Network intrusion open identification method and system for fine-grained multi-classification, and storage medium

Abstract

The invention provides a network intrusion open identification method and system for fine-grained multi-classification and a storage medium, and the method comprises the steps: a feature representation step: learning a generalization feature representation network to represent training and test samples, thereby providing support for the subsequent classification step and rejection step; a classification step: constructing a classifier, and classifying the test sample into a certain category in known categories in the closed world hypothesis; and a rejection step of estimating a possible cluster number from the training data distribution to learn an accurate identifier in the open feature space, thereby minimizing the risk that a known category sample is wrongly identified as unknown. The network intrusion open identification method has the beneficial effects that 1, the detection accuracy of network intrusion detection in the open world is improved by the network intrusion open identification method; and 2, the network intrusion open identification method has good feature representation capability, and samples of unknown categories can be rejected while samples of known categories are classified.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a method, system and storage medium for fine-grained multi-classification network intrusion open identification. Background Art

[0002] Deep learning has been widely used in the field of network security to protect computer networks and terminal devices from intrusion by attackers. As the first line of defense, network intrusion detection detects intrusion attempts by analyzing network traffic and behavioral characteristics, and provides early warnings to reduce the possibility of successful intrusions. With the amazing effectiveness of deep learning technology in many fields, more and more network security researchers are empowering network intrusion detection by building detection models using deep learning technology. These detection models have different settings and are modeled by following two levels: data type (normal and attack) and artificial label granularity (coarse-grained and fine-grained). For example, the anomaly detection model is learned purely using coarse-grained normal data, the binary classification model is learned using coarse-grained normal and attack data, and the pseudo multi-classification model is learned using coarse-grained normal data and fine-grained attack data. These models have been applied by researchers in a variety of network intrusion detection systems and have achieved satisfactory detection performance.

[0003] Unfortunately, these superior solutions work in a closed world assumption, which requires that the categories of the test data have all been seen when the model is learned. However, this assumption is weak in the open world. Since the real network environment is constantly changing dynamically, it is impractical to obtain all known categories when the model is learned. On the one hand, new applications and organic behaviors are constantly evolving. On the other hand, new vulnerabilities and attacker mutations continue to emerge. As a result, these learning-based detection methods misclassify a large number of samples from unknown categories as known categories, causing the deployed solutions to fail.

[0004] In order to identify samples of unknown categories that have never appeared in the training data, some solutions have been proposed in different network intrusion detection settings in recent years, such as anomaly detection for open worlds, binary classification, and pseudo multi-classification. There are two main problems with these solutions. One is the use of normal data with coarse granularity. Normal data often includes data generated by multiple applications of different types and organic behaviors. Although confusing these normal data into a coarse-grained category can reduce the difficulty of model learning, it also increases the risk of unknown categories being mistakenly identified as normal categories. The second is to use training data with artificial labels (or data that has been correctly classified in the closed world). The labels of training data are labeled by network security experts based on domain knowledge. These labels limit the correct understanding of the distribution of training data, thereby increasing the open area of ​​uncertainty in the feature space. Summary of the invention

[0005] In order to solve the problems in the prior art, the present invention provides a network intrusion open identification method for fine-grained multi-classification, comprising the following steps:

[0006] Feature representation step: learn a feature representation network with good generalization to represent training and test samples, thereby providing support for subsequent classification and rejection steps;

[0007] Classification step: build a classifier to classify the test sample into one of the known categories in the closed world hypothesis;

[0008] Rejection step: Estimate the number of possible clusters from the training data distribution to learn an accurate classifier in the open feature space, thereby minimizing the risk of known class samples being misclassified as unknown.

[0009] As a further improvement of the present invention, the classification step and the rejection step are performed alternately.

[0010] As a further improvement of the present invention, in the feature representation step, a supervised contrast loss function is used to perform feature representation network training, specifically:

[0011] Randomly select a sample x from the training data i , N(i) represents the number of kn Neutralize sample x i The index of samples with the same label indicates that the supervised contrast loss of the network is:

[0012]

[0013] Among them, z i is the sample x i The eigenvector of kn corresponds to the known subset of categories in the training data, and is the parameter representing the network. It is an indicator function that returns 1 if n is equal to i, otherwise it returns 0; is the temperature value.

[0014] As a further improvement of the present invention, in the classification step, the k nearest neighbor algorithm is used as a classifier to model the training data. During the test, for each test sample x i , the classifier selects cosine distance test samples x from the training data i The k most recent samples are then used to perform a majority vote to determine the test sample x i The predicted category.

[0015] As a further improvement of the present invention, in the rejection step, the recognizer assigns an identifier to each test sample to indicate whether it belongs to the training data distribution. When learning the recognizer, the number of clusters of the training data is estimated from the data distribution density level, and then the re-labeled labels are used to learn the recognizer.

[0016] As a further improvement of the present invention, the rejection step specifically includes:

[0017] Step S1: Treat each sample in the training data as a cluster and represent it as the cluster center;

[0018] Step S2: Calculate the cosine distance from each cluster center to the remaining clusters, merge the K clusters closest to each cluster into one cluster, and update the cluster center;

[0019] Step S3: Iterate the steps S1 and S2 until the number of clusters estimated is Cluster k Not less than the original known number of categories in the training data;

[0020] Step S4: Cluster the estimated number of categories k The number of categories used in the k-means algorithm is used to cluster the training data again to achieve re-labeling of the training data in the feature space;

[0021] Step S5: The training data and new labels will be used to learn a class prototype-based recognizer.

[0022] As a further improvement of the present invention, in step S5, the feature representation of the training data is extracted by using a feature representation network, and the class prototype of the sample of the category to which each label belongs is calculated in combination with the new label.

[0023] As a further improvement of the present invention, in order to reduce the risk of misidentification due to an excessively large open space, the 95% fraction of the sorting distance from each class prototype to the samples of the category to which it belongs is used as the rejection threshold.

[0024] The present invention also discloses a system for fine-grained multi-classification network intrusion open identification, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the network intrusion open identification method of the present invention when called by the processor.

[0025] The present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the network intrusion open identification method of the present invention when called by a processor.

[0026] The beneficial effects of the present invention are: 1. The network intrusion open identification method of the present invention improves the detection accuracy of network intrusion detection in the open world; 2. The network intrusion open identification method of the present invention has good feature representation ability and can reject samples of unknown categories while classifying samples of known categories. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a flow chart of the network intrusion open identification method of the present invention; DETAILED DESCRIPTION

[0028] In order to improve the detection accuracy of network intrusion detection in the open world, the present invention proposes a network intrusion open identification method for fine-grained multi-classification. The open identification problem is divided into two sub-problems, namely closed-world classifier classification and open-world identifier recognition, by using a divide-and-conquer strategy to solve them separately. The identifier assigns an identifier to the test sample to indicate whether it belongs to the distribution of training data in the open world, and the classifier classifies the test sample in the closed world. By combining the identifier and classification result of the test sample, it is possible to achieve accurate classification of known category samples while identifying unknown category samples.

[0029] The network intrusion open identification method for fine-grained multi-classification proposed in the present invention has good feature representation ability and can reject samples of unknown categories while classifying samples of known categories. Figure 1 As shown in the figure, the network intrusion open identification method includes three steps: a feature representation step, which is used to learn a feature representation network with good generalization to characterize the training and test samples, so as to provide support for the subsequent classification module and rejection module; a classification step: used to build a reliable and stable closed set classifier, so as to classify the test sample into one of the known categories in the closed world hypothesis; a rejection step: used to estimate the possible number of clusters from the distribution of training data to learn an accurate identifier in the open feature space, so as to minimize the risk of known category samples being misidentified as unknown.

[0030] The classification step and the rejection step can be performed alternately.

[0031] The feature representation step uses supervised contrast techniques to learn a feature representation network. The classification step and the rejection step use the feature representation network to extract feature representations of the training data, which are used to build a closed-world classifier and an open-world recognizer. By combining the classification results of the classifier and the identification results of the recognizer, it is possible to accurately classify known category samples while identifying unknown category samples, as follows:

[0032] Feature representation step: Although the present invention adopts a divide-and-conquer strategy to isolate the learning process of the classifier and the recognizer from each other, they both need a feature representation network with good generalization to represent samples. In order to learn a feature representation network that can achieve the best closed-world detection performance, the present invention uses a supervised contrast loss function to train the feature representation network, specifically:

[0033] Randomly select a sample x from the training data i , N(i) represents the number of kn Neutralize sample x i The index of samples with the same label indicates that the supervised contrast loss of the network is:

[0034]

[0035] Among them, z i is the sample x i The eigenvector of kn corresponds to the known subset of categories in the training data, and is the parameter representing the network. It is an indicator function that returns 1 if n is equal to i, otherwise it returns 0; is the temperature value. mini-batch: When training a model in deep learning, because the training data is too large to be loaded into the model at once, the training data is divided into N parts, each of which contains 64 samples (assumingly). The 64 samples here become a batch or mini-batch.

[0036] After the feature representation network training is completed, the feature representation of the sample can be extracted for subsequent learning of the classifier and recognizer.

[0037] Classification step: The classifier classifies the test sample in a closed world. In order to obtain stable classification performance, the present invention uses the k nearest neighbor algorithm as a classifier to model the training data without the need for a training process. During the test, for each test sample x i , the classifier selects cosine distance test samples x from the training data i The k most recent samples are then used to perform a majority vote to determine the test sample x i The predicted category.

[0038] Rejection step: The recognizer assigns a flag to each test sample to indicate whether it belongs to the training data distribution. When learning the recognizer, unlike the method of using training data with artificial labels, the present invention estimates the number of clusters of the training data from the data distribution density level, and then uses the re-labeled labels to learn the recognizer.

[0039] The number of clusters in the training data is estimated using the nearest K neighbor idea based on hierarchical clustering. Step S1: First, treat each sample in the training data as a cluster and represent it as the cluster center; Step S2: Then, calculate the cosine distance from each cluster center to the remaining clusters, merge the K clusters closest to each cluster into one cluster, and update the cluster center; Step S3: Finally, iterate steps S1 and S2 until the number of clusters estimated is Cluster k is not less than the original known number of categories in the training data; Step S4: Then, the estimated number of categories Cluster k The number of categories used as the k-means algorithm (k-means clustering algorithm) is used to cluster the training data again to achieve re-labeling of the training data in the feature space; Step S5: Then, the training data and the new labels will be used to learn a class prototype-based identifier. The feature representation of the training data is extracted by using a feature representation network, and the class prototype (the average value of the feature representation) of the sample of the category to which each label belongs is calculated in combination with the new label. In order to minimize the risk of misidentification introduced by an excessively large open space, the present invention uses the 95% fractional position of the sorted distance from each class prototype to the sample of the category to which it belongs as the rejection threshold.

[0040] In the test phase, the test samples captured in real time are extracted by the feature representation network and then input into the recognizer to obtain the identification of whether they belong to the training data distribution; the classifier decides whether to perform the classification process based on the feedback results of the recognizer. For example, when the recognizer identifies the test sample as a sample within the training data distribution, it is marked as True, and the classifier further classifies the test sample into one of the known categories.

[0041] The present invention also discloses a system for fine-grained multi-classification network intrusion open identification, comprising: a memory, a processor, and a computer program stored on the memory, wherein the computer program is configured to implement the steps of the network intrusion open identification method of the present invention when called by the processor.

[0042] The present invention also discloses a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the network intrusion open identification method of the present invention when called by a processor.

[0043] The beneficial effects of the present invention are: 1. The network intrusion open identification method of the present invention improves the detection accuracy of network intrusion detection in the open world; 2. The network intrusion open identification method of the present invention has good feature representation ability and can reject samples of unknown categories while classifying samples of known categories.

[0044] The above contents are further detailed descriptions of the present invention in combination with specific preferred embodiments, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the protection scope of the present invention.

Claims

1. A network intrusion open identification method for fine-grained multi-classification, characterized in that: This involves performing the following steps: Feature representation step: learn a generalized feature representation network to represent training and test samples, thereby providing support for subsequent classification and rejection steps; Classification step: build a classifier to classify the test sample into one of the known categories in the closed world hypothesis; Rejection step: Estimate the number of possible clusters from the training data distribution to learn an accurate classifier in the open feature space, minimizing the risk of known class samples being misclassified as unknown.

2. The network intrusion open identification method according to claim 1 is characterized in that: The classification step and the rejection step are performed alternately.

3. The network intrusion open identification method according to claim 1 is characterized in that: In the feature representation step, a supervised contrast loss function is used to train the feature representation network, specifically: Randomly select a sample x from the training data i , N(i) represents the number of kn Neutralize sample x i The index of samples with the same label indicates that the supervised contrast loss of the network is: Among them, z i is the sample x i The eigenvector of kn corresponds to the known subset of categories in the training data, and is the parameter representing the network. It is an indicator function that returns 1 if n is equal to i, otherwise it returns 0; is the temperature value.

4. The network intrusion open identification method according to claim 1 is characterized in that: In the classification step, the k nearest neighbor algorithm is used as a classifier to model the training data. During the test, for each test sample x i , the classifier selects cosine distance test samples x from the training data i The k most recent samples are then used to perform a majority vote to determine the test sample x i The predicted category.

5. The network intrusion open identification method according to claim 1 is characterized in that: In the rejection step, the recognizer assigns a flag to each test sample to indicate whether it belongs to the training data distribution. When learning the recognizer, the number of clusters of the training data is estimated from the data distribution density level, and then the re-labeled labels are used to learn the recognizer.

6. The network intrusion open identification method according to claim 5 is characterized in that: The rejection step specifically includes: Step S1: Treat each sample in the training data as a cluster and represent it as the cluster center; Step S2: Calculate the cosine distance from each cluster center to the remaining clusters, merge the k clusters closest to each cluster into one cluster, and update the cluster center; Step S3: Iterate the steps S1 and S2 until the number of clusters estimated is Cluster k Not less than the original known number of categories in the training data; Step S4: Cluster the estimated number of categories k The number of categories used in the k-means algorithm is used to cluster the training data again to achieve re-labeling of the training data in the feature space; Step S5: The training data and new labels will be used to learn a class prototype-based recognizer.

7. The network intrusion open identification method according to claim 6 is characterized in that: In step S5, the feature representation of the training data is extracted by using a feature representation network, and the class prototype of the sample of the category to which each label belongs is calculated in combination with the new label.

8. The network intrusion open identification method according to claim 7 is characterized in that: In order to reduce the risk of false identification due to too large an open space, the 95% score of the sorting distance from each class prototype to the samples of its category is used as the rejection threshold.

9. A system for fine-grained multi-classification network intrusion open identification, characterized in that: include: A memory, a processor and a computer program stored in the memory, wherein the computer program is configured to implement the steps of the network intrusion open identification method according to any one of claims 1 to 8 when called by the processor.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and the computer program is configured to implement the steps of the network intrusion open identification method according to any one of claims 1 to 8 when called by a processor.

Images