Intrusion detection method and system integrating multiple neural networks

Abstract

The invention relates to the technical field of intrusion detection, in particular to an intrusion detection method and system integrating multiple neural networks. Taking a data set of intrusion detection as an original data set, and carrying out unified coding on the original data set; performing data standardization on the coded data, performing unified processing, and generating network balance data by using WGAN confrontation; integrating CNN and LSTM-GRU neural networks to form an intrusion detection model, and performing deep mining on key features; performing classification test on the intrusion detection model trained by the training data set by using the test data set; and detecting real-time data by using the intrusion detection model passing the test. The problem that the accuracy of the model is reduced due to the fact that the model is excessively biased to majority features due to excessive majority data is avoided.

Description

Technical Field

[0001] The present invention relates to the technical field of intrusion detection, and in particular to an intrusion detection method and system integrating multiple neural networks. Background Art

[0002] Based on the detection method, intrusion detection systems can be divided into misuse-based intrusion detection systems and anomaly-based intrusion detection systems. If the intrusion detection system finds a match between unknown network traffic and known network traffic signatures in the database, the intrusion detection system immediately provides a warning. High detection accuracy is a benefit, but the disadvantage is that the system strongly relies on the current database, which makes it challenging to identify unidentified network attacks. Anomaly-based intrusion detection systems detect the difference between normal behavior and abnormal behavior, and when the network behavior is very different from expectations, the intrusion detection system will issue a warning. In order to better detect unknown traffic in real networks, this is the current mainstream research hotspot.

[0003] From the perspective of model learning, traditional machine learning, deep learning, and reinforcement learning are all popular methods for anomaly-based intrusion detection systems. Machine learning algorithms are generally divided into supervised and unsupervised categories. Common supervised learning methods include Naive Bayes, K-nearest neighbor, random forest, support vector machine, etc. Unsupervised learning includes K-means algorithm, hierarchical clustering, Gaussian mixture model, etc. When faced with high-dimensional features, traditional machine learning methods have difficulty extracting features from a large amount of network data due to the increase in network data volume, increase in false alarm rate, and decrease in accuracy. The amount of data is growing, but the abnormal traffic is decreasing, which limits the development of traditional machine learning technology. In order to solve the problems of low accuracy and poor performance of traditional machine learning technology under the condition of unbalanced network data traffic ratio, the system used to detect intrusion adopts deep learning classification algorithm and WGAN adversarial generation technology. Summary of the invention

[0004] In view of the above problems existing in the prior art, the present invention is proposed.

[0005] Therefore, the present invention provides a variable load boiler cleaning factor evaluation method based on historical data, which can solve the problems of imbalanced proportions and poor performance faced by traditional machine learning technology when processing network data traffic. The present invention uses WGAN adversarial generation technology to balance minority and majority class data, avoid the model being too biased towards majority class features, and improve the accuracy and generalization ability of the model.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: an intrusion detection method integrating multiple neural networks, comprising: taking the intrusion detection data set as the original data set, and uniformly encoding the original data set; using WGAN to generate network balance data, and using CNN to extract data features, using a multi-head squeezing incentive mechanism MSE to perform multi-angle adaptive calibration on the features, and integrating LSTM-GRU neural network to form an intrusion detection model; using a test data set to perform classification test on the intrusion detection model trained by the training data set.

[0007] As a preferred solution of the intrusion detection method integrating multiple neural networks described in the present invention, wherein: the original data set includes the judgment results of network data flow and abnormal intrusion behavior;

[0008] The unified encoding process includes applying one-hot encoding to non-numeric features and mapping them into binary space vectors, which can be expressed as:

[0009]

[0010] Among them, F is the value of the data feature, F min is the minimum value of the data eigenvalue, F max is the maximum value of the data eigenvalue, F norm is the normalized value.

[0011] As a preferred solution of the intrusion detection method integrating multiple neural networks described in the present invention, wherein: the use of WGAN to counter generate network balance data includes: WGAN is improved on the basis of GAN, and the Earth-Mover distance is used as the loss function, and the formula is expressed as:

[0012]

[0013] Among them, g θ is the generator in WGAN, f w is the discriminator in WGAN, x (i) is the i-th real data, z (i) is the i-th random noise data, Loss c is the loss function of the generator, Loss g is the loss function of the discriminator, m is the number of batch data, and i is the data index value;

[0014] Use the adversarial learning between the generator and the discriminator to learn minority class features, generate minority class data, and create a new data set;

[0015] The adversarial learning of the generator and the discriminator includes a generator with 3 linear layers and a discriminator with 3 linear layers. The generator generates random noise virtual data with the same dimension as the real data. The real data and the virtual data are input into the discriminator to judge the authenticity of the data. After the generator training is completed, the number of the largest number of types of data is used as the final number of generated data to obtain a data set with balanced distribution of each type of data.

[0016] As a preferred solution of the intrusion detection method integrating multiple neural networks described in the present invention, wherein: the use of CNN to extract data features includes two one-dimensional convolutional layers and two maximum pooling layers, the convolution kernel size of the one-dimensional convolutional layer is 3, the data is preprocessed to obtain 93*1 data, the first convolution obtains 91*32 data, the pooling layer step size is 2, the data is output to the pooling layer through the convolution layer for dimensionality reduction, and 45*32 data is obtained, the second convolution operation obtains 43*64 data, and the second pooling dimensionality reduction obtains 21*64 data;

[0017] The multi-angle adaptive calibration of features includes: the squeezing operation uses global average pooling to generate global statistical information, and uses two fully connected layers and activation functions to adaptively learn the weighted coefficients of the global statistical information, which is expressed as follows:

[0018]

[0019] s=F ex (F sq (x c ),W)=σ(g(z,W))=σ(W2δ(W1))

[0020] Among them, F sq For extrusion operation, F ex To stimulate the operation, z c is the global statistical information, s is the global statistical information z c The weighting coefficient, x c represents the c-th feature with input size H, σ and δ are activation functions sigmoid and ReLU respectively, W1 and W2 are the weights of the first and second fully connected layers respectively, and W is the global weight;

[0021] The multi-head squeeze incentive mechanism MSE uses multiple squeeze incentive mechanisms SE to fit and learn traffic features in parallel. For each SE block, the weighted features are obtained by multiplying the generated weight vector with the original features. The outputs of multiple SE blocks are fused by Concat. The final output formula is expressed as:

[0022] X′=Concat(s 1 X,s 2 X,s 3 X)

[0023] X=[x1,x2,...,x c ]

[0024] Among them, X′ is the final output, s 1 、s 2 and 3 are different weight vectors respectively, and X is the original feature.

[0025] As a preferred solution of the intrusion detection method integrating multiple neural networks described in the present invention, the integrated LSTM-GRU neural network includes a long short-term memory network and a gated neural unit, 21*64 data is obtained from the convolution layer, the data is passed through the long short-term memory network to obtain 21*64 data, and a one-dimensional vector with a length of 64 is obtained through the gated neural unit. The SoftMax classifier is used for classification, and the formula is expressed as follows:

[0026]

[0027] Among them, SoftMax(z) i is the output data of the SoftMax function, z i is the input data of the SoftMax function, e is a constant, k is the number of output nodes, and j is the output node index value.

[0028] As a preferred solution of the intrusion detection method integrating multiple neural networks described in the present invention, the intrusion detection model includes building a hierarchical network model through CNN and LSTM-GRU networks to obtain the dynamic characteristics of the data, and the data obtained after two convolution calculations and pooling calculations are input into the input layer of the LSTM network. In the LSTM-GRU network, a hidden layer is used to extract features, a ReLU function is used to activate operations, and a fully connected layer is linked to the GRU output layer.

[0029] As a preferred solution of the intrusion detection method integrating multiple neural networks described in the present invention, the classification test includes obtaining an n-dimensional vector y after the data features are processed by the neural network, and the formula is expressed as follows:

[0030]

[0031] Among them, y i is the i-th element in the input vector y;

[0032] Use the SoftMax function to transform the vector into an n-dimensional real vector p. The formula is:

[0033]

[0034] p0 + p1 + p2 + …… + p n = 1

[0035] where p i is the probability of the i-th category;

[0036] The classification result of the feature is determined by the category corresponding to the maximum probability. The classification result is optimized into two classification categories, namely normal data and abnormal data. The SoftMax classifier maps the data features into the probabilities of two categories. p0 is normal data, p1 is abnormal data, p0 + p1 = 1. When p0 > p1, the data is judged as normal data. When p0 < p1, the data is judged as abnormal data;

[0037] When the classification result is normal data, the intrusion detection model has no response;

[0038] When the classification result is abnormal data, the intrusion detection model activates the security protection function of the system, gives a warning to the staff, and notifies the result to the mobile device of the staff.

[0039] Another object of the present invention is to provide an intrusion detection system integrating multiple neural networks. Through the data encoding and standardization module, the system performs unified encoding and standardization processing on the original data set to ensure the unity and comparability of the data. The WGAN data balancing module uses the adversarial generation network technology to balance the data, reduces the bias and imbalance problems in the data set, and improves the generalization ability and robustness of the model. The hybrid neural network integration module forms a hybrid neural network model by integrating multiple neural networks such as CNN, LSTM, and GRU, which can deeply mine key features and improve the accuracy and efficiency of intrusion detection. The model classification and testing module uses the test data set to classify and test the intrusion detection model trained on the trained data set, evaluates the performance and accuracy of the model, and ensures the effectiveness and reliability of the model in practical applications.

[0040] As a preferred solution of an intrusion detection system integrating multiple neural networks according to the present invention, it includes: a data encoding and standardization module, a WGAN data balancing module, a neural network integration module, and a model classification and testing module;

[0041] The data encoding and standardization module takes the data set for intrusion detection as the original data set and performs unified encoding on the original data set;

[0042] The WGAN data balancing module performs data standardization on the encoded data, makes unified processing, and uses the WGAN adversarial generation network to balance the data;

[0043] The neural network integration module integrates CNN and LSTM-GRU after completing data balancing to form an intrusion detection model and deeply mine key features;

[0044] The model classification test module uses the test data set to perform classification test on the intrusion detection model trained with the training data set.

[0045] A computer device includes a memory and a processor, wherein the memory stores a computer program, and is characterized in that when the processor executes the computer program, it implements the steps of an intrusion detection method integrating multiple neural networks.

[0046] A computer-readable storage medium having a computer program stored thereon, characterized in that when the computer program is executed by a processor, the steps of an intrusion detection method integrating multiple neural networks are implemented.

[0047] Beneficial effects of the present invention: The intrusion detection method provided by the present invention integrates multiple neural networks and establishes a new combined prediction model. The use of convolutional layers can identify rich spatial features, LSTM is particularly effective in understanding random dependencies in data, and GRU provides the model with the flexibility to reset information that is no longer relevant, allowing for more adaptive and efficient analysis of the temporal aspects of the data. WGAN is used to generate minority classes to balance the data set, avoiding the problem that too much majority class data makes the model too biased towards majority class features, resulting in a decrease in model accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0049] Figure 1 A schematic flow chart of an intrusion detection method integrating multiple neural networks provided by an embodiment of the present invention.

[0050] Figure 2 A neural network structure diagram of an intrusion detection method integrating multiple neural networks provided by an embodiment of the present invention.

[0051] Figure 3 A framework structure diagram of a multi-head squeezing incentive mechanism for an intrusion detection method integrating multiple neural networks provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0052] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0053] Example 1, reference Figure 1-Figure 3 , which is the first embodiment of the present invention, provides an intrusion detection method integrating multiple neural networks, including:

[0054] S1: The intrusion detection dataset is taken as the original dataset and uniformly encoded.

[0055] It should be noted that there are problems such as data imbalance, difficulty in extracting sample features, and poor accuracy in detecting abnormal traffic in the intrusion detection system. In order to deal with these problems, the present invention proposes a composite intrusion detection solution. The model uses the intrusion detection data set as the original data set and uniformly encodes the intrusion detection data using one-hot encoding;

[0056] An N-bit state register is used to encode N states. Each state has its own independent register bit, and only one bit is valid at any time, that is, only one bit is 1, and the rest are zero values.

[0057] S2: Use WGAN to generate network balance data, use CNN to extract data features, use multi-head squeeze incentive mechanism MSE to perform multi-angle adaptive calibration of features, and integrate LSTM-GRU neural network to form an intrusion detection model;

[0058] The original data set includes the network data flow and the judgment results of abnormal intrusion behavior. In order to convert non-numeric features into digital features, one-hot encoding is used to map them into binary space vectors. In data preprocessing, the MIN-MAX scaling method is used to scale the data to a specific interval [0,1].

[0059]

[0060] Among them, F is the value of the data feature, F min is the minimum characteristic value, F max is the characteristic maximum value, F norm is the normalized value.

[0061] Furthermore, WGAN is improved on the basis of GAN. The Sigmoid function of the last layer of the GAN network discriminator is removed and the Earth-Mover distance is used as the loss function instead. It uses the adversarial learning of minority class features between the generator and the discriminator, and finally uses the trained generator to generate minority class data to create a new balanced data set, which can solve the data imbalance problem.

[0062] The Earth-Mover distance as a loss function is calculated as follows:

[0063]

[0064] Among them, g θ is the generator in WGAN, f w is the discriminator in WGAN, x (i) is the i-th real data, z (i) is the i-th random noise data, Loss c is the loss function of the generator, Loss g is the loss function of the discriminator, m is the number of batch data, and i is the data index value;

[0065] Since the number of different types of data in the data set is extremely unevenly distributed, the intrusion detection model will tend to learn the characteristics of the majority class data and ignore the characteristics of the minority class data (minority class data is the data with a smaller number of data in the data set). Therefore, it is necessary to generate minority class data so that the number is basically equivalent to that of majority class data, and use the adversarial learning of minority class features between the generator and the discriminator. Finally, the trained generator is used to generate minority class data and create a new data set with even distribution of different types of data.

[0066] Furthermore, the adversarial learning includes a generator with 3 linear layers and a discriminator with 3 linear layers. The generator is responsible for generating virtual data with the same dimension as the real data from random noise, and inputting the real data and virtual data into the discriminator to determine whether the data is generated or real. The generator continuously optimizes the data it generates so that the discriminator cannot judge, and the discriminator also continuously optimizes itself to make the judgment result more accurate, and the two are constantly in confrontation. After the generator training is completed, the number of data of the largest number of types is used as the final generated number of other types of data, and finally a data set with balanced distribution of each type of data is obtained.

[0067] It should be noted that CNN excels at extracting spatial features from input data, applying a series of learnable convolutional kernels to the input data to capture basic features, such as the signature of a packet header or the probability of a specific network event. The LSTM architecture provides a mechanism to learn which data in a sequence is important to keep or discard. In the context of network traffic, this means being able to retain key information about a series of operations. These operations may indicate a coordinated attack while ignoring irrelevant data. As a complement to LSTM, GRU simplifies the gating mechanism, merging the forget gate and input gate into a single update gate, which allows GRU to make fewer parameter updates, thereby reducing computational complexity without significantly affecting network performance.

[0068] Further, such as Figure 2 As shown, the use of CNN to extract data features includes two one-dimensional convolutional layers and two maximum pooling layers. The convolution kernel size of the one-dimensional convolutional layer is 3. The data is preprocessed to obtain 93*1 data. The first convolution obtains 91*32 data. The step size of the pooling layer is 2. The data is output to the pooling layer through the convolution layer for dimensionality reduction to obtain 45*32 data. The second convolution operation obtains 43*64 data. The second pooling dimensionality reduction obtains 21*64 data.

[0069] like Figure 3 As shown, the multi-angle adaptive calibration of features includes: the squeezing operation uses global average pooling to generate global statistical information, and uses two fully connected layers and activation functions to adaptively learn the weighted coefficients of the global statistical information. The formula is expressed as:

[0070]

[0071] s=F ex (F sq (x c ),W)=σ(g(z,W))=σ(W2δ(W1))

[0072] Among them, F sq For extrusion operation, F ex To stimulate the operation, z c is the global statistical information, s is the global statistical information z c The weighting coefficient, x c represents the c-th feature with input size H, σ and δ are activation functions sigmoid and ReLU respectively, W1 and W2 are the weights of the first and second fully connected layers respectively, and W is the global weight;

[0073] Furthermore, the multi-head squeeze incentive mechanism MSE uses multiple squeeze incentive mechanisms SE to fit and learn traffic features in parallel. For each SE block, the weighted features are obtained by multiplying the generated weight vector with the original features. The outputs of multiple SE blocks are fused by Concat. The final output formula is expressed as:

[0074] X′=Concat(s 1 X,s 2 X,s 3 X)

[0075] X=[x1,x2,...,x c ]

[0076] Among them, X′ is the final output, s 1 、s 2 and 3 are different weight vectors respectively, and X is the original feature.

[0077] Furthermore, the integrated LSTM-GRU neural network includes a long short-term memory network and a gated neural unit. 21*64 data is obtained from the convolution layer. The data is passed through the long short-term memory network to obtain 21*64 data. A one-dimensional vector with a length of 64 is obtained through the gated neural unit. SoftMax classifier is used for classification. The formula is expressed as follows:

[0078]

[0079] Among them, SoftMax(z) i is the i-th element output by the SoftMax function, Z i is each element in the input data, e is a constant, k is the number of output nodes, and j is the output node index value.

[0080] The SoftMax classifier first performs a linear transformation on the input feature vector and maps it to a real vector. Then, by performing an exponential operation on this real vector, a non-negative vector is obtained. Next, this non-negative vector is normalized so that the sum of the elements in the vector is equal to 1, and a probability distribution is obtained. Finally, the probability distribution is used to determine which category the input belongs to.

[0081] S3: Use the test dataset to perform classification tests on the intrusion detection model trained with the training dataset.

[0082] It should be noted that the intrusion detection model includes building a hierarchical network model through CNN and LSTM-GRU networks to obtain the dynamic characteristics of the data. The data obtained after two convolution calculations and pooling calculations are input into the input layer of the LSTM network. In the LSTM-GRU network, a hidden layer is used to extract features, and a ReLU function is used to activate the operation. A fully connected layer is linked to the GRU output layer.

[0083] After the model is trained, it is tested using the pre-prepared test set. First, the test set data is preprocessed. Except for the unnecessary data enhancement, the preprocessing is the same as the previous processing of the training set, so that the processed data dimension is the same as the training set. Then, the trained model is used for testing, and finally, the accuracy and other evaluation criteria are used to evaluate the efficiency of the model.

[0084] Classification testing helps verify the model's ability to distinguish between different categories (such as normal behavior and various types of attacks). Through testing, the model's accuracy, that is, the proportion of samples that are correctly classified, can be quantified to evaluate the model's effectiveness. By testing on a dataset that was not involved in the training process, the model's ability to handle new and unknown data can be evaluated, which helps ensure that the model not only performs well on the training data, but can also effectively cope with data encountered in actual applications. Classification testing can reveal the model's insufficient performance under specific types of attacks or under specific conditions, providing guidance for further optimization of the model.

[0085] The classification test includes obtaining an n-dimensional vector y after the data features are processed by a neural network, and the formula is expressed as:

[0086]

[0087] Among them, y i is the i-th element in the input vector y;

[0088] Use the SoftMax function to transform the vector into an n-dimensional real vector p. The formula is:

[0089]

[0090] p0+p1+p2+……+p n =1

[0091] Among them, p i is the probability of the i-th category;

[0092] The classification result of the features is determined by the category corresponding to the maximum probability. The classification result is optimized into two classification categories, namely normal data and abnormal data. The SoftMax classifier maps the data features into the probabilities of two categories. p0 represents normal data, p1 represents abnormal data, and p0 + p1 = 1. When p0 > p1, the data is judged as normal data. When p0 < p1, the data is judged as abnormal data;

[0093] When the classification result is normal data, the intrusion detection model has no response;

[0094] When the classification result is abnormal data, the intrusion detection model activates the security protection function of the system, gives a warning to the staff, and notifies the result to the staff's mobile device.

[0095] If the model performs poorly in detecting a certain type of attack, developers can adjust the model or add relevant training data针对性地. By classifying and testing multiple models, their performance under the same conditions can be compared, including indicators such as accuracy, recall rate, and F1 score, which helps developers select or design the most suitable intrusion detection model for specific application requirements. The results of the classification test can be used to adjust the parameters (such as learning rate, regularization term) and structure (such as number of layers, number of neurons) of the model to achieve better performance. This is an iterative process, and the effect of the model is gradually improved through continuous testing and adjustment.

[0096] The above is a schematic solution of an intrusion detection method integrating multiple neural networks in this embodiment. It should be noted that the technical solution of the intrusion detection system integrating multiple neural networks belongs to the same concept as the technical solution of the above-mentioned intrusion detection method integrating multiple neural networks. For the details not described in detail in the technical solution of the intrusion detection system integrating multiple neural networks in this embodiment, reference can be made to the description of the technical solution of the above-mentioned intrusion detection method integrating multiple neural networks.

[0097] The intrusion detection system integrating multiple neural networks in this embodiment includes: a data encoding and standardization module, a WGAN data balancing module, a neural network integration module, and a model classification and testing module;

[0098] The data encoding and standardization module takes the intrusion detection data set as the original data set and performs unified encoding on the original data set;

[0099] The WGAN data balancing module standardizes the encoded data, makes unified processing, and uses the WGAN adversarial generation network to balance the data;

[0100] The neural network integration module integrates CNN and LSTM-GRU after completing the data balancing to form an intrusion detection model and deeply mine key features;

[0101] The model classification test module uses the test data set to perform classification test on the intrusion detection model trained with the training data set.

[0102] This embodiment also provides a computing device, which is applicable to the case of integrating multiple neural network intrusion detection methods, including:

[0103] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0104] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0105] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0106] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0107] Embodiment 2, the second embodiment of the present invention, provides an intrusion detection method integrating multiple neural networks. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0108] The test data set is used to perform classification test on the intrusion detection model trained by the training data set, and the test set is input into the model of the present invention for classification test after preprocessing.

[0109] Table 1 Comparative experimental results

[0110]

[0111]

[0112] It can be seen that in terms of accuracy, the present invention has improved by at least 1.57% over other models; the F1 score of the present invention is also better than that of other models, which is sufficient to show that the present invention has more efficient detection performance.

[0113] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. An intrusion detection method integrating multiple neural networks, characterized in that: include, The intrusion detection data set is used as the original data set, and the original data set is uniformly coded; WGAN is used to generate network balance data, CNN is used to extract data features, multi-head squeeze incentive mechanism MSE is used to perform multi-angle adaptive calibration of features, and LSTM-GRU neural network is integrated to form an intrusion detection model; The test data set is used to perform classification tests on the intrusion detection model trained with the training data set.

2. The intrusion detection method integrating multiple neural networks as claimed in claim 1, characterized in that: The original data set includes network data flow and judgment results of abnormal intrusion behavior; The unified encoding process includes applying one-hot encoding to non-numeric features and mapping them into binary space vectors, which can be expressed as: Among them, F is the value of the data feature, F min is the minimum value of the data eigenvalue, F max is the maximum value of the data eigenvalue, F norm is the normalized value.

3. The intrusion detection method integrating multiple neural networks as claimed in claim 2, characterized in that: The method of using WGAN to counter the generation of network balancing data includes improving WGAN based on GAN and using Earth-Mover distance as the loss function, which is expressed as: Among them, g θ is the generator in WGAN, f w is the discriminator in WGAN, x (i) is the i-th real data, z (i) is the i-th random noise data, Loss c is the loss function of the generator, Loss g is the loss function of the discriminator, m is the number of batch data, and i is the data index value; Use the adversarial learning between the generator and the discriminator to learn minority class features, generate minority class data, and create a new data set; The adversarial learning of the generator and the discriminator includes a generator with 3 linear layers and a discriminator with 3 linear layers. The generator generates random noise virtual data with the same dimension as the real data. The real data and the virtual data are input into the discriminator to judge the authenticity of the data. After the generator training is completed, the number of the largest number of types of data is used as the final number of generated data to obtain a data set with balanced distribution of each type of data.

4. The intrusion detection method integrating multiple neural networks as claimed in claim 3, characterized in that: The method of extracting data features using CNN includes two one-dimensional convolution layers and two maximum pooling layers. The convolution kernel size of the one-dimensional convolution layer is 3. The data is preprocessed to obtain 93*1 data. The first convolution obtains 91*32 data. The step size of the pooling layer is 2. The data is output to the pooling layer through the convolution layer for dimensionality reduction to obtain 45*32 data. The second convolution operation obtains 43*64 data. The second pooling dimensionality reduction obtains 21*64 data. The multi-angle adaptive calibration of features includes: the squeezing operation uses global average pooling to generate global statistical information, and uses two fully connected layers and activation functions to adaptively learn the weighted coefficients of the global statistical information, which is expressed as follows: s=F ex (F sq (x c ),W)=σ(g(z,W))=σ(W2δ(W1)) Among them, F sq For extrusion operation, F ex To stimulate the operation, z c is the global statistical information, s is the global statistical information z c The weighting coefficient, x c represents the c-th feature with input size H, σ and δ are activation functions sigmoid and ReLU respectively, W1 and W2 are the weights of the first and second fully connected layers respectively, and W is the global weight; The multi-head squeeze incentive mechanism MSE uses multiple squeeze incentive mechanisms SE to fit and learn traffic features in parallel. For each SE block, the weighted features are obtained by multiplying the generated weight vector with the original features. The outputs of multiple SE blocks are fused by Concat. The final output formula is expressed as: X′=Concat(s 1 X,s 2 X,s 3 X) X=[x1,x2,...,x c ] Among them, X′ is the final output, s 1 、s 2 and 3 are different weight vectors respectively, and X is the original feature.

5. The intrusion detection method integrating multiple neural networks as claimed in claim 5, characterized in that: The integrated LSTM-GRU neural network includes a long short-term memory network and a gated neural unit. 21*64 data is obtained from the convolution layer. The data is passed through the long short-term memory network to obtain 21*64 data. A one-dimensional vector with a length of 64 is obtained through the gated neural unit. SoftMax classifier is used for classification. The formula is expressed as follows: Among them, SoftMax(z) i is the output data of the SoftMax function, z i is the input data of the SoftMax function, e is a constant, k is the number of output nodes, and j is the output node index value.

6. The intrusion detection method integrating multiple neural networks as claimed in claim 6, characterized in that: The intrusion detection model includes constructing a hierarchical network model through CNN and LSTM-GRU networks to obtain the dynamic characteristics of data. The data obtained after two convolutional calculations and pooling calculations is input into the input layer of the LSTM network. In the LSTM-GRU network, the hidden layer is used to extract features, and the ReLU function is used for activation operations. A fully connected layer is linked to the GRU output layer.

7. The intrusion detection method integrating multiple neural networks as claimed in claim 7, characterized in that: The classification test includes that after the data features are processed by the neural network, an n-dimensional vector y is obtained, which is expressed by the formula Among them, y i is the i-th element in the input vector y; The SoftMax function is used to transform the vector into an n-dimensional real vector p, which is expressed by the formula p0+p1+p2+……+p n =1 Among them, p i is the probability of the i-th category; The classification result of the feature is determined by the category corresponding to the maximum probability. The classification result is optimized into two classification categories, namely normal data and abnormal data. The SoftMax classifier maps the data features into the probabilities of the two categories. p0 is normal data, p1 is abnormal data, and p0 + p1 = 1. When p0 > p1, the data is judged as normal data. When p0 < p1, the data is judged as abnormal data. When the classification result is normal data, the intrusion detection model has no reaction. When the classification result is abnormal data, the intrusion detection model activates the security protection function of the system, gives a warning to the staff, and notifies the result to the mobile device of the staff.

8. The intrusion detection system integrating multiple neural networks as claimed in any one of claims 1 to 8, characterized in that: It includes a data encoding standardization module, a WGAN data balancing module, a neural network integration module, and a model classification test module. The data encoding standardization module uses the intrusion detection data set as the original data set and performs unified encoding on the original data set. The WGAN data balancing module standardizes the encoded data, makes unified processing, and uses the WGAN adversarial generation network to balance the data. The neural network integration module integrates CNN and LSTM-GRU after the data is balanced to form an intrusion detection model for in-depth mining of key features. The model classification test module uses the test data set to perform classification tests on the intrusion detection model trained by the training data set.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, it implements the steps of the method described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the method described in any one of claims 1 to 8.

Images