Ocean network intrusion detection method and system based on feature dimension reduction and graph convolution

Abstract

The application provides a marine network intrusion detection method and system based on feature dimension reduction and graph convolution, comprising the following steps: analyzing a marine meteorological sensor network framework and characteristics; preprocessing a network traffic dataset to obtain a preprocessed network traffic dataset; constructing a GARF algorithm to perform feature dimension reduction on the network traffic dataset, find an optimal feature subset, and reduce the feature dimension of the original network intrusion detection dataset; constructing an ANN algorithm to obtain an optimal approximate nearest neighbor node set of the optimal feature subset, and convert the network traffic data into graph structure type data; finally, constructing a graph convolution network to perform network traffic classification prediction on the graph structure type data to obtain a classification result; combining the classification result, using a loss function as an evaluation standard, using an optimization algorithm as an optimizer, training a pre-established marine network intrusion detection model, obtaining a trained marine network intrusion detection model, and realizing a marine network intrusion detection function.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, and particularly relates to an ocean network intrusion detection method and system based on feature dimension reduction and graph convolution. BACKGROUND

[0002] As a rapidly developing emerging technology, the Internet of Things plays an important role in promoting the informatization and intelligentization of the ocean Internet of Things. As an important part of the ocean Internet of Things, the ocean meteorological sensor network provides valuable meteorological and ocean data for the ocean aquaculture industry, ocean navigation, and ocean energy exploitation. The ocean meteorological sensor network is vulnerable to attacks by illegal network access, which seriously threatens the network security of the ocean Internet of Things. This requires timely detection and analysis of ocean network behavior and network traffic, and the establishment of an ocean meteorological sensor network intrusion detection system to identify aggressive network abnormal traffic in the ocean meteorological sensor network, thereby improving the reliability and security of the ocean meteorological sensor network.

[0003] In recent years, traditional machine learning methods have been widely used in the field of network intrusion detection. However, traditional shallow machine learning cannot automatically learn features and requires manual feature extraction. Moreover, when facing high-dimensional large-scale network data traffic, its detection performance is not good, and it cannot meet the needs of new network environments. Deep learning, on the other hand, can learn features autonomously and performs better in intrusion detection performance. In addition, due to the imbalance of traffic data distribution in real network environments, normal traffic behavior is much higher than abnormal traffic behavior. Models trained on data sets with class imbalance have poor detection performance for abnormal samples. To address the problem of class imbalance, traditional methods use undersampling, oversampling, and hybrid sampling techniques to solve the class imbalance problem, but these methods have the risk of overfitting and losing useful information.

[0004] Common network intrusion detection methods include machine learning-based methods and deep learning-based methods. Common machine learning-based intrusion detection methods include support vector machines, logistic regression, random forests, and extreme gradient boosting. Machine learning-based intrusion detection methods have the advantage of fast operation speed, but also have the problem of poor intrusion detection performance. Deep learning-based intrusion detection methods have better intrusion detection performance than machine learning-based intrusion detection methods. Common deep learning-based intrusion detection methods include long short-term memory neural networks and convolutional neural networks. Subsequent researchers have made a series of improvements based on CNN and LSTM to improve intrusion detection performance. However, deep learning-based intrusion detection methods have the disadvantages of difficult model training and high computational resource consumption.

[0005] The current method still has problems of poor intrusion detection performance, complex model, high detection time cost and the like, and the generalization ability of the model is not enough, and unknown network attacks cannot be effectively detected. SUMMARY

[0006] The technical problems to be solved by the present application are to provide an ocean network intrusion detection method and system based on feature dimension reduction and graph convolution.

[0007] The method comprises the following steps:

[0008] Step 1, constructing an ocean network intrusion detection model;

[0009] Step 2, receiving an ocean network traffic data set, and preprocessing the ocean network traffic data set, wherein the ocean network traffic data set comprises ocean network traffic samples, and the ocean network traffic samples comprise normal traffic samples and attack class samples;

[0010] Step 3, inputting the preprocessed ocean network traffic data set into a previously established genetic random forest GARF feature dimension reduction algorithm, performing feature dimension reduction on the ocean network traffic data set, obtaining an optimal feature subset, reducing the feature dimension of the original ocean network traffic data set, and improving the running speed of the model;

[0011] Step 4, inputting the optimal feature subset into a previously established approximate nearest neighbor algorithm ANN to obtain an optimal approximate nearest neighbor node set of the optimal feature subset, and converting the network traffic data into a graph structure type data set;

[0012] Step 5, inputting the graph structure type data set into a previously established graph convolutional neural network GCN to obtain traffic features, inputting the traffic features into a preset classification network to obtain a classification result;

[0013] Step 6, combining the classification result, using a loss function binary cross entropy as an evaluation standard, using an optimization algorithm Adam as an optimizer, training the previously established ocean network intrusion detection model to obtain a trained ocean network intrusion detection model, thereby realizing the function of ocean network intrusion detection.

[0014] Step 1 comprises:

[0015] The marine meteorological sensor network (MMSN) mainly comprises a marine server (a coastal server, a marine base station server, etc.), a marine mobile terminal node (a meteorological buoy, a meteorological unmanned aerial vehicle, etc.), a marine switch (a ship meteorological station, a meteorological detection ship, etc.), and a satellite, etc.

[0016] Each marine mobile terminal node can transmit and forward network traffic, and the mobile terminal node has limited computing resources, so that it cannot perform large network protection mechanisms. The marine base station server has sufficient computing power to deploy network security mechanisms. The marine switch close to the marine mobile terminal node can capture the network traffic of the marine mobile terminal node of the marine base station server.

[0017] The marine mobile terminal node has characteristics of various node types, complex structure hierarchy, large data transmission volume, and poor deployment environment. In the MMSN, the marine switch is the main forwarding device, which can forward or discard traffic based on a flow table.

[0018] In addition, the marine base station server and the marine switch have strong computing power and computing resources, and can both be deployed for advanced defense. Suppose that a criminal intrudes into the network nodes of the marine network intrusion detection model from the external network by starting malicious network traffic, further harms and controls the vulnerable network nodes of the MMSN, so that the network nodes of the MMSN are in an untrusted state. The marine MMSN network nodes infected by malicious network traffic will lose their original functions and become new malicious MMSN network nodes, and then launch a large number of malicious traffic attacks on other normal MMSN network nodes, which may eventually cause the entire MMSN to be in a paralyzed state, which will cause very serious harm. In order to prevent the MMSN from being paralyzed and ensure that the MMSN can work normally, it is necessary to perform timely network intrusion detection on the MMSN.

[0019] Considering the characteristics of the MMSN and the requirements of network intrusion detection, the marine network intrusion detection model comprises a data collection module, a network intrusion detection module, and a response feedback module.

[0020] The data collection module is used to collect network traffic data streams of the MMSN, extract data features of the network traffic, and deliver the data features to the network intrusion detection module.

[0021] The network intrusion detection module is used to preprocess the network traffic data, use a neural network model (which can be a convolutional neural network CNN, a long short-term memory neural network LSTM, etc.) to classify and detect the network traffic data features, identify abnormal network traffic data and network traffic attacks, and deliver the network intrusion detection results to the response feedback module.

[0022] The response feedback module is used to interrupt the attacked node service, reject network flow data from malicious nodes, and feed back the network attack situation to the artificial for further processing.

[0023] In step 2, the network flow data set is preprocessed, including:

[0024] The feature types contained in the network flow data set are numerical features and symbolic features, and the network flow data set is numerically valued and missing value processed. The numerical value is converted into a numerical feature representation by using one-hot encoding; the missing value is filled with 0;

[0025] The network flow data set after missing value processing is subjected to Min-Max Scaling, and the numerical value is normalized to 0 to 1.

[0026] In step 2, the numerical value is normalized to 0 to 1 by using the following formula:

[0027]

[0028] Where x is the data corresponding to one of the numerical features in the network flow data set, x max is the maximum value of the data corresponding to the numerical feature, x min is the minimum value of the data corresponding to the numerical feature, and x * represents the normalized data corresponding to the numerical feature.

[0029] In step 3, the GARF feature dimensionality reduction algorithm includes a GA algorithm and an RF algorithm;

[0030] The GA algorithm generates a reduced feature vector by the following steps:

[0031] Step 3-1, create an initial population;

[0032] Step 3-2, find the fitness score of each chromosome in the population, and the fitness score calculation formula is:

[0033]

[0034] Where X is a binary vector representing the current feature subset, fitness(X) is the fitness function, Accuracy(X) is the classifier accuracy, and a is a predefined weight adjusted according to user requirements to indicate the importance of RF accuracy relative to the length of the subset; Accuracy(X) is the accuracy of RF based on feature subset X, which is used to calculate the accuracy of the classifier, x i indicates whether the i-th feature is used; therefore, The number of features in the given subset is given;

[0035] Step 3-3, selecting the best chromosome from the population;

[0036] Step 3-4, applying a crossover operation between the two selected parents;

[0037] Step 3-5, performing a mutation operation on the mutation of the population;

[0038] Step 3-6, checking the termination condition; generally, the maximum number of iterations is reached as the termination condition.

[0039] The RF algorithm is an integrated algorithm composed of a decision tree (DT), and the RF algorithm includes two or more decision trees DT, and there is no association between different decision trees DT. When performing a classification task, a new input sample enters, and each decision tree DT in the forest is allowed to judge and classify respectively, and each decision tree DT will obtain a classification result. The classification result with the most categories in all classification results is taken as the final result.

[0040] In step 4, the approximate nearest neighbor algorithm ANN (Approximate Nearest Neighbor, ANN) includes: regarding each data of the network flow data set as a node, calculating the Euclidean distance between the nodes, and the formula is:

[0041]

[0042] Where d(dx, dy) represents the Euclidean distance between two nodes dx and dy, dn is the number of features, dx i and dy i respectively represent the value of the i-th feature in the node dx and the value of the i-th feature in the node dy;

[0043] By looping through the nodes in the training data set and the test data set in the network flow (the NSL-KDD data set is a classic public data set, and the training set and the test set are provided by the NSL-KDD official website. Downloading a training set.csv and a test set.csv), the index of the similar neighbor node of node i is obtained, the node feature matrix is obtained, the edge information is added to the edge list, the edge connection data is obtained, and finally the edge connection data is converted into an adjacency matrix, that is, the network flow data is converted into graph structure data, so that the GCN can classify and predict the graph structure data.

[0044] In step 5, the graph convolutional neural network GCN is based on graph structure data, the graph structure data includes a feature matrix and an adjacency matrix, the graph convolutional neural network GCN has high operation speed on the graph structure data, and the graph structure data can be directly calculated;

[0045] The graph convolutional neural network GCN takes the feature matrix M and the adjacency matrix A as initial input, and extracts features from the graph structure data, and it is assumed that there are N nodes in the graph, each node has d-dimensional features, and the structure of the graph and the node features are represented as A∈R N×N and M∈R N×d , wherein R represents a real number, R N×N and R N×d respectively represent an N*N-dimensional real matrix and an N*d-dimensional real matrix;

[0046] The graph convolutional neural network GCN takes M and A as input and performs graph convolution operation with local first-order approximation, and the graph convolutional neural network GCN includes two or more neural network layers, and the propagation mode between the neural network layers is:

[0047]

[0048] Wherein, Z is a node feature representation, sigma is a nonlinear activation function, is an approximate graph convolution filter, is a self-loop adjacency matrix, and I is a unit matrix of the self-loop adjacency matrix, is a degree matrix, and W is a weight matrix input to a hidden layer;

[0049] The graph convolutional neural network GCN learns the hidden representation of the node by encoding the graph structure and the node features, finally completes the classification task of the network traffic, and realizes the goal of network intrusion detection.

[0050] In step 5, the converted graph structure data is input into the GCN to obtain the output of the graph convolutional neural network GCN, and finally, a sigmoid function is used as an activation function to perform binary classification output, and the classification results corresponding to each marine network traffic sample are output.

[0051] The application also provides a marine network intrusion detection model based on feature dimension reduction and graph convolution, comprising:

[0052] A data preprocessing module is used for receiving a network traffic data set and preprocessing the network traffic data set, wherein the network traffic data set includes network traffic samples, and the network traffic samples include normal traffic samples and attack class samples;

[0053] The feature dimension reduction module is used for inputting the preprocessed network traffic data set into a pre-established genetic random forest GARF feature dimension reduction algorithm, performing feature dimension reduction on the network traffic data set, obtaining an optimal feature subset, reducing the feature dimension of the original network intrusion detection data set, improving the intrusion detection performance and operation speed of the model, and taking the obtained optimal feature subset as a final training data set.

[0054] The data conversion module is used for inputting the optimal feature subset into a pre-established approximate nearest neighbor algorithm ANN, obtaining an optimal approximate nearest neighbor node set of the optimal feature subset, and converting the network traffic data into a graph structure type data set.

[0055] The classification module is used for inputting the final graph structure type data set into a pre-established graph convolutional neural network GCN, obtaining traffic features, inputting the traffic features into a pre-set classification network, and obtaining a classification result.

[0056] The model training module is used for training a pre-established marine network intrusion detection model by combining the classification result, using a loss function Binary crossentropy as an evaluation standard and using an optimization algorithm Adam as an optimizer, obtaining a trained marine network intrusion detection model, and thus realizing the function of marine network intrusion detection.

[0057] The application also provides a device comprising:

[0058] One or more processors;

[0059] A memory for storing one or more programs;

[0060] When the one or more programs are executed by the one or more processors, the one or more processors realize the method.

[0061] The application has the advantages that the feature dimension reduction module GARF is used to select an optimal feature subset, the ANN module is used to convert marine network traffic data into graph structure data, and the GCN module is used to classify and predict the graph structure data, so that the network intrusion detection performance and efficiency are improved, and the application has important theoretical significance and application value in the field of marine meteorological sensor networks. BRIEF DESCRIPTION OF DRAWINGS

[0062] Figure 1 is a method flowchart of the application.

[0063] Figure 2 is a marine meteorological sensor network diagram of the application.

[0064] Figure 3 is a marine meteorological sensor network intrusion detection diagram of the application.

[0065] Figure 4 is a schematic diagram of the marine network intrusion detection model structure of the present application.

[0066] Figure 5 is a schematic diagram of the GCN neural network structure of the present application.

[0067] Figure 6 is a schematic diagram of the influence of GARF on the intrusion detection performance of the present application.

[0068] Figure 7 is a schematic diagram of the training process of the GARF-AGCN model of the present application.

[0069] Figure 8 is a comparison diagram of the intrusion detection performance of the present application and other models.

[0070] Figure 9 is a comparison diagram of the intrusion detection efficiency of the present application and other models.

[0071] Figure 10 is a schematic diagram of the system structure of the present application. DETAILED DESCRIPTION

[0072] The above and / or other aspects of the present application will become apparent and more readily appreciated from the following description, taken in conjunction with the accompanying drawings, in which:

[0073] As shown in Figure 1 , the embodiment provides a marine network intrusion detection method based on feature dimension reduction and graph convolution, including the following steps:

[0074] A marine network intrusion detection model is constructed, and the marine network intrusion detection model includes a data acquisition module, a network intrusion detection module, and a response feedback module.

[0075] A network traffic dataset is received, and the network traffic dataset is preprocessed to obtain a preprocessed network traffic dataset, wherein the preprocessed network traffic dataset contains network traffic samples, and the network traffic samples include normal traffic samples and attack class samples.

[0076] The characteristics of MMSN (as shown in Figure 2 ) and the requirements of network intrusion detection are comprehensively considered, and the design of the MMSN intrusion detection system is as shown in Figure 3As shown, the framework is composed of a data acquisition module and a network intrusion detection module, and a response feedback module. The data acquisition module is mainly responsible for collecting network traffic data streams of MMSN, extracting data features of network traffic, and delivering network intrusion detection module. The network intrusion detection module is mainly responsible for preprocessing network traffic data, using an efficient classifier to classify and detect the features of the incoming network traffic data, identifying abnormal network traffic data and network traffic attacks, and delivering network intrusion detection results to the response feedback module. The response feedback module is mainly responsible for interrupting the business of the attacked node, rejecting network traffic data from malicious nodes, and feeding back the network attack situation to the human for further processing.

[0077] The data preprocessing method specifically includes: standardizing the network traffic data set, that is, converting symbolic features into numerical feature representation by using one-hot encoding; and performing Min-Max Scaling on the data set after standardization and outlier processing to normalize the numerical value to 0 to 1. The network traffic samples in the network traffic data set are taken as input, and the network traffic samples in the preprocessed network traffic data set are taken as output to construct a network traffic data preprocessing module;

[0078] The network traffic data set used in the embodiment of the application is an NSL-KDD data set, and the characteristics of the NSL-KDD data set are as follows:

[0079] The NSL-KDD data set includes a training data set and a test data set. Both the training data set and the test data set include multiple class labels, and only a binary classification task is required in the method, that is, to judge whether the network traffic sample is normal traffic or abnormal traffic, and the abnormal traffic represents an attack. The NSL-KDD records 148517 network traffic samples, each sample is composed of 41 features, and there are 40 attack types, which can be divided into five categories: Normal, DoS, Probe, U2R, and R2L. The NSL-KDD includes two subsets KDDTrain+ and KDDTest+, and the sample class distribution in the two data sets is shown in Table 1. KDDTrain+ is a training set composed of 125973 samples, which records 22 types of attacks; KDDTest+ is a test set composed of 22544 samples, which includes 17 more types of attacks than KDDTrain+.

[0080] The network traffic data set includes numerical features and symbolic features, and the network traffic data set is standardized, and the symbolic features are converted into numerical feature representation based on the one-hot encoding method.

[0081] The NSL-KDD dataset includes 38 numerical features and 3 symbolic features, and the 3 symbolic features are protocol_type feature, service feature and flag feature. Based on one-hot encoding, the protocol_type and other 2 symbolic features are converted into 3 numerical features corresponding to the 3 symbolic features, and the original 41-dimensional network flow dataset is converted into a 122-dimensional network flow dataset.

[0082] Based on the Min-Max Scaling method, the normalized network flow dataset after standardization is processed according to the formula:

[0083]

[0084] In the formula, x is the data corresponding to one of the numerical features in the network flow dataset, x max is the maximum value in the data corresponding to the numerical feature, x min is the minimum value in the data corresponding to the numerical feature, and x * represents the data corresponding to the normalized numerical feature.

[0085] First, the training set is used to reduce the dimension of the features by using the GARF algorithm, which is composed of GA and RF algorithms. The GA algorithm applies six steps to generate a reduced feature vector, i.e., 1) initial population creation, 2) finding the fitness score of each chromosome in the population, 3) selecting the best chromosome from the population, 4) applying a crossover operation between two selected parents, 5) performing a mutation operation on the mutation in the population, and 6) checking the termination condition.

[0086] Fitness function: The fitness score calculation plays a crucial role in evaluating the potential of the GA algorithm, and the fitness function is based on the classification accuracy of RF and the number of selected features. The chromosome with the highest accuracy and the smallest number of features produces the highest fitness value. The fitness score of each chromosome in the population is calculated using the formula given in equation (3).

[0087]

[0088] where X is a binary vector representing the current feature subset, fitness(X) is the fitness function, Accuracy(X) is the classifier accuracy, and a is a predefined weight adjusted according to user requirements to indicate the importance of RF accuracy relative to the length of the subset; Accuracy(X) is the accuracy of RF based on the feature subset X, which is used to calculate the accuracy of the classifier, and x i represents the bit indicating whether the i-th feature is used. Therefore, The number of features in the given subset is given;

[0089] RF is an integrated algorithm composed of decision trees (DTs). As shown in Figure 4 RF is composed of many DTs, and there is no correlation between different DTs. When performing a classification task, a new input sample enters, and each DT in the forest makes a judgment and classification. Each DT gets its own classification result. The RF takes the classification with the most DTs as the final result.

[0090] After 50 iterations, different feature subsets of different feature dimensions are obtained. The accuracy of the classifier under different feature subsets of different feature dimensions in the validation set is shown in Figure 6 As can be seen from the figure, when the feature dimension is 122, the accuracy of the classifier is about 80%. As the feature dimension decreases, the accuracy of the classifier gradually increases. When the feature dimension is reduced to 16, the classifier reaches the highest accuracy of 90%. If the feature dimension continues to decrease, the accuracy of the classifier will decrease sharply. Therefore, the feature subset with a feature dimension of 16 is selected as the best feature subset of the original data set to achieve the purpose of feature dimension reduction, reduce the training time of the model, and improve the performance of the model.

[0091] In this embodiment, the ANN algorithm is used to convert data into graph structure data. The ANN mainly consists of an approximate nearest neighbor (ANN) algorithm. Each data in the network traffic data set is regarded as a node, and the Euclidean distance between nodes is calculated. The Euclidean distance calculation process is as follows:

[0092]

[0093] where dx and dy are the feature vectors of two nodes, dn is the number of features, dx i and dy i represent the value of the i-th feature in node dx and node dy, respectively. By traversing the nodes in the training data set and the test data set in the network traffic, the index of the similar neighbor node of node i is obtained, the node feature matrix is obtained, the edge information is added to the edge list, the edge connection data is obtained, and finally it is converted into an adjacency matrix, i.e. the network traffic data is converted into graph structure data, so that the GCN classifier can classify and predict the graph structure data.

[0094] The key parameter of the ANN algorithm is the K value. Different K values ​​control the number of nearest neighbor nodes for each node. The model classification performance under different K values ​​is: when K = 2, the ANN algorithm finds the two nearest neighbor nodes for each node as its neighbor nodes, the classifier accuracy is 90.31%, and the model training time is also the shortest. As the K value increases, the number of neighbor nodes for each node increases, the classification performance of the classifier gradually improves, and the training time also increases. When K = 7, the classifier reaches the highest accuracy of 91.40%. As the K value continues to increase, the classification performance gradually decreases. Therefore, K = 7 is selected as the optimal K value for the ANN algorithm to obtain the graph structure data with the best approximation of neighbor nodes.

[0095] In this embodiment, GCN is based on graph structure data, which consists of two parts: feature matrix and adjacency matrix. Therefore, it is necessary to convert the data set into graph structure data through ANN. GCN has a high computing speed for graph structure data and can directly calculate graph structure data. The GCN neural network model uses the feature matrix M and the adjacency matrix A as initial input and extracts features from the graph structure data. The neural network model of GCN is as follows: Figure 5 As shown, there are N nodes in the graph, each node has d-dimensional features, and the structure of the graph and the node features are represented by A∈R N×N and M∈R N×d Indicates that R represents a real number, R N×N and R N ×d Represents real number matrices of N×NN×N and N×dN×d dimensions respectively. The GCN unit takes X and A as input and performs a graph convolution operation with local first-order approximation. GCN consists of multiple neural network layers, and its propagation between layers is:

[0096]

[0097] Among them, Z is the node feature representation, σ is the nonlinear activation function, is an approximate graph convolution filter, is a self-loop adjacency matrix, and I is the identity matrix of the self-loop adjacency matrix, is the degree matrix, and W is the weight matrix input to the hidden layer. GCN can learn the hidden representation of nodes by encoding graph structure and node features, and ultimately complete the task of classifying network traffic and achieve the goal of network intrusion detection.

[0098] The graph structure data of the network traffic sample in the training data set is input into the GCN to obtain the output of the GCN, and finally, a sigmoid function is used as an activation function for binary classification output, and the classification results corresponding to each network traffic sample are output. The accuracy of the GCN model on the training set and the test set changes with the number of training rounds as shown in Figure 7 The red line and the blue line are the training set accuracy Train Accuracy and the test set accuracy Test Accuracy respectively. As can be seen from the figure, the classification accuracy of the GCN model first increases, then decreases, then continues to increase, and finally stabilizes after 100 rounds. The curve trends of the two are consistent, indicating that the GARF-AGCN model has good learning ability. Finally, the classification accuracy of the training set stabilizes at about 94%, and the classification accuracy of the test set stabilizes at about 91%, indicating that the GARF-AGCN model is easy to train and has good learning ability, and can identify abnormal traffic in network traffic.

[0099] The network intrusion detection model is used to realize rapid, efficient and accurate marine network intrusion detection.

[0100] In one embodiment, the initial population size of the GARF is set to 50, the number of iterations is set to 50, the crossover rate is set to 0.8, the mutation rate is set to 0.1, the random seed size of the RF is set to 42, the K value of the ANN is set to 7, the training round number of the GCN is set to 300, the optimizer is set to Adam, the learning rate is set to 0.01, the hidden layer size is set to 16, the neuron dropout rate is set to 0.5, and the activation function of the output layer is set to sigmoid. In addition, the most important goal in marine meteorological sensor network intrusion detection is to distinguish normal traffic from malicious traffic in the marine meteorological sensor network, therefore, this paper uses binary classification labels as the labels of the model for training and testing.

[0101] In another aspect, to achieve the above-mentioned object, the application discloses a marine network intrusion detection model based on feature dimension reduction and graph convolution, as shown in Figure 10 The marine network intrusion detection model based on feature dimension reduction and graph convolution comprises:

[0102] A data preprocessing module: configured to receive a network traffic data set, and preprocess the network traffic data set to obtain a preprocessed network traffic data set, wherein the preprocessed network traffic data set contains network traffic samples, and the network traffic samples include normal traffic samples and attack class samples;

[0103] The feature dimension reduction module is configured to input the preprocessed network traffic dataset into a pre-established GARF, perform feature dimension reduction on the network traffic dataset, obtain an optimal feature subset, reduce the feature dimension of the original network intrusion detection dataset, improve the intrusion detection performance and running speed of the model, and take the obtained optimal feature subset as a final training dataset.

[0104] The data conversion module is configured to input the optimal feature subset into a pre-established ANN, obtain an optimal approximate nearest neighbor node set of the optimal feature subset, and convert the network traffic data into a graph structure type dataset.

[0105] The model classification module is configured to input the final graph structure type dataset into a pre-established GCN neural network model, obtain traffic features, input the traffic features into a pre-set classification network, and obtain a classification result.

[0106] The model training module is configured to train the pre-established marine network intrusion detection model by using a loss function Binary crossentropy as an evaluation standard and an optimization algorithm Adam as an optimizer in combination with the classification result, and obtain a trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

[0107] In addition, in order to verify the reliability of the model, the model is compared with other intrusion detection models. Figure 8 The intrusion detection experimental comparison results of different models are shown. As can be seen from the figure, the intrusion detection accuracy of the LR model, the SVM model, the XGB model and the RF model based on machine learning is only about 80%, among which the best machine learning model is the RF model, and the intrusion detection accuracy and F1 score thereof are 81.61% and 81.57% respectively. The LSTM model and the CNN model are deep learning models, and the intrusion detection performance of the CNN model is relatively better than that of the LSTM model, and the intrusion detection accuracy and F1 score thereof are 82.24% and 81.24% respectively. The GARF-AGCN model selects an optimal feature subset by using the GARF, converts the network traffic data into a graph data structure by using the ANN, and classifies the graph data structure by using the GCN, so that the intrusion detection accuracy and F1 score of the GARF-AGCN model are 91.41% and 91.34% respectively, which indicates that the GARF-AGCN model has better intrusion detection performance.

[0108] The length of the stable state of the intrusion detection model training is also an important indicator of marine network intrusion detection. It not only directly affects the intrusion response time, but also reflects the intrusion detection efficiency of network intrusion detection, which is very important for marine weather sensor networks with limited computing power. The test set of NSL-KDD is used to test the computing efficiency of machine learning models such as LR, SVM, XGB, and RF, as well as deep learning models such as CNN, LSTM, and GARF-AGCN. The number of training rounds of the three deep learning models is set to 300 rounds. The experimental comparison results are shown in Figure 9 As can be seen from the figure, the shortest training time is the LR model in the machine learning model, which takes 9.24s. The longest detection time is the CNN model in the deep learning model, which takes 361.42s. Although the training time of the machine learning model LR is the shortest, its intrusion detection performance is poor, with an intrusion accuracy rate and F1 score of less than 80%. Therefore, it cannot protect the marine weather sensor network. The deep learning model CNN has relatively good intrusion detection performance, but it takes 361.42s to train 300 rounds, which is too long. Therefore, it is not suitable for application in marine weather sensor networks. The training time of the GARF-AGCN model proposed in this paper is 14.46s, which is only 5.43s longer than the training time of the machine learning model LR with the best computing efficiency. In addition, the intrusion detection performance of the GARF-AGCN model is better than that of the above models. Therefore, the GARF-AGCN model can be applied to the intrusion detection task of marine weather sensor networks.

[0109] Based on the same inventive concept, the application further provides a computer device, which comprises one or more processors and a memory for storing one or more computer programs; the program comprises program instructions, and the processor is configured to execute the program instructions stored in the memory. The processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. It is the computing core and control core of the terminal, which is used to implement one or more instructions, and is specifically used to load and execute one or more instructions in the computer storage medium to realize the above method.

[0110] It needs to be further explained that based on the same inventive concept, the application also provides a computer storage medium, which stores a computer program, and the computer program is executed by a processor to perform the above method. The storage medium can adopt any combination of one or more computer readable media. The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium may, for example, be but is not limited to an electrical, magnetic, optical, electrical, magnetic, infrared, or semiconductor system, device or apparatus, or any combination of the above. More specific examples (non-exhaustive list) of the computer readable storage medium include: electrical connection with one or more conductive wires, portable computer disk, hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination of the above. In the present application, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device or apparatus.

[0111] The application provides an ocean network intrusion detection method and system based on feature dimension reduction and graph convolution. There are many methods and ways to realize the technical solution. The above description is only the preferred embodiment of the application. It should be pointed out that for ordinary skilled persons in the art, without departing from the principle of the application, some improvements and refinements can be made, which should be regarded as the protection scope of the application. The components not explicitly described in the embodiment can be realized by the existing technology.

Claims

1. A marine network intrusion detection method based on feature dimension reduction and graph convolution, characterized in that, The method comprises the following steps: Step 1, constructing a marine network intrusion detection model; Step 2, receiving a marine network traffic data set, preprocessing the marine network traffic data set, wherein the marine network traffic data set comprises marine network traffic samples, and the marine network traffic samples comprise normal traffic samples and attack samples; Step 3, inputting the preprocessed marine network traffic data set into a pre-established genetic random forest GARF feature dimension reduction algorithm, performing feature dimension reduction on the marine network traffic data set, and obtaining an optimal feature subset; Step 4, inputting the optimal feature subset into a pre-established approximate nearest neighbor algorithm ANN to obtain an optimal approximate nearest neighbor node set of the optimal feature subset, and converting the network traffic data into a graph structure type data set; Step 5, inputting the graph structure type data set into a pre-established graph convolutional neural network GCN to obtain traffic features, inputting the traffic features into a pre-set classification network, and obtaining a classification result; Step 6, combining the classification result, using a loss function binary cross entropy as an evaluation standard, using an optimization algorithm Adam as an optimizer, training the pre-established marine network intrusion detection model, and obtaining a trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

2. The method of claim 1, wherein, Step 1 comprises that the marine network intrusion detection model comprises a data acquisition module, a network intrusion detection module and a response feedback module; The data acquisition module is used for acquiring network traffic data flow of the MMSN, extracting data features of the network traffic, and delivering the data features to the network intrusion detection module; The network intrusion detection module is used for preprocessing the network traffic data, using a neural network model to classify and detect the network traffic data features, identifying abnormal network traffic data and network traffic attacks, and delivering the network intrusion detection result to the response feedback module; The response feedback module is used for interrupting the business of the attacked node, rejecting network traffic data from malicious nodes, and feeding back the network attack situation to an artificial person for further processing.

3. The method of claim 2, wherein, In step 2, the preprocessing of the marine network traffic data set comprises: The feature types contained in the network traffic data set are numerical features and symbolic features, the network traffic data set is subjected to numericalization and missing value processing, the numericalization is to convert the symbolic features into numerical features by using one-hot encoding; and the missing value processing is to fill the missing values with 0; The network traffic data set subjected to the missing value processing is subjected to Min-Max Scaling, and the numerical values are normalized to 0 to 1.

4. The method of claim 3, wherein, In step 2, the numerical values are normalized to 0 to 1 by using the following formula: ， wherein x is data corresponding to one of the numerical features in the network traffic dataset, is a maximum value in the data corresponding to the numerical feature, is a minimum value in the data corresponding to the numerical feature, denotes the data corresponding to the numerical feature after normalization.

5. The method of claim 4, wherein, In step 3, the GARF feature dimension reduction algorithm comprises a GA algorithm and an RF algorithm; The GA algorithm generates a reduced feature vector by the following steps: Step 3-1, creating an initial population; Step 3-2, finding the fitness score of each chromosome in the population, and the fitness score calculation formula is: ， where X is a binary vector representing the current subset of features, is the fitness function, is the classifier accuracy, is a predefined weight adjusted according to user requirements to indicate the importance of the RF accuracy relative to the subset length; accuracy(X) is the accuracy of the RF based on the subset of features X, used to calculate the accuracy of the classifier, is a bit indicating whether the i-th feature is used or not; thus, gives the number of features in the given subset; Step 3-3, selecting the best chromosome from the population; Step 3-4, applying a cross operation between two selected parents; Step 3-5, performing a mutation operation on the mutation in the population; Step 3-6, checking the termination condition; The RF algorithm is an integrated algorithm composed of a decision tree DT, the RF algorithm includes two or more decision trees DT, and there is no correlation between different decision trees DT, when performing a classification task, a new input sample enters, and each decision tree DT in the forest is judged and classified respectively, each decision tree DT will get a classification result, and the classification result with the most categories in all classification results is taken as the final result.

6. The method of claim 5, wherein, In step 4, the approximate nearest neighbor algorithm ANN includes: regarding each data of the network traffic data set as a node, calculating the Euclidean distance between the nodes, and the formula is: ， wherein denotes the Euclidean distance between two nodes dxand dy, dnis the number of features, and denotes the value of the i-th feature in node dxand dy, respectively. By circularly traversing the nodes in the training data set and the test data set in the network traffic, the index of the similar neighbor nodes of the nodes is obtained, the node feature matrix is obtained, the edge information is added to the edge list, the edge connection data is obtained, and finally the edge connection data is converted into an adjacency matrix, that is, the network traffic data is converted into graph structure data.

7. The method of claim 6, wherein, In step 5, the graph convolutional neural network GCN is based on graph structure data, and the graph structure data includes a feature matrix and an adjacency matrix; The graph convolutional neural network GCN takes a feature matrix M and an adjacency matrix A as initial input, and extracts features from graph structure data, assuming that there are N nodes in the graph, each node has d-dimensional features, and the structure and node features of the graph are represented as and , where R represents a real number, and respectively represent an N×N-dimensional real matrix and N × d -dimensional real matrix; The graph convolutional neural network GCN takes M and A as input and performs graph convolution operation with local first-order approximation, and the graph convolutional neural network GCN includes two or more neural network layers, and the propagation mode between the neural network layers is: ， wherein, Z is a node feature representation, is a nonlinear activation function, is an approximated graph convolution filter, is a self-loop adjacency matrix, and is a unit matrix of the self-loop adjacency matrix, is a degree matrix, and W is a weight matrix input to a hidden layer; The graph convolutional neural network GCN learns the hidden representation of the nodes by encoding the graph structure and the node features, and finally completes the classification task of the network traffic and realizes the goal of network intrusion detection.

8. The method of claim 7, wherein, In step 5, the converted graph structure data is input into the GCN to obtain the output of the graph convolutional neural network GCN, and finally, a sigmoid function is used as an activation function for binary classification output, and the classification results corresponding to each marine network traffic sample are output.

9. The ocean network intrusion detection system based on feature reduction and graph convolution implemented by the method according to any one of claims 1-8, characterized in that, It comprises: A data preprocessing module is used for receiving a network traffic data set and preprocessing the network traffic data set, wherein the network traffic data set includes network traffic samples, and the network traffic samples include normal traffic samples and attack class samples; A feature dimension reduction module is used for inputting the preprocessed network traffic data set into a pre-established genetic random forest GARF feature dimension reduction algorithm, performing feature dimension reduction on the network traffic data set, obtaining an optimal feature subset, reducing the feature dimension of the original network intrusion detection data set, improving the intrusion detection performance and running speed of the model, and taking the obtained optimal feature subset as a final training data set; A data conversion module is used for inputting the optimal feature subset into a pre-established approximate nearest neighbor algorithm ANN to obtain an optimal approximate nearest neighbor node set of the optimal feature subset, and converting the network traffic data into a graph structure type data set; A classification module is used for inputting the final graph structure type data set into a pre-established graph convolutional neural network GCN to obtain traffic features, inputting the traffic features into a pre-set classification network, and obtaining a classification result. Model training module: used to combine the classification results, use the loss function Binary crossentropy as the evaluation standard, and use the optimization algorithm Adam as the optimizer to train the pre-established marine network intrusion detection model to obtain the trained marine network intrusion detection model, thereby realizing the function of marine network intrusion detection.

10. An apparatus, comprising: include: one or more processors; a memory for storing one or more programs; When one or more of the programs are executed by one or more of the processors, the one or more processors implement the method according to any one of claims 1 to 8.

Images