustworthy. The network nodes of the marine MMSN infected by malicious network traffic will lose their original functions and become new malicious MMSN network nodes, and then launch a large amount of malicious traffic to attack other normal MMSN network nodes, which may eventually paralyze the entire MMSN, which will cause very serious harm. In order to prevent the MMSN from being paralyzed and ensure that the MMSN can work normally, it is very necessary to conduct timely network intrusion detection for the MMSN.

[0019] Taking into account the characteristics of MMSN and the needs of network intrusion detection, the marine network intrusion detection model includes a data acquisition module, a network intrusion detection module and a response feedback module;

[0020] The data acquisition module is used to collect the network traffic data stream of the MMSN, extract the data features of the network traffic from it, and pass it to the network intrusion detection module;

[0021] The network intrusion detection module is used to pre-process the network traffic data, use the neural network model (convolutional neural network CNN, long short-term memory neural network LSTM, etc.) to classify and detect the network traffic data features, identify abnormal network traffic data and network traffic attacks, and pass the network intrusion detection results to the response feedback module;

[0022] The response feedback module is used to interrupt the attacked node business, reject the network traffic data from the malicious node, and feed back the network attack situation to humans for further processing.

[0023] In step 2, the network traffic data set is preprocessed, including:

[0024] The feature types contained in the network traffic data set are numerical features and symbolic features. The network traffic data set is digitized and missing value processing is performed. The digitization is to convert the symbolic features into numerical feature representations using one-hot encoding; the missing value processing is to fill the missing values ​​with 0;

[0025] Min-Max Scaling is performed on the network traffic data set after missing value processing to normalize the values ​​to between 0 and 1.

[0026] In step 2, the values ​​are normalized to between 0 and 1 using the following formula:

[0027]

[0028] Where x is the data corresponding to one of the numerical features in the network traffic dataset, x max is the maximum value in the data corresponding to the numerical feature, x min is the minimum value in the data corresponding to the numerical feature, x * Indicates the normalized numerical feature corresponding data.

[0029] In step 3, the genetic random forest GARF feature dimensionality reduction algorithm includes a GA algorithm and a RF algorithm;

[0030] The GA algorithm generates a reduced feature vector by the following steps:

[0031] Step 3-1, create an initial population;

[0032] Step 3-2, find the fitness score of each chromosome in the population. The fitness score calculation formula is:

[0033]

[0034] Where X is a binary vector representing the current feature subset, fitness(X) is the fitness function, Accuracy(X) is the classifier accuracy, α is a predefined weight adjusted according to user requirements to indicate the importance of RF accuracy relative to the length of the subset; Accuracy(X) is the accuracy of the RF based on the feature subset X, which is used to calculate the accuracy of the classifier, x i indicates whether the bit of the i-th feature is used; therefore, The number of features in a given subset is given;

[0035] Step 3-3, select the best chromosome from the population;

[0036] Step 3-4, apply the crossover operation between the two selected parents;

[0037] Step 3-5, perform mutation operation on the mutations in the population;

[0038] Step 3-6, check the termination condition; generally, reaching the predetermined maximum number of iterations is selected as the termination condition.

[0039] The RF algorithm is an integrated algorithm composed of decision trees (DT). The RF algorithm includes more than two decision trees DT. There is no correlation between different decision trees DT. When performing a classification task, a new input sample enters, and each decision tree DT in the forest is asked to make judgments and classifications respectively. Each decision tree DT will obtain a classification result, and the classification result with the most categories among all classification results will be taken as the final result.

[0040] In step 4, the approximate nearest neighbor algorithm ANN (Approximate Nearest Neighbor, ANN) includes: treating each data of the network traffic data set as a node, and calculating the Euclidean distance between the nodes, the formula is:

[0041]

[0042] Where d(dx,dy) represents the Euclidean distance between two nodes dx and dy, dn is the number of features, dx i anddy i They represent the value of the i-th feature in node dx and the value of the i-th feature in node dy respectively;

[0043] By looping through the nodes in the training data set and the test data set in the network traffic (NSL-KDD data set is a classic public data set, the training set and test set are provided on the NSL-KDD official website, and the downloaded data is a training set .csv and a test set .csv), the index of the similar neighboring nodes of node i is obtained, the node feature matrix is ​​obtained, the edge information is added to the edge list, the edge connection data is obtained, and finally the edge connection data is converted into an adjacency matrix, that is, the network traffic data is converted into graph structure data, so that GCN can perform classification and prediction on the graph structure data.

[0044] In step 5, the graph convolutional neural network GCN is based on graph structure data, and the graph structure data includes a feature matrix and an adjacency matrix. The graph convolutional neural network GCN has an efficient operation speed for the graph structure data and can directly calculate the graph structure data;

[0045] The graph convolutional neural network GCN takes the feature matrix M and the adjacency matrix A as initial input and extracts features from the graph structure data. It is assumed that there are N nodes in the graph, each node has d-dimensional features, and the structure and node features of the graph are represented by A∈R N×N and M∈R N×d Represents, where R represents a real number, R N×N and R N×d Respectively represent real number matrices of N×N dimensions and real number matrices of N×d dimensions;

[0046] The graph convolutional neural network GCN takes M and A as input and performs a graph convolution operation with local first-order approximation. The graph convolutional neural network GCN includes more than two neural network layers, and the propagation mode between the neural network layers is:

[0047]

[0048] Among them, Z is the node feature representation, σ is the nonlinear activation function, is an approximate graph convolution filter, is a self-loop adjacency matrix, and I is the identity matrix of the self-loop adjacency matrix, is the degree matrix, W is the weight matrix input to the hidden layer;

[0049] The graph convolutional neural network GCN learns the hidden representation of nodes by encoding graph structure and node features, and finally completes the task of classifying network traffic and achieves the goal of network intrusion detection.

[0050] In step 5, the converted graph structure data is input into GCN to obtain the output of the graph convolutional neural network GCN. Finally, the sigmoid function is used as the activation function for binary classification output, and the classification results corresponding to each ocean network traffic sample are output.

[0051] The present invention also provides a marine network intrusion detection model based on feature dimension reduction and graph convolution, including:

[0052] Data preprocessing module: used for receiving a network traffic data set and preprocessing the network traffic data set, wherein the preprocessed network traffic data set includes network traffic samples, and the network traffic samples include normal traffic samples and attack samples;

[0053] Feature dimension reduction module: used to input the preprocessed network traffic data set into the pre-established genetic random forest GARF feature dimension reduction algorithm, perform feature dimension reduction on the network traffic data set, obtain the best feature subset, reduce the feature dimension of the original network intrusion detection data set, improve the intrusion detection performance and running speed of the model, and use the obtained best feature subset as the final training data set;

[0054] Data conversion module: used to input the best feature subset into the pre-established approximate nearest neighbor algorithm ANN, obtain the optimal approximate nearest neighbor node set of the best feature subset, and convert the network traffic data into a graph structured data set;

[0055] Classification module: used to input the final graph structured data set into the pre-established graph convolutional neural network GCN to obtain traffic features, and then input the traffic features into the preset classification network to obtain classification results.

[0056] Model training module: used to combine the classification results, use the loss function Binary crossentropy as the evaluation criterion, and use the optimization algorithm Adam as the optimizer to train the pre-established marine network intrusion detection model to obtain the trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

[0057] The present invention also provides a device, comprising:

[0058] one or more processors;

[0059] A memory for storing one or more programs;

[0060] When one or more of the programs are executed by one or more of the processors, the one or more processors implement the described methods.

[0061] The beneficial effects of the present invention include: the present invention uses the feature dimension reduction module GARF to select the best feature subset, uses the ANN module to convert the marine network flow data into graph structure data, and uses the GCN module to classify and predict the graph structure data. The network intrusion detection performance and intrusion detection efficiency are improved, and it has important theoretical significance and application value in the field of marine meteorological sensor networks. BRIEF DESCRIPTION OF THE DRAWINGS

[0062] Figure 1 It is a schematic flow chart of the method of the present invention.

[0063] Figure 2 It is a schematic diagram of the marine meteorological sensor network of the present invention.

[0064] Figure 3 It is a schematic diagram of intrusion detection of marine meteorological sensor network according to the present invention.

[0065] Figure 4 It is a schematic diagram of the structure of the marine network intrusion detection model of the present invention.

[0066] Figure 5 Schematic diagram of the GCN neural network structure of the present invention.

[0067] Figure 6 This is a diagram illustrating the impact of GARF on intrusion detection performance in the present invention.

[0068] Figure 7 It is a schematic diagram of the training process of the GARF-AGCN model of the present invention.

[0069] Figure 8 This is a comparison chart of the intrusion detection performance of the present invention and other models.

[0070] Fig. 9 This is a comparison chart of the intrusion detection efficiency of the present invention and other models.

[0071] Fig.10 It is a schematic diagram of the system structure of the present invention. DETAILED DESCRIPTION

[0072] The present invention will be further described in detail below in conjunction with the accompanying drawings and specific embodiments, and the above and / or other advantages of the present invention will become more clear.

[0073] like Figure 1 As shown, this embodiment provides a marine network intrusion detection method based on feature dimension reduction and graph convolution, including the following steps:

[0074] Constructing a marine network intrusion detection model, wherein the marine network intrusion detection model includes a data acquisition module, a network intrusion detection module, and a response feedback module;

[0075] Receiving a network traffic data set, preprocessing the network traffic data set to obtain a preprocessed network traffic data set, wherein the preprocessed network traffic data set contains network traffic samples, and the network traffic samples include normal traffic samples and attack samples;

[0076] Comprehensive consideration of MMSN (such as Figure 2 Based on the characteristics of network intrusion detection and the requirements of network intrusion detection, the MMSN intrusion detection system is designed as follows: Figure 3As shown in the figure, the framework consists of a data acquisition module, a network intrusion detection module, and a response feedback module. The data acquisition module is mainly responsible for collecting the network traffic data stream of MMSN, extracting the data features of the network traffic from it, and passing it to the network intrusion detection module. The network intrusion detection module is mainly responsible for preprocessing the network traffic data, using an efficient classifier to classify and detect the incoming network traffic data features, identifying abnormal network traffic data and network traffic attacks, and passing the network intrusion detection results to the response feedback module. The response feedback module is mainly responsible for interrupting the attacked node service, rejecting the network traffic data from malicious nodes, and feeding back the network attack situation to humans for further processing.

[0077] The data preprocessing method specifically includes: standardizing the network traffic data set, that is, using one-hot encoding to convert symbolic features into numerical feature representations; performing Min-Max Scaling on the data set after standardization and outlier processing to normalize the values ​​to between 0 and 1. Taking the network traffic samples in the network traffic data set as input and the network traffic samples in the preprocessed network traffic data set as output, a network traffic data preprocessing module is constructed;

[0078] The network traffic dataset used in the embodiment of the present invention is the NSL-KDD dataset, wherein the characteristics of the NSL-KDD dataset are as follows:

[0079] The NSL-KDD dataset contains a training dataset and a test dataset. Both the training dataset and the test dataset contain multiple class labels. In this method, only a binary classification task is required, that is, to determine whether the network traffic sample is normal traffic or abnormal traffic. Abnormal traffic means that it is under attack, and the dataset labels are replaced. NSL-KDD records 148,517 network traffic samples, each of which consists of 41 features. There are 40 types of attacks in total, which can be divided into five categories: Normal, DoS, Probe, U2R, R2L, and contains two subsets KDDTrain+ and KDDTest+. The sample category distribution in these two datasets is shown in Table 1. KDDTrain+ is a training set consisting of 125,973 samples, which records 22 types of attacks; KDDTest+ is a test set consisting of 22,544 samples, which has 17 more types of attacks than KDDTrain+.

[0080] The network traffic dataset contains numerical features and symbolic features. The network traffic dataset is standardized and the symbolic features are converted into numerical feature representations based on the one-hot encoding method.

[0081] The NSL-KDD dataset includes 38 numerical features and 3 symbolic features. The 3 symbolic features are protocol_type feature, service feature, and flag feature. Based on one-hot encoding, the 3 symbolic features such as protocol_type are converted into 3 corresponding numerical features, and the original 41-dimensional network traffic dataset is converted into a 122-dimensional network traffic dataset.

[0082] Based on the Min-Max Scaling method, the standardized network traffic data set is normalized according to the formula:

[0083]

[0084] In the formula, x is the data corresponding to one of the numerical features in the network traffic dataset, x max is the maximum value of the data corresponding to the numerical feature, x min is the minimum value in the data corresponding to the numerical feature, x * Represents the data corresponding to the normalized numerical features.

[0085] First, the training set is subjected to feature dimensionality reduction using the GARF algorithm. GARF consists of the GA and RF algorithms. The GA algorithm applies six steps to produce a reduced feature vector, namely: 1) initial population creation, 2) finding the fitness score of each chromosome in the population, 3) selecting the best chromosome from the population, 4) applying a crossover operation between the two selected parents, 5) performing a mutation operation on the variants in the population, and 6) checking the termination condition.

[0086] Fitness Function: Fitness score calculation plays a vital role in evaluating the potential of GA algorithm. The fitness function is based on the classification accuracy of RF and the number of selected features. The chromosome with the highest accuracy and minimum number of features yields the highest fitness value. The fitness score of each chromosome in the population is calculated using the formula given in equation (3).

[0087]

[0088] Where X is a binary vector representing the current feature subset, fitness(X) is the fitness function, Accuracy(X) is the classifier accuracy, α is a predefined weight adjusted according to user requirements to indicate the importance of RF accuracy relative to the length of the subset; Accuracy(X) is the accuracy of the RF based on the feature subset X, which is used to calculate the accuracy of the classifier, x i Indicates whether the i-th feature is used. Therefore, The number of features in a given subset is given;

[0089] RF is an integrated algorithm composed of decision trees (DT). The structure of RF is as follows: Figure 4 As shown in the figure, RF is composed of many DTs. There is no correlation between different DTs. When performing classification tasks, new input samples enter, and each DT in the forest is asked to make judgments and classifications separately. Each DT will get its own classification result. The RF will take the result with the most classifications as the final result.

[0090] After 50 iterations, feature subsets of different feature dimensions are obtained. The accuracy experimental results of the classifier under different feature dimension feature subsets of the validation set are as follows: Figure 6 As shown in the figure, when the feature dimension is 122 full features, the accuracy of the classifier is about 80%. As the feature dimension decreases, the accuracy of the classifier gradually increases. When the feature dimension is reduced to 16 features, the classifier reaches the highest accuracy of 90%. If the feature dimension is further reduced, the accuracy of the classifier will drop sharply. Therefore, a feature subset with a feature dimension of 16 is selected as the best feature subset of the original data set to achieve feature dimensionality reduction, reduce model training time, and improve model performance.

[0091] In this embodiment, the ANN algorithm is used to convert the data into graph structure data. The ANN is mainly composed of an Approximate Nearest Neighbor (ANN) algorithm. Each piece of data in the network traffic data set is regarded as a node, and the Euclidean distance between the nodes is calculated. The Euclidean distance calculation process is:

[0092]

[0093] Among them, dx and dy are the feature vectors of the two nodes, dn is the number of features, dx i anddy i Represent the value of the i-th feature in node dx and node dy respectively. By looping through the nodes in the training data set and the test data set in the network traffic, the index of the similar neighboring nodes of node i is obtained, the node feature matrix is ​​obtained, the edge information is added to the edge list, the edge connection data is obtained, and finally it is converted into an adjacency matrix, that is, the network traffic data is converted into graph structure data, so that the GCN classifier can perform classification prediction on the graph structure data.

[0094] The key parameter of the ANN algorithm is the K value. Different K values ​​control the number of nearest neighbor nodes of each node. The model classification performance under different K values ​​is that when K = 2, the ANN algorithm finds the two nearest neighbor nodes for each node as its neighbor nodes, the accuracy of the classifier is 90.31%, and the model training time is also the shortest. As the K value increases, the number of each node and other neighbor nodes will increase, the classification performance of the classifier will gradually increase, and the training time will also increase; when K = 7, the classifier reaches the highest accuracy of 91.40%; continue to increase the K value, the classification performance will gradually decrease. Therefore, K = 7 is selected as the optimal K value of the ANN algorithm to obtain the graph structure data of the best approximate neighbor nodes.

[0095] In this embodiment, GCN is based on graph structure data, which consists of two parts: feature matrix and adjacency matrix. Therefore, it is necessary to convert the data set into graph structure data through ANN. GCN has a high computing speed for graph structure data and can directly calculate graph structure data. The GCN neural network model uses the feature matrix M and the adjacency matrix A as initial input and extracts features from the graph structure data. Figure 5 As shown, there are N nodes in the graph, each node has d-dimensional features, and the structure and node features of the graph are represented by A∈R N×N and M∈R N×d Represents, where R represents a real number, R N×N and R N ×d Represents real number matrices of N×NN×N and N×dN×d dimensions respectively. The GCN unit takes X and A as input and performs graph convolution operations with local first-order approximation. GCN consists of multiple neural network layers, and the propagation method between its layers is:

[0096]

[0097] Among them, Z is the node feature representation, σ is the nonlinear activation function, is an approximate graph convolution filter, is a self-loop adjacency matrix, and I is the identity matrix of the self-loop adjacency matrix, is the degree matrix, and W is the weight matrix input to the hidden layer. GCN can learn the hidden representation of nodes by encoding graph structure and node features, and finally complete the task of classifying network traffic and achieve the goal of network intrusion detection.

[0098] The graph structure data of the network traffic samples in the training data set is input into GCN to obtain the output of GCN. Finally, the sigmoid function is used as the activation function for binary classification output, and the classification results corresponding to each network traffic sample are output. The accuracy of the GCN model in the training set and the test set changes with the number of training rounds as shown in the figure below. Figure 7 The red line and the blue line are the training set accuracy Train Accuracy and the test set accuracy Test Accuracy, respectively. It can be seen from the figure that the classification accuracy of the GCN model increases first, then decreases, and then continues to increase with the increase in the number of rounds, and finally stabilizes after 100 rounds. The curve trends of the two are consistent, indicating that the GARF-AGCN model has good learning ability. Finally, the classification accuracy of the training set is stable at about 94%, and the classification accuracy of the test set is stable at about 91%, indicating that the GARF-AGCN model is easy to train and has good learning ability, and can identify abnormal traffic in network traffic.

[0099] The network intrusion detection model is adopted to realize fast, efficient and accurate marine network intrusion detection.

[0100] In one embodiment, the initial population size of GARF is set to 50, the number of iterations is set to 50, the crossover rate is set to 0.8, the mutation rate is set to 0.1, the random seed size of RF is set to 42, the K value of ANN is set to 7, the number of training rounds of GCN is set to 300, the optimizer is set to Adam, the learning rate is set to 0.01, the hidden layer size is set to 16, the neuron drop rate is set to 0.5, and the activation function of the output layer is set to sigmoid. In addition, the most important goal in the intrusion detection of the marine meteorological sensor network is to distinguish between normal traffic and malicious traffic in the marine meteorological sensor network. Therefore, this paper uses binary classification labels as the labels of the model for training and testing.

[0101] On the other hand, in order to achieve the above-mentioned object, the present invention discloses a marine network intrusion detection model based on feature dimension reduction and graph convolution, such as Fig.10 As shown, including:

[0102] Data preprocessing module: used for receiving a network flow data set, preprocessing the network flow data set, and obtaining a preprocessed network flow data set, wherein the preprocessed network flow data set contains network flow samples, and the network flow samples include normal flow samples and attack samples;

[0103] Feature dimension reduction module: used to input the pre-processed network traffic data set into the pre-established GARF, perform feature dimension reduction on the network traffic data set, obtain the best feature subset, reduce the feature dimension of the original network intrusion detection data set, improve the intrusion detection performance and running speed of the model, and use the obtained best feature subset as the final training data set;

[0104] Data conversion module: used to input the best feature subset into the pre-established ANN, obtain the optimal approximate nearest neighbor node set of the best feature subset, and convert the network traffic data into a graph structured data set;

[0105] Model classification module: used to input the final graph structured data set into the pre-established GCN neural network model to obtain traffic features, and then input the traffic features into the preset classification network to obtain classification results.

[0106] Model training module: used to combine the classification results, use the loss function Binary crossentropy as the evaluation criterion, and use the optimization algorithm Adam as the optimizer to train the pre-established marine network intrusion detection model to obtain the trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

[0107] In addition, in order to verify the reliability of the model, it is compared with other intrusion detection models. Figure 8 The comparison results of intrusion detection experiments of different models are shown. As can be seen from the figure, the intrusion detection accuracy of the LR model, SVM model, XGB model, and RF model based on machine learning is only about 80%. Among them, the best performing machine learning model is the RF model, whose intrusion detection accuracy and F1 score are 81.61% and 81.57% respectively; the LSTM model and CNN model are deep learning models, and the intrusion detection performance of the CNN model is better than that of the LSTM model, and its intrusion detection accuracy and F1 score are 82.24% and 81.24% respectively. The GARF-AGCN model selects the best feature subset through GARF, ANN converts network traffic data into a graph data structure, and GCN classifies the graph data structure, so that the intrusion detection accuracy and F1 score of the GARF-AGCN model reach 91.41% and 91.34% respectively, indicating that the GARF-AGCN model has better intrusion detection performance.

[0108] The duration of the intrusion detection model training in a stable state is also an important indicator of marine network intrusion detection. It not only directly affects the intrusion response time, but also reflects the intrusion detection efficiency of the network intrusion detection, which is very important for marine meteorological sensor networks with limited computing power. The NSL-KDD test set is used to test the computational efficiency of machine learning models such as LR, SVM, XGB, RF, and deep learning models such as CNN, LSTM, and GARF-AGCN. The number of training rounds for the three deep learning models is set to 300. The experimental comparison results are shown in Figure 2. Fig. 9 As shown in the figure, it can be seen that the LR model in the machine learning model has the shortest training time, which is 9.24s, and the CNN model in the deep learning model has the longest detection time, which is 361.42s. Although the machine learning model LR has the shortest training time, its intrusion detection performance is poor, and the intrusion accuracy and F1 score are both less than 80%, so it will not be able to protect the marine meteorological sensor network. The deep learning model CNN with relatively good intrusion detection performance takes 361.42s to train 300 rounds, which has the disadvantage of too long model training time, so it is not suitable for marine meteorological sensor networks. The training time of the GARF-AGCN model proposed in this paper is 14.46s, which is only 5.43s longer than the training time of the machine learning model LR with the best computational efficiency. In addition, the intrusion detection performance of the GARF-AGCN model is better than the above models. Therefore, the GARF-AGCN model can be applied to the intrusion detection task of the marine meteorological sensor network.

[0109] Based on the same inventive concept, the present invention also provides a computer device, which includes: one or more processors, and a memory for storing one or more computer programs; the program includes program instructions, and the processor is used to execute the program instructions stored in the memory. The processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is used to implement one or more instructions, specifically for loading and executing one or more instructions in a computer storage medium to implement the above method.

[0110] It needs to be further explained that, based on the same inventive concept, the present invention also provides a computer storage medium, on which a computer program is stored, and the computer program is executed by a processor to execute the above method. The storage medium can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0111] The present invention provides a method and system for detecting intrusion in marine networks based on feature dimension reduction and graph convolution. There are many methods and ways to implement the technical solution. The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be regarded as the protection scope of the present invention. All components not specified in this embodiment can be implemented by existing technologies.

Claims

1. A marine network intrusion detection method based on feature dimension reduction and graph convolution, characterized in that: The following steps are involved: Step 1, constructing a marine network intrusion detection model; Step 2, receiving an ocean network traffic data set, and preprocessing the ocean network traffic data set, wherein the ocean network traffic data set includes an ocean network traffic sample, and the ocean network traffic sample includes a normal traffic sample and an attack sample; Step 3, input the preprocessed ocean network flow data set into the pre-established genetic random forest GARF feature dimensionality reduction algorithm, perform feature dimensionality reduction on the ocean network flow data set, and obtain the best feature subset; Step 4: Input the best feature subset into the pre-established approximate nearest neighbor algorithm ANN to obtain the optimal approximate nearest neighbor node set of the best feature subset, and convert the network traffic data into a graph structured data set; Step 5: Input the graph structure data set into the pre-established graph convolutional neural network GCN to obtain traffic features, and input the traffic features into the preset classification network to obtain classification results; Step 6, combined with the classification results, the loss function binary crossentropy is used as the evaluation criterion, and the optimization algorithm Adam is used as the optimizer to train the pre-established marine network intrusion detection model to obtain the trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

2. The method according to claim 1, characterized in that Step 1 includes: the marine network intrusion detection model includes a data acquisition module, a network intrusion detection module and a response feedback module; The data acquisition module is used to collect the network traffic data stream of the MMSN, extract the data features of the network traffic from it, and pass it to the network intrusion detection module; The network intrusion detection module is used to pre-process the network traffic data, classify and detect the network traffic data features using a neural network model, identify abnormal network traffic data and network traffic attacks, and pass the network intrusion detection results to the response feedback module; The response feedback module is used to interrupt the attacked node business, reject the network traffic data from the malicious node, and feed back the network attack situation to humans for further processing.

3. The method according to claim 2, characterized in that In step 2, the network traffic data set is preprocessed, including: The feature types contained in the network traffic data set are numerical features and symbolic features. The network traffic data set is digitized and missing value processing is performed. The digitization is to convert the symbolic features into numerical feature representations using one-hot encoding; the missing value processing is to fill the missing values ​​with 0; Min-Max Scaling is performed on the network traffic data set after missing value processing to normalize the values ​​to between 0 and 1.

4. The method according to claim 3, characterized in that In step 2, the values ​​are normalized to between 0 and 1 using the following formula: Where x is the data corresponding to one of the numerical features in the network traffic dataset, x max is the maximum value in the data corresponding to the numerical feature, x min is the minimum value in the data corresponding to the numerical feature, x * Indicates the normalized numerical feature corresponding data.

5. The method according to claim 4, characterized in that In step 3, the genetic random forest GARF feature dimensionality reduction algorithm includes a GA algorithm and a RF algorithm; The GA algorithm generates a reduced feature vector by the following steps: Step 3-1, create an initial population; Step 3-2, find the fitness score of each chromosome in the population. The fitness score calculation formula is: Where X is a binary vector representing the current feature subset, fitness(X) is the fitness function, Accuracy(X) is the classifier accuracy, α is a predefined weight adjusted according to user requirements to indicate the importance of RF accuracy relative to the length of the subset; Accuracy(X) is the accuracy of the RF based on the feature subset X, which is used to calculate the accuracy of the classifier, x i indicates whether the bit of the i-th feature is used; therefore, The number of features in a given subset is given; Step 3-3, select the best chromosome from the population; Step 3-4, apply the crossover operation between the two selected parents; Step 3-5, perform mutation operation on the mutations in the population; Step 3-6, check the termination condition; The RF algorithm is an integrated algorithm composed of decision trees DT. The RF algorithm includes more than two decision trees DT. There is no correlation between different decision trees DT. When performing a classification task, a new input sample enters, and each decision tree DT in the forest is asked to make judgments and classifications respectively. Each decision tree DT will obtain a classification result, and the classification result with the most categories among all classification results will be taken as the final result.

6. The method according to claim 5, characterized in that In step 4, the approximate nearest neighbor algorithm ANN includes: treating each piece of data in the network traffic data set as a node, and calculating the Euclidean distance between the nodes, the formula is: Where d(dx,dy) represents the Euclidean distance between two nodes dx and dy, dn is the number of features, dx i anddy i They represent the value of the i-th feature in node dx and the value of the i-th feature in node dy respectively; By looping through the nodes in the training data set and the test data set in the network traffic, the indexes of similar neighboring nodes of node i are obtained, the node feature matrix is ​​obtained, the edge information is added to the edge list, the edge connection data is obtained, and finally the edge connection data is converted into an adjacency matrix, that is, the network traffic data is converted into graph structure data.

7. The method according to claim 6, characterized in that In step 5, the graph convolutional neural network GCN is based on graph structure data, and the graph structure data includes a feature matrix and an adjacency matrix; The graph convolutional neural network GCN takes the feature matrix M and the adjacency matrix A as initial input and extracts features from the graph structure data. It is assumed that there are N nodes in the graph, each node has d-dimensional features, and the structure and node features of the graph are represented by A∈R N×N and M∈R N×d Represents, where R represents a real number, R N×N and R N×d Respectively represent real number matrices of N×N dimensions and real number matrices of N×d dimensions; The graph convolutional neural network GCN takes M and A as input and performs a graph convolution operation with local first-order approximation. The graph convolutional neural network GCN includes more than two neural network layers, and the propagation mode between the neural network layers is: Among them, Z is the node feature representation, σ is the nonlinear activation function, is an approximate graph convolution filter, is a self-loop adjacency matrix, and I is the identity matrix of the self-loop adjacency matrix, is the degree matrix, W is the weight matrix input to the hidden layer; The graph convolutional neural network GCN learns the hidden representation of nodes by encoding graph structure and node features, and finally completes the task of classifying network traffic and achieves the goal of network intrusion detection.

8. The method according to claim 7, characterized in that In step 5, the converted graph structure data is input into GCN to obtain the output of the graph convolutional neural network GCN. Finally, the sigmoid function is used as the activation function for binary classification output, and the classification results corresponding to each ocean network traffic sample are output.

9. A marine network intrusion detection model based on feature dimension reduction and graph convolution implemented by the method according to any one of claims 1 to 8, characterized in that: include: Data preprocessing module: used for receiving a network traffic data set and preprocessing the network traffic data set, wherein the preprocessed network traffic data set includes network traffic samples, and the network traffic samples include normal traffic samples and attack samples; Feature dimension reduction module: used to input the preprocessed network traffic data set into the pre-established genetic random forest GARF feature dimension reduction algorithm, perform feature dimension reduction on the network traffic data set, obtain the best feature subset, reduce the feature dimension of the original network intrusion detection data set, improve the intrusion detection performance and running speed of the model, and use the obtained best feature subset as the final training data set; Data conversion module: used to input the best feature subset into the pre-established approximate nearest neighbor algorithm ANN, obtain the optimal approximate nearest neighbor node set of the best feature subset, and convert the network traffic data into a graph structured data set; Classification module: used to input the final graph structure data set into the pre-established graph convolutional neural network GCN to obtain traffic features, and then input the traffic features into the preset classification network to obtain classification results; Model training module: used to combine the classification results, use the loss function Binary crossentropy as the evaluation criterion, and use the optimization algorithm Adam as the optimizer to train the pre-established marine network intrusion detection model to obtain the trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

10. A device, characterized in that: include: one or more processors; A memory for storing one or more programs; When one or more of the programs are executed by one or more of the processors, the one or more processors implement the method according to any one of claims 1 to 8.

Images