A method, system, and storage medium for fine-grained multi-class network intrusion open identification.

Abstract

The application provides a network intrusion open recognition method, system and storage medium for fine-grained multi-classification, the network intrusion open recognition method comprising: a feature representation step: learning a general feature representation network to represent training and test samples, thereby providing support for subsequent classification and rejection steps; a classification step: constructing a classifier to classify test samples into a certain category in the known category under the closed world assumption; a rejection step: estimating the possible cluster number from the training data distribution to learn an accurate recognizer in the open feature space, thereby minimizing the risk of known category samples being misidentified as unknown. The application has the beneficial effects that: 1. The network intrusion open recognition method improves the detection accuracy of network intrusion detection in the open world; 2. The network intrusion open recognition method has good feature representation capability and can reject unknown category samples while classifying known category samples.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network intrusion open identification method and system for fine-grained multi-classification and a storage medium. BACKGROUND

[0002] Deep learning has been widely used in the field of network security to protect computer networks and terminal devices from attacks by intruders. Network intrusion detection, as the first line of defense, detects intrusion attempts by analyzing network traffic and behavioral characteristics, providing early warning to reduce the likelihood of successful intrusion. With the amazing effectiveness of deep learning technology in multiple fields, more and more network security researchers use deep learning technology to build detection models to empower network intrusion detection. These detection models have different settings, which are modeled by following two aspects of data types (normal and attack) and artificial labeling granularity (coarse-grained and fine-grained). For example, purely using coarse-grained normal data to learn anomaly detection models, using coarse-grained normal and attack data to learn binary classification models, and using coarse-grained normal data and fine-grained attack data to learn pseudo multi-classification models. These models have been applied to various network intrusion detection systems by researchers and have achieved satisfactory detection performance.

[0003] Unfortunately, these superior solutions work in the closed world assumption, which requires that the classes of test data have all been seen when the model is learned. However, this assumption is weak in the open world. Since the real network environment is constantly changing, it is unrealistic to obtain all known classes when the model is learned. On the one hand, new applications and organic behaviors are constantly evolving. On the other hand, new vulnerabilities and attacker mutations continue to emerge. As a result, these learning-based detection methods incorrectly classify a large number of samples from unknown classes as known classes, resulting in the failure of the deployed solution.

[0004] In order to identify unknown class samples that have never appeared in the training data, some solutions have been proposed in different network intrusion detection settings in recent years, such as anomaly detection, binary classification and pseudo multi-classification for open world. These solutions mainly have two problems. One is to use normal data with coarse granularity. Normal data often includes data generated by different types of multiple applications and organic behaviors. Although mixing these normal data into a coarse-grained class can reduce the difficulty of model learning, it also increases the risk of misidentifying unknown classes as normal classes. Two is to use training data with artificial labels (or data correctly classified in the closed world). The labels of the training data are labeled by network security experts based on domain knowledge. These labels limit the correct understanding of the distribution of the training data, thereby increasing the open area of uncertainty in the feature space. Summary of the Invention

[0005] To address the problems in existing technologies, this invention provides a fine-grained, multi-classification method for network intrusion open identification, comprising the following steps:

[0006] Feature representation step: Learn a feature representation network with good generalization to represent training and test samples, thereby providing support for subsequent classification and rejection steps;

[0007] Classification steps: Construct a classifier to classify the test sample into one of the known categories under the closed-world assumption;

[0008] Rejection step: Estimate the number of possible clusters from the training data distribution to learn an accurate recognizer in an open feature space, thereby minimizing the risk of known class samples being misidentified as unknown.

[0009] As a further improvement of the present invention, the classification step and the rejection step are performed alternately.

[0010] As a further improvement of the present invention, in the feature representation step, a supervised contrastive loss function is used to train the feature representation network, specifically:

[0011] A sample x is randomly selected from the training data. i N(i) represents a mini-batch B kn Neutralized sample x i The index of samples with the same label indicates that the supervised contrastive loss of the network is:

[0012]

[0013] Among them, z i It is sample x i eigenvectors, B kn This corresponds to a known subset of categories in the training data and represents the parameters of the network. This is an indicator function that returns 1 if n equals i, otherwise returns 0; It is a temperature value.

[0014] As a further improvement of the present invention, in the classification step, the k-nearest neighbor algorithm is used as a classifier to model the training data, and during testing, for each test sample x... i The classifier selects a test sample x from the training data based on the cosine distance. i The k most recent samples are used, and then a majority vote is performed using the labels of these k samples to determine the test sample x. i The prediction category.

[0015] As a further improvement of the present invention, in the rejection step, the recognizer assigns a label to each test sample to indicate whether it belongs to the training data distribution. When learning the recognizer, the number of clusters of the training data is estimated from the data distribution density level, and then the relabeled label is used to learn the recognizer.

[0016] As a further improvement of the present invention, the rejection step specifically includes:

[0017] Step S1: Treat each sample in the training data as a separate cluster and represent it as the cluster center;

[0018] Step S2: Calculate the cosine distance from each cluster center to the other clusters, merge the K nearest clusters to each cluster into one cluster, and update the cluster center;

[0019] Step S3: Iteratively execute steps S1 and S2 until the estimated number of clusters (Cluster) is obtained. k Not less than the original known number of classes in the training data;

[0020] Step S4: Estimate the number of clusters k The number of classes used in the k-means algorithm is used to further cluster the training data, thereby relabeling the training data in the feature space.

[0021] Step S5: The training data and new labels will be used to learn a class prototype-based recognizer.

[0022] As a further improvement of the present invention, in step S5, feature representations of training data are extracted using a feature representation network, and the class prototype of each label's category sample is calculated by combining the new label.

[0023] As a further improvement of the present invention, in order to reduce the risk of misidentification caused by excessive open space, the 95th percentile of the sorted distance from each class prototype to its class sample is used as the rejection threshold.

[0024] The present invention also discloses a system for fine-grained multi-class network intrusion open identification, comprising: a memory, a processor, and a computer program stored in the memory, the computer program being configured to implement the steps of the network intrusion open identification method of the present invention when invoked by the processor.

[0025] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the network intrusion open identification method of the present invention when invoked by a processor.

[0026] The beneficial effects of this invention are: 1. The open network intrusion identification method of this invention improves the detection accuracy of network intrusion in the open world; 2. The open network intrusion identification method of this invention has excellent feature representation capabilities, and can classify samples of known categories while rejecting samples of unknown categories. Attached Figure Description

[0027] Figure 1 This is a flowchart of the network intrusion open identification method of the present invention; Detailed Implementation

[0028] To improve the accuracy of network intrusion detection in open worlds, this invention proposes a fine-grained multi-classification open intrusion identification method. By employing a divide-and-conquer strategy, the open identification problem is divided into two sub-problems: classification by a closed-world classifier and identification by an open-world identifier. The identifier assigns a label to the test sample in the open world to indicate whether it belongs to the training data distribution, while the classifier classifies the test sample in the closed world. By combining the label of the test sample and the classification result, the method can accurately classify samples of known categories while identifying samples of unknown categories.

[0029] The proposed method for fine-grained multi-class network intrusion open identification has excellent feature representation capabilities, enabling it to classify samples of known categories while rejecting those of unknown categories. For example... Figure 1 As shown, this open identification method for network intrusion includes three steps: a feature representation step, used to learn a feature representation network with good generalization to characterize training and test samples, thereby providing support for subsequent classification and rejection modules; a classification step, used to build a reliable and stable closed-set classifier, thereby classifying test samples into one of the known categories under the closed-world assumption; and a rejection step, used to estimate the number of possible clusters from the training data distribution, in order to learn an accurate classifier in the open feature space, thereby minimizing the risk of known category samples being misidentified as unknown.

[0030] The classification and rejection steps can be performed alternately.

[0031] The feature representation step uses supervised contrastive techniques to learn a feature representation network. The classification and rejection steps utilize this network to extract feature representations from the training data, which are used to build a closed-world classifier and an open-world recognizer. By combining the classification results of the classifier and the recognition results of the recognizer, the goal is to accurately classify samples of known categories while simultaneously recognizing samples of unknown categories, as detailed below:

[0032] Feature Representation Steps: Although this invention employs a divide-and-conquer strategy to isolate the learning processes of the classifier and the recognizer, both require a well-generalized feature representation network to characterize the samples. To learn a feature representation network that achieves optimal detection performance in a closed world, this invention uses a supervised contrastive loss function for feature representation network training, specifically:

[0033] A sample x is randomly selected from the training data. i N(i) represents a mini-batch B kn Neutralized sample x i The index of samples with the same label indicates that the supervised contrastive loss of the network is:

[0034]

[0035] Among them, z i It is sample x i eigenvectors, B kn This corresponds to a known subset of categories in the training data and represents the parameters of the network. This is an indicator function that returns 1 if n equals i, otherwise returns 0; It's a temperature value. Mini-batch: In deep learning, when training a model, if the training data is too large to be loaded into the model all at once, it's divided into N parts, each containing 64 samples (hypothetically). These 64 samples form a batch, or mini-batch.

[0036] After the feature representation network is trained, the feature representations of the samples can be extracted for subsequent learning of the classifier and recognizer.

[0037] Classification Steps: The classifier classifies the test samples in a closed world. To obtain stable classification performance, this invention uses the k-nearest neighbor algorithm as the classifier to model the training data, eliminating the need for a separate training process. During testing, for each test sample x... i The classifier selects a test sample x from the training data based on the cosine distance. i The k most recent samples are used, and then a majority vote is performed using the labels of these k samples to determine the test sample x. i The prediction category.

[0038] Rejection Step: The recognizer assigns a label to each test sample to indicate whether it belongs to the training data distribution. Instead of using manually labeled training data, this invention estimates the number of clusters in the training data from the perspective of data distribution density when learning the recognizer, and then uses the relabeled data to learn the recognizer.

[0039] The cluster number estimation in the training data uses the nearest K-neighbor idea based on hierarchical clustering. Step S1: First, treat each sample in the training data as a separate cluster and represent it as the cluster center; Step S2: Then, calculate the cosine distance from each cluster center to the remaining clusters, merge the K nearest clusters of each cluster into one cluster, and update the cluster center; Step S3: Finally, iteratively execute steps S1 and S2 until the estimated cluster number (Cluster) is obtained. k The estimated number of categories is not less than the original known number of categories in the training data; Step S4: Furthermore, the estimated number of categories is clustered. k The number of categories used in the k-means clustering algorithm is used to re-cluster the training data, thereby relabeling the training data in the feature space; Step S5: Next, the training data and new labels will be used to learn a class prototype-based recognizer. Feature representations of the training data are extracted using a feature representation network, and combined with the new labels to calculate the class prototype (mean of the feature representation) of the sample belonging to each label's category. To minimize the risk of misidentification due to an excessively large open space, this invention uses the 95th percentile of the sorted distance from each class prototype to the sample belonging to its category as the rejection threshold.

[0040] During the testing phase, real-time captured test samples are used by a feature representation network to extract feature representations, which are then input into a recognizer to determine whether the sample belongs to the training data distribution. The classifier then decides whether to perform a classification process based on the feedback from the recognizer. For example, if the recognizer identifies a test sample as belonging to the training data distribution, it marks it as True, and the classifier further classifies the test sample into one of the known categories.

[0041] The present invention also discloses a system for fine-grained multi-class network intrusion open identification, comprising: a memory, a processor, and a computer program stored in the memory, the computer program being configured to implement the steps of the network intrusion open identification method of the present invention when invoked by the processor.

[0042] The present invention also discloses a computer-readable storage medium storing a computer program configured to implement the steps of the network intrusion open identification method of the present invention when invoked by a processor.

[0043] The beneficial effects of this invention are: 1. The open network intrusion identification method of this invention improves the detection accuracy of network intrusion in the open world; 2. The open network intrusion identification method of this invention has excellent feature representation capabilities, and can classify samples of known categories while rejecting samples of unknown categories.

[0044] The above description, in conjunction with specific preferred embodiments, provides a further detailed explanation of the present invention. It should not be construed that the specific implementation of the present invention is limited to these descriptions. For those skilled in the art, various simple deductions or substitutions can be made without departing from the concept of the present invention, and all such modifications and substitutions should be considered within the scope of protection of the present invention.

Claims

1. A network intrusion open recognition method for fine-grained multi-classification, characterized in that, The method comprises the following steps: a feature representation step of learning a general feature representation network to represent training and test samples, thereby providing support for subsequent classification and rejection steps; a classification step of constructing a classifier to classify test samples into one of the known classes under the closed world assumption; a rejection step of estimating the number of possible clusters from the training data distribution to learn an accurate recognizer in an open feature space, thereby minimizing the risk of known class samples being misidentified as unknown; In the feature representation step, the feature representation network is trained using a supervised contrastive loss function, specifically: Randomly select a sample x from the training data i , N(i) represents the index of the sample x kn in a mini-batch B i and the sample with the same label, and the supervised contrastive loss of the network is: where z i is the feature vector of the sample x i B kn corresponds to the known class subset in the training data, is the parameter representing the network, is the indicator function, which returns 1 if n is equal to i, otherwise returns 0; is the temperature value; In the classification step, a k-Nearest Neighbors algorithm is used as a classifier to model the training data, at test time, for each test sample x i , the classifier selects the k-nearest samples from the training data to x i , then utilizes the labels of these k samples to majority vote to determine the predicted class of test sample x i . In the rejection step, the recognizer assigns each test sample a label indicating whether it belongs to the training data distribution. When learning the recognizer, the number of clusters of the training data is estimated from the data distribution density level, and then the re-labeled label is used to learn the recognizer.

2. The method of claim 1, wherein, The classification step and the rejection step are alternately performed.

3. The method of claim 1, wherein, In the rejection step, specifically comprising: Step S1: Each sample in the training data is treated as a cluster and represented as a cluster center; Step S2: Calculate the cosine distance from each cluster center to the remaining clusters, combine the k clusters closest to each cluster into a cluster, and update the cluster center; Step S3: iteratively performing the step S1, step S2 until the cluster estimated number of classes Cluster k not less than the original known number of classes in the training data; Step S4: The estimated number of clusters Cluster k The number of clusters as the k-means algorithm is used for re-clustering of the training data to achieve re-labeling of the training data in the feature space; Step S5: The training data and the new label will be used to learn a class prototype-based recognizer.

4. The method of claim 3, wherein, In step S5, the feature representation of the training data is extracted using the feature representation network, and the class prototype of each label belonging to the class sample is calculated in combination with the new label.

5. The method of claim 4, wherein, To reduce the risk of misidentification due to the large open space, the 95th percentile of the distance from each class prototype to the sample in its own class is used as the rejection threshold.

6. A system for fine-grained multi-classification of open recognition of network intrusion, characterized by, Comprising: a memory, a processor, and a computer program stored on the memory, the computer program being configured to implement the steps of the network intrusion open recognition method of any one of claims 1-5 when called by the processor.

7. A computer-readable storage medium, characterized in that: The computer readable storage medium stores a computer program, which is configured to implement the steps of the network intrusion open recognition method of any one of claims 1-5 when called by the processor.

Images