A network intrusion detection method based on distributed improved raccoon algorithm

Abstract

The present application discloses a network intrusion detection method based on a distributed improved raccoon algorithm, which relates to the field of network security. The method comprises: generating an improved raccoon optimization algorithm based on a Circle chaos mapping method and a Levy flight strategy; extracting intrusion features from an intrusion data set by using the improved raccoon optimization algorithm; optimizing parameters of a target support vector machine based on the improved raccoon optimization algorithm to obtain an optimized support vector machine; training the optimized support vector machine according to the intrusion features to generate a network intrusion recognition model; integrating the network intrusion recognition model on a target Flink platform; obtaining real-time input features based on the improved raccoon optimization algorithm using the integrated target Flink platform; and performing network intrusion detection according to the real-time input features and the network intrusion recognition model.

Description

Technical Field

[0001] The present invention relates to the field of network security, and more specifically, to a network intrusion detection method based on a distributed improved raccoon algorithm. Background Art

[0002] Network intrusion detection system (IDS) is a key component of network security, responsible for monitoring network activities and identifying potential malicious behaviors. However, with the increasing complexity of network environments and the sharp increase in data volume, traditional network intrusion detection systems face multiple challenges that directly affect their effectiveness and efficiency.

[0003] As enterprises and organizations deploy more and more network devices and applications, the dimensions of network traffic data, log files, and other monitoring data naturally increase. The diversity of modern network behaviors means that more features are needed to accurately describe and analyze these behaviors, resulting in an increase in data dimensionality. Many features may provide similar or overlapping information, which not only increases the burden of processing data, but also may interfere with learning algorithms and affect their performance. Network security requires a rapid response. If the time to detect and respond to intrusions is too long, the attacker may have caused irreversible damage. Despite the huge amount of data, computing resources such as processing power and memory are usually limited. Under resource-constrained conditions, processing data with high dimensions and a large number of redundant features will result in prolonged detection time. In order to solve this problem, it is necessary to propose a network intrusion detection method based on the distributed improved raccoon algorithm. Summary of the invention

[0004] A series of simplified concepts are introduced in the Summary of the Invention section, which will be further described in detail in the Detailed Description of the Invention section. The Summary of the Invention section of this application does not mean to attempt to define the key features and essential technical features of the claimed technical solution, nor does it mean to attempt to determine the scope of protection of the claimed technical solution.

[0005] In the first aspect, the present application proposes a network intrusion detection method based on a distributed improved raccoon algorithm, the method comprising:

[0006] An improved raccoon optimization algorithm is generated based on the Circle chaos mapping method and Levy flight strategy;

[0007] The invasion features are extracted from the invasion data set by using the improved raccoon optimization algorithm mentioned above;

[0008] Based on the above improved raccoon optimization algorithm, the parameters of the target support vector machine are optimized to obtain an optimized support vector machine;

[0009] The optimized support vector machine is trained according to the intrusion features to generate a network intrusion recognition model;

[0010] Integrate the above network intrusion identification model on the target Flink platform;

[0011] Use the integrated target Flink platform to obtain real-time input features based on the improved Raccoon optimization algorithm mentioned above;

[0012] Network intrusion detection is performed based on the above real-time input features and the above network intrusion identification model.

[0013] In a feasible implementation manner, the improved raccoon optimization algorithm specifically includes:

[0014] Use the Circle chaos mapping method to initialize the initial population of the algorithm;

[0015] In each generation, the new position update step size is calculated according to the Levy flight strategy;

[0016] Provide perturbation parameters to the current solution through Circle chaos mapping based on fixed period and specific conditions;

[0017] Evaluate the fitness of each individual to determine the individual's survival probability and reproductive efficiency;

[0018] The original raccoon algorithm is optimized based on the initial population, the update step size, the disturbance parameter, the survival probability, and the reproduction efficiency to obtain the improved raccoon optimization algorithm.

[0019] In a feasible implementation manner, the method for determining the above fixed period is:

[0020] Set the initial period based on problem complexity and population size;

[0021] The number and convergence speed of solutions are obtained based on pre-experimental data of different periods;

[0022] Setting a first cycle adjustment parameter by the number of solutions and the convergence speed;

[0023] Setting the second cycle adjustment parameters based on the algorithm operation status and algorithm performance feedback;

[0024] The fixed period is determined based on the initial period, the first period adjustment parameter and the second period adjustment parameter.

[0025] In a feasible implementation, the above-mentioned specific conditions include a fitness stagnation condition, and the above-mentioned fitness stagnation condition is that the change in the optimal fitness for N consecutive generations is less than a preset threshold.

[0026] In a feasible embodiment, the above-mentioned specific conditions also include population diversity conditions, and the above-mentioned population diversity conditions are that the average distance between individuals in the population is lower than a distance threshold and / or the genotype diversity index used is less than an index threshold.

[0027] In a feasible implementation, the above-mentioned specific conditions also include performance evaluation conditions, and the above-mentioned performance evaluation conditions are that the quality of the optimal solution is less than a preset quality, the convergence speed of the algorithm is less than a preset speed, and the change amplitude of the solution is less than a preset amplitude.

[0028] In a feasible implementation, it also includes:

[0029] Obtain intrusion detection scenario information;

[0030] Determine, based on the intrusion detection scenario information, first weight information corresponding to the fitness stagnation condition, second weight information corresponding to the population diversity condition, and third weight information corresponding to the performance evaluation condition;

[0031] Determine a comprehensive specific condition threshold through the fitness stagnation condition, the first weight information, the population diversity condition, the second weight information, the performance evaluation condition and the third weight information;

[0032] When the current condition threshold is greater than the above-mentioned comprehensive specific condition threshold, the above-mentioned disturbance parameter is provided to the current solution through Circle chaotic mapping.

[0033] In a feasible implementation, the above-mentioned extraction of invasion features from the invasion data set by using the above-mentioned improved raccoon optimization algorithm includes:

[0034] The above improved raccoon optimization algorithm is defined as a binary coding algorithm;

[0035] Based on the binary coding algorithm, the above-mentioned intrusion data set is screened for redundant features to obtain the above-mentioned intrusion features.

[0036] In a feasible implementation manner, the above-mentioned parameter optimization of the target support vector machine based on the improved raccoon optimization algorithm to obtain an optimized support vector machine includes:

[0037] Select regularization parameters and kernel function parameters as parameters to be optimized;

[0038] The improved raccoon optimization algorithm population is initialized using Circle chaos mapping, where each individual in the population represents a candidate solution for a set of parameters to be optimized.

[0039] determining a fitness function as a performance parameter;

[0040] In each generation, the Levy flight strategy is used to update the above parameters to be optimized;

[0041] Based on a fixed period and / or specific conditions, the current solution is perturbed using the Circle chaotic map, where the current solution is a specific parameter combination considered by the algorithm during a specific iteration, and the candidate solutions are all possible parameter combinations generated from the entire parameter space during the algorithm initialization phase;

[0042] The best performing individuals are selected according to fitness for reproduction to produce a new generation of solutions;

[0043] Repeat the steps of updating the parameters to be optimized, perturbing the current solution, and generating a new generation of solutions until the performance parameters or the number of iterations meet the termination condition, and determine the optimized parameters;

[0044] The optimized support vector machine is configured based on the optimized parameters.

[0045] In a feasible implementation, the above-mentioned use of the integrated target Flink platform to obtain real-time input features based on the above-mentioned improved raccoon optimization algorithm includes:

[0046] The improved raccoon optimization algorithm is set as a parallel operator based on the Flink distributed parallel computing framework using the integrated target Flink platform;

[0047] Use the NSL-KDD dataset with doubled capacity to simulate massive intrusion detection datasets;

[0048] Based on the above parallel operators, feature selection is performed on the above massive intrusion detection data set to obtain real-time input features.

[0049] In summary, the network intrusion detection method based on the distributed improved raccoon algorithm of the embodiment of the present application includes: generating an improved raccoon optimization algorithm based on the Circle chaos mapping method and the Levy flight strategy; extracting intrusion features from the intrusion data set through the above improved raccoon optimization algorithm; optimizing the parameters of the target support vector machine based on the above improved raccoon optimization algorithm to obtain the optimized support vector machine; training the above optimized support vector machine according to the above intrusion features to generate a network intrusion recognition model; integrating the above network intrusion recognition model on the target Flink platform; obtaining real-time input features based on the above improved raccoon optimization algorithm using the integrated target Flink platform; and performing network intrusion detection according to the above real-time input features and the above network intrusion recognition model. The present application uses the improved raccoon optimization algorithm to extract key features from the intrusion data set, which can effectively reduce the dimension of the data and remove redundant features. This method not only optimizes the training and execution efficiency of subsequent models, but also improves the model processing speed and accuracy, so that the model can respond faster and accurately identify potential threats. The key parameters of the support vector machine, such as the regularization parameter C and the kernel function parameter γ, are accurately optimized by the improved raccoon optimization algorithm. Such optimization ensures that the support vector machine can achieve the highest classification accuracy while maintaining generalization capabilities. Compared with the traditional manual parameter adjustment method, this automated and intelligent parameter optimization method greatly improves the performance of the model and the flexibility of application. The network intrusion identification model is integrated on the high-performance distributed stream processing framework Apache Flink, and real-time network intrusion detection is performed. Compared with traditional centralized processing, Flink's distributed processing capabilities can better cope with large-scale data streams, reduce data processing delays, and improve the real-time nature of detection and the scalability of the system. The entire solution is implemented by optimizing data processing processes and algorithms, which not only improves the efficiency of detection, but also reduces the demand for computing resources. Through intelligent feature selection and parameter optimization, the system can achieve better performance with limited resources, and compared with traditional systems, it can still maintain efficient operation in an environment with limited processing power and memory. This application solution introduces advanced optimization algorithms and machine learning technologies, combined with a powerful distributed processing framework, to provide a more efficient, accurate and responsive solution for the field of network intrusion detection, significantly improving the ability of network security protection.

[0050] The network intrusion detection method based on the distributed improved raccoon algorithm proposed in this application, and other advantages, objectives and features of this application will be partially reflected through the following description, and will also be partially understood by technical personnel in this field through research and practice of this application. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] Various other advantages and benefits will become apparent to those of ordinary skill in the art by reading the detailed description of the preferred embodiments below. The accompanying drawings are only for the purpose of illustrating the preferred embodiments and are not to be considered as limiting the present specification. Also, the same reference symbols are used throughout the accompanying drawings to represent the same components. In the accompanying drawings:

[0052] Figure 1 A schematic diagram of the process of a network intrusion detection method based on a distributed improved raccoon algorithm provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] The terms "first", "second", "third", "fourth", etc. (if any) in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments described herein can be implemented in an order other than that illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices. The technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0054] See also Figure 1 , which is a flow chart of a network intrusion detection method based on a distributed improved raccoon algorithm provided in an embodiment of the present application, which may specifically include:

[0055] S110, Generate an improved raccoon optimization algorithm based on Circle chaos mapping method and Levy flight strategy;

[0056] For example, the improved raccoon optimization algorithm combines Circle chaos mapping and Levy flight strategy. Circle chaos mapping is used to initialize the algorithm population to increase the diversity and randomness of the initial solution, thereby helping the algorithm avoid falling into the local optimal solution. Levy flight strategy is used to enhance the algorithm's exploration ability in the search space, allowing the algorithm to perform long-distance search steps so that it can jump out of the potential local optimal area.

[0057] S120, extracting invasion features from the invasion data set by using the improved raccoon optimization algorithm;

[0058] For example, the improved Raccoon optimization algorithm is used to extract key features from the intrusion detection dataset. The improved Raccoon optimization algorithm determines which features are most effective in distinguishing normal behavior from malicious activities by evaluating the performance of different feature combinations. The dimension of the data is reduced and redundant features are removed, thereby optimizing the training and execution efficiency of subsequent models.

[0059] S130, optimizing the parameters of the target support vector machine based on the improved raccoon optimization algorithm to obtain an optimized support vector machine;

[0060] Exemplarily, the key parameters of the support vector machine are optimized using the improved raccoon optimization algorithm. This includes adjusting the regularization parameter C and kernel function parameter γ of the SVM to ensure that the model can achieve the highest classification accuracy while maintaining generalization ability. The purpose of parameter optimization is to enable the support vector machine to perform the best performance when processing intrusion detection tasks.

[0061] S140, training the optimized support vector machine according to the intrusion features to generate a network intrusion recognition model;

[0062] Exemplarily, the intrusion features extracted from step S120 and the parameters optimized in step S130 are used to train the support vector machine. The SVM model is trained using the training data set so that it can learn how to effectively distinguish normal and abnormal network behaviors based on the selected features.

[0063] S150, integrating the above network intrusion identification model on the target Flink platform;

[0064] For example, the trained network intrusion identification model is deployed on the Apache Flink platform. As a high-performance distributed stream processing framework, Flink allows the model to analyze and process the network data flowing through it in real time, so as to detect and respond to potential intrusion threats in a timely manner.

[0065] S160. Using the integrated target Flink platform to obtain real-time input features based on the improved raccoon optimization algorithm

[0066] Exemplarily, during the operation of the integrated target Flink platform, the improved Raccoon optimization algorithm is used to process the input data stream in real time, extract and update key features in real time, and ensure that the model always uses the most relevant data to make decisions, thereby enhancing the accuracy and timeliness of detection.

[0067] S170: Perform network intrusion detection based on the real-time input features and the network intrusion identification model.

[0068] For example, a model integrated on the Flink platform is used, combined with real-time extracted features, to continuously monitor network activities and identify and report any abnormal or potential intrusion behaviors.

[0069] In summary, the present application uses the improved raccoon optimization algorithm to extract key features from the intrusion data set, which can effectively reduce the dimension of the data and remove redundant features. This method not only optimizes the training and execution efficiency of the subsequent model, but also improves the model processing speed and accuracy, so that the model can respond faster and accurately identify potential threats. The key parameters of the support vector machine, such as the regularization parameter C and the kernel function parameter γ, are precisely optimized by the improved raccoon optimization algorithm. Such optimization ensures that the support vector machine can achieve the highest classification accuracy while maintaining generalization ability. Compared with the traditional manual parameter adjustment method, this automated and intelligent parameter optimization method greatly improves the performance of the model and the flexibility of application. The network intrusion identification model is integrated on the high-performance distributed stream processing framework Apache Flink, and real-time network intrusion detection is performed. Compared with traditional centralized processing, Flink's distributed processing capabilities can better cope with large-scale data streams, reduce data processing delays, and improve the real-time nature of detection and the scalability of the system. The entire solution is implemented by optimizing the data processing process and algorithm, which not only improves the efficiency of detection, but also reduces the demand for computing resources. Through intelligent feature selection and parameter optimization, the system can achieve better performance with limited resources. Compared with traditional systems, it can still maintain efficient operation in an environment with limited processing power and memory. This application scheme introduces advanced optimization algorithms and machine learning technology, combined with a powerful distributed processing framework, to provide a more efficient, accurate and responsive solution for the field of network intrusion detection, significantly improving the ability of network security protection.

[0070] In a feasible implementation manner, the improved raccoon optimization algorithm specifically includes:

[0071] Use the Circle chaos mapping method to initialize the initial population of the algorithm;

[0072] In each generation, the new position update step size is calculated according to the Levy flight strategy;

[0073] Provide perturbation parameters to the current solution through Circle chaos mapping based on fixed period and specific conditions;

[0074] Evaluate the fitness of each individual to determine the individual's survival probability and reproductive efficiency;

[0075] The original raccoon algorithm is optimized based on the initial population, the update step size, the disturbance parameter, the survival probability, and the reproduction efficiency to obtain the improved raccoon optimization algorithm.

[0076] Exemplarily, the purpose of using the Circle chaos mapping method to generate the initial population is to increase the coverage of the solution space and introduce a high degree of randomness to help the algorithm start searching from a wide range of possibilities and reduce the risk of the algorithm relying on initial conditions. When the algorithm starts, a series of random but inherently regular initial solutions are generated through the Circle chaos mapping. These solutions serve as the starting point for the algorithm search, and each solution represents a potential feature combination or parameter setting.

[0077] In each generation, the new position update step is calculated according to the Levy flight strategy. The Levy flight strategy makes the search step have a heavy-tailed distribution, allowing the algorithm to perform long-distance searches, helping to jump out of the local optimal solution and explore a wider solution space. During the algorithm's iteration process, the position update of each individual is not simply adjusted slightly, but a new step is randomly selected according to the Levy distribution, giving the individual the opportunity to make a large-scale "leap".

[0078] Introducing disturbances periodically or based on specific algorithm performance indicators (such as fitness stagnation) aims to increase the diversity of the population and prevent the algorithm from converging to a non-global optimal solution prematurely. For example, by setting a fixed period (such as every 50 generations) or monitoring algorithm performance (such as when the fitness improvement is less than a certain threshold), using Circle chaos mapping to perturb selected individuals to change their search path.

[0079] Fitness evaluation ensures that only the best individuals can reproduce, ensuring that the algorithm evolves towards a better solution. Fitness is usually calculated based on an objective function (such as classification accuracy or error rate). The higher the fitness of an individual, the greater the probability that it will be selected for reproduction in the next generation.

[0080] The original raccoon algorithm is optimized by using the above initial population, update step size, disturbance parameter, survival probability, and reproduction efficiency, and these strategies and parameters are integrated into the raccoon optimization algorithm to form a more robust and efficient optimization framework. These improvements are integrated into the algorithm's iterative process, so that the algorithm can adaptively adjust its behavior and strategy in each generation according to the current environment and performance.

[0081] Through these steps, the improved raccoon optimization algorithm can not only provide a wider search capability and a better ability to escape the local optimal solution in theory, but also can effectively process high-dimensional data and complex feature space and provide high-quality solutions in practical applications such as network intrusion detection.

[0082] In a feasible implementation manner, the method for determining the above fixed period is:

[0083] Set the initial period based on problem complexity and population size;

[0084] The number and convergence speed of solutions are obtained based on pre-experimental data of different periods;

[0085] Setting a first cycle adjustment parameter by the number of solutions and the convergence speed;

[0086] Setting the second cycle adjustment parameters based on the algorithm operation status and algorithm performance feedback;

[0087] The fixed period is determined based on the initial period, the first period adjustment parameter and the second period adjustment parameter.

[0088] Exemplarily, an initial perturbation period is set according to the complexity of the problem and the size of the population. For complex problems or large populations, a longer period may need to be set to allow the algorithm to have enough time to explore the solution space without being disturbed by frequent perturbations. For simpler problems or small populations, the period can be set shorter to speed up the exploration rhythm. Among them, the complexity of the problem can be determined by the dimension of the problem, the size of the solution space, nonlinearity and non-convexity, dependencies and interactions, etc. The population size can be determined by the problem scale, computing resources, and performance requirements of the algorithm.

[0089] By changing the length of the perturbation period, we observe the number of solutions found by the algorithm and the convergence speed under different settings. These experimental data help evaluate the impact of different period lengths on algorithm performance.

[0090] Based on the results of the preliminary experiment, a tuning parameter is set to fine-tune the initial period. If the data shows that a longer period leads to a decrease in the number of solutions or a slow convergence, the period needs to be shortened; otherwise, the period needs to be extended.

[0091] During the actual operation of the algorithm, further cycle adjustments are made based on the operating status and performance feedback. This includes monitoring whether the algorithm frequently falls into local optimality and whether it can effectively escape. Cycle parameters are adjusted based on these real-time feedback to ensure that the algorithm maintains the best balance between exploration and development.

[0092] Combining the initial settings, the adjustment parameters of the first cycle and the second cycle, a fixed cycle that adapts to the current problem and algorithm status is finally determined. This cycle will be used in subsequent algorithm iterations to regularly introduce necessary disturbances to help the algorithm maintain efficient search performance.

[0093] The determination of the fixed period takes into account both theoretical and experimental data support and the dynamic adjustment of the actual operation of the algorithm, thereby optimizing the overall performance of the algorithm and its ability to cope with complex optimization problems. This approach ensures that the algorithm has sufficient flexibility in the process of exploring the global optimal solution, and is not overly restricted by the local optimal solution.

[0094] In a feasible implementation, the above-mentioned specific conditions include a fitness stagnation condition, and the above-mentioned fitness stagnation condition is that the change in the optimal fitness for N consecutive generations is less than a preset threshold.

[0095] For example, the fitness stagnation condition is usually defined as the fitness (or optimization target value) of the optimal solution found by the algorithm changes less than a preset threshold in N consecutive generations (or iterations). This condition helps determine whether the algorithm is trapped in a local optimum and cannot be further improved through the conventional iterative process.

[0096] Consecutive N generations specifies the number of consecutive generations to monitor. The value of N needs to be set based on the complexity of the problem and the characteristics of the algorithm. A larger value of N means that the algorithm will be allowed to make no progress for a longer period of time, while a smaller value of N makes the algorithm more sensitive to stagnation.

[0097] The preset threshold refers to the minimum value of fitness change, which is usually set to a very small positive number. If the fitness difference between the optimal solutions of consecutive N generations is less than this threshold, the algorithm is considered to be stagnant.

[0098] At the end of each generation of the algorithm, the fitness of the current optimal solution is calculated and compared with the optimal fitness of the previous N-1 generations. If the change in the optimal fitness of N consecutive generations is less than the preset threshold, the fitness stagnation condition is triggered, and the current solution is provided with perturbation parameters through the Circle chaos map.

[0099] In a feasible embodiment, the above-mentioned specific conditions also include population diversity conditions, and the above-mentioned population diversity conditions are that the average distance between individuals in the population is lower than a distance threshold and / or the genotype diversity index used is less than an index threshold.

[0100] For example, the average distance between individuals in a population is one of the intuitive ways to measure population diversity. The calculation method is to average the distances between all individuals in the population. The distance can be calculated based on the parameters or genotype of the individual, usually using Euclidean distance or other appropriate distance metrics. Set a threshold. If the calculated average distance is lower than this threshold, it indicates that the individuals in the population are too close, the diversity is reduced, and the algorithm may fall into a local optimal solution prematurely.

[0101] The genotype diversity index is a more complex diversity indicator, usually calculated based on the frequency of different genotypes in the population. The diversity index can be calculated by a variety of methods, such as the Shannon diversity index, which is calculated based on the relative frequency of each genotype in the population. Similarly, an index threshold is set for this genotype diversity index. If the diversity index is lower than this threshold, it indicates that most individuals in the population have similar or identical genotypes and the diversity is insufficient. When the population diversity condition is that the average distance between individuals in the population is lower than the distance threshold and / or the genotype diversity index used is less than the index threshold, the population diversity condition is triggered, and the perturbation parameters are provided to the current solution through the Circle chaos map.

[0102] In a feasible implementation, the above-mentioned specific conditions also include performance evaluation conditions, and the above-mentioned performance evaluation conditions are that the quality of the optimal solution is less than a preset quality, the convergence speed of the algorithm is less than a preset speed, and the change amplitude of the solution is less than a preset amplitude.

[0103] For example, performance evaluation criteria are usually set around the following three core indicators:

[0104] The quality of the optimal solution is the main indicator to measure the performance of an algorithm, which usually refers to the difference between the optimal solution found by the algorithm and the known optimal solution or theoretical optimal solution.

[0105] The convergence rate of an algorithm is the speed at which the algorithm reaches a steady state (i.e., further iterations fail to significantly improve the solution).

[0106] The magnitude of the solution change involves the degree of change of the solution in several consecutive iterations. If the magnitude of the solution change is less than the preset threshold for several consecutive iterations, it may indicate that the algorithm has fallen into a local optimum or stagnant state.

[0107] Set specific thresholds for each of the above indicators. These thresholds are set based on the characteristics of the problem, the design of the algorithm, and the expected performance. For example, the quality of the optimal solution can be set as the percentage difference from the known optimal solution, the convergence speed can be measured by the number of iterations, and the change in the solution can be calculated by the Euclidean distance of the solution vector or other appropriate metrics.

[0108] When the performance evaluation condition, the above performance evaluation condition is that the quality of the optimal solution, the convergence speed of the algorithm and the change amplitude of the solution are less than the preset amplitude, the performance evaluation condition provides a perturbation parameter to the current solution through Circle chaotic mapping.

[0109] In a feasible implementation, it also includes:

[0110] Obtain intrusion detection scenario information;

[0111] Determine, based on the intrusion detection scenario information, first weight information corresponding to the fitness stagnation condition, second weight information corresponding to the population diversity condition, and third weight information corresponding to the performance evaluation condition;

[0112] Determine a comprehensive specific condition threshold through the fitness stagnation condition, the first weight information, the population diversity condition, the second weight information, the performance evaluation condition and the third weight information;

[0113] When the current condition threshold is greater than the above-mentioned comprehensive specific condition threshold, the above-mentioned disturbance parameter is provided to the current solution through Circle chaotic mapping.

[0114] For example, the scenario information related to intrusion detection is collected, which may include the characteristics of network traffic, historical intrusion event data, system security requirements and tolerable risk level, etc. This information helps the algorithm better understand and adapt to its operating environment.

[0115] Determine weights for different optimization conditions based on the collected scenario information. For example: Fitness stagnation condition weight (first weight information): If the scenario data shows frequent and variable intrusion events, it may be necessary to break the stagnation more frequently and increase the weight of this condition. Population diversity condition weight (second weight information): In high-risk or highly dynamic network environments, population diversity is more critical, so the corresponding weight may need to be increased to maintain the algorithm's exploration capabilities. Performance evaluation condition weight (third weight information): In performance-sensitive application scenarios, such as real-time systems, the weight of performance evaluation should be higher to ensure that the algorithm responds to changes quickly and effectively.

[0116] Using the weight information determined above, a comprehensive threshold value for a specific condition is calculated. This threshold value comprehensively considers multiple aspects of the algorithm performance and can be expressed by a weighted formula, such as:

[0117] Comprehensive threshold = w1×fitness stagnation condition + w2×population diversity condition + w3×performance evaluation condition, where w1, w2, and w3 are the weights of the corresponding conditions respectively.

[0118] In each iteration of the algorithm, the current condition threshold is calculated and compared with the preset comprehensive specific condition threshold. If the current condition threshold is greater than the comprehensive threshold, it means that the algorithm may need to be adjusted to avoid performance degradation or local optimality. At this time, Circle chaos mapping is applied to provide perturbations for the current solution, which helps the algorithm jump out of the possible local optimal state and regain the opportunity to explore new areas.

[0119] In a feasible implementation, the above-mentioned extraction of invasion features from the invasion data set by using the above-mentioned improved raccoon optimization algorithm includes:

[0120] The above improved raccoon optimization algorithm is defined as a binary coding algorithm;

[0121] Based on the binary coding algorithm, the above-mentioned intrusion data set is screened for redundant features to obtain the above-mentioned intrusion features.

[0122] For example, in this strategy, each feature is represented as a binary bit. This means that each feature has two possible states: selected (1) and unselected (0). The individual or solution of the improved raccoon optimization algorithm consists of a series of such binary bits, each corresponding to a feature in the data set. At the beginning of the algorithm, a series of such binary strings are randomly generated as the initial population. Each string represents a set of possible feature combinations.

[0123] The fitness function is the key to evaluating the quality of each feature combination. This usually involves training a classifier (such as SVM, decision tree, etc.) using the selected features (1 in binary encoding) and evaluating its performance on the validation set. Fitness can be based on classification accuracy, F1 score, or other related metrics. A new generation is generated from the current population through the core operations of genetic algorithms such as crossover and mutation. The crossover operation allows two solutions to merge some of their features, and the mutation operation randomly changes the selected state of certain features, which helps to explore new feature combinations. Based on the results of the fitness function, the best performing individuals are selected as candidates for the next generation. This process ensures that the algorithm gradually focuses on the most effective feature combination. The above process is repeated until the stopping condition is met, such as reaching the maximum number of iterations or stagnating fitness progress. The final selected feature set is considered to be the most useful feature for intrusion detection.

[0124] In a feasible implementation manner, the above-mentioned parameter optimization of the target support vector machine based on the improved raccoon optimization algorithm to obtain an optimized support vector machine includes:

[0125] Select regularization parameters and kernel function parameters as parameters to be optimized;

[0126] The improved raccoon optimization algorithm population is initialized using Circle chaos mapping, where each individual in the population represents a candidate solution for a set of parameters to be optimized.

[0127] determining a fitness function as a performance parameter;

[0128] In each generation, the Levy flight strategy is used to update the above parameters to be optimized;

[0129] Based on a fixed period and / or specific conditions, the current solution is perturbed using the Circle chaotic map, where the current solution is a specific parameter combination considered by the algorithm during a specific iteration, and the candidate solutions are all possible parameter combinations generated from the entire parameter space during the algorithm initialization phase;

[0130] The best performing individuals are selected according to fitness for reproduction to produce a new generation of solutions;

[0131] Repeat the steps of updating the parameters to be optimized, perturbing the current solution, and generating a new generation of solutions until the performance parameters or the number of iterations meet the termination condition, and determine the optimized parameters;

[0132] The optimized support vector machine is configured based on the optimized parameters.

[0133] For example, the regularization parameter (C) controls the misclassification tolerance of the SVM, a smaller C value increases the possibility of misclassification, and a larger C value may lead to overfitting.

[0134] Kernel function parameter (γ) When using the radial basis function (RBF) kernel, the γ parameter affects the smoothness of the decision boundary, thereby affecting the generalization ability of the model.

[0135] Circle chaos mapping is used to initialize the parameter values ​​of each individual in the population. Increasing the diversity of the initial population allows the algorithm to start from a broad search space.

[0136] The classification performance of SVM is usually used as the fitness function. The effectiveness of each parameter combination can be evaluated by using performance indicators such as cross-validation accuracy and F1 score.

[0137] In each generation of the algorithm, the parameters to be optimized are updated through the Levy flight strategy. This strategy enables parameter updates to perform long-distance jumps, which helps the algorithm to jump out of the local optimal solution and explore a wider solution space.

[0138] Based on a fixed period or specific algorithm running conditions (such as fitness stagnation), the Circle chaos map is used to perturb the current solution to increase the diversity of the population and prevent the algorithm from converging prematurely.

[0139] The best performing individuals are selected based on fitness, and a new generation of solutions is generated through crossover and mutation operations in the genetic algorithm. This ensures that high-performance solutions can be retained and optimized.

[0140] Repeat the steps of updating the parameters to be optimized, perturbing the current solution and generating a new generation of solutions until the performance parameters reach the preset accuracy requirements or the number of iterations reaches the preset number. At this time, the termination condition is met and the optimal parameter set at this time is regarded as the final configuration of the SVM.

[0141] Use the found optimal parameters to configure the support vector machine. These parameters will be used in the actual intrusion detection task, where the SVM model needs to perform the classification task based on these optimized parameters.

[0142] In some examples, the integrated target Flink platform is used to obtain real-time input features based on the improved raccoon optimization algorithm, including:

[0143] Using the integrated target Flink platform, the improved raccoon optimization algorithm is set as a parallel operator based on the Flink distributed parallel computing framework;

[0144] Use the NSL-KDD dataset with doubled capacity to simulate massive intrusion detection datasets;

[0145] Based on the above parallel operators, feature selection is performed on the above massive intrusion detection data set to obtain real-time input features.

[0146] For example, in the integrated target Flink, the Improved Raccoon Optimization Algorithm (ICOA) is designed as one or more parallel operators. Each component of ICOA, such as initialization, fitness evaluation, parameter update, etc., can run in parallel in Flink's distributed environment. In this way, ICOA can use Flink's distributed computing capabilities to perform parallel processing on different data partitions, thereby accelerating the entire optimization process.

[0147] In order to simulate a massive data environment and test the performance of ICOA in this environment, the scale of the NSL-KDD dataset is increased using the doubling method. NSL-KDD is a widely used network intrusion detection dataset. By duplicating the records in the dataset, the data scale can be artificially increased to achieve the effect of a massive dataset.

[0148] On the Flink platform, the ICOA parallel operator is used to perform real-time feature selection on the expanded NSL-KDD dataset. The ICOA operator analyzes the features in the dataset, evaluates the contribution of each feature to the intrusion detection model, and selects the most informative features.

[0149] The ICOA operator not only selects features, but also updates the results of feature selection in real time. As the data stream continues to be input, the operator can dynamically adjust the selected features to adapt to new patterns or changes that may appear in the data.

[0150] By leveraging Flink’s high-performance processing capabilities and ICOA’s optimization capabilities, we can effectively process and analyze massive amounts of network data, and promptly detect and respond to intrusion threats. This approach not only improves the efficiency and accuracy of intrusion detection, but also adapts to the needs of dynamic data changes.

[0151] The above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A network intrusion detection method based on a distributed improved raccoon algorithm, characterized in that: include: An improved raccoon optimization algorithm is generated based on the Circle chaos mapping method and Levy flight strategy; Extracting invasion features from the invasion data set by using the improved raccoon optimization algorithm; Optimizing the parameters of the target support vector machine based on the improved raccoon optimization algorithm to obtain an optimized support vector machine; Training the optimized support vector machine according to the intrusion features to generate a network intrusion recognition model; Integrate the network intrusion identification model on the target Flink platform; Using the integrated target Flink platform to obtain real-time input features based on the improved raccoon optimization algorithm; Performing network intrusion detection according to the real-time input features and the network intrusion identification model; The improved raccoon optimization algorithm specifically includes: Use the Circle chaos mapping method to initialize the initial population of the algorithm; In each generation, the new position update step size is calculated according to the Levy flight strategy; Provide perturbation parameters to the current solution through Circle chaos mapping based on fixed period and specific conditions; Evaluate the fitness of each individual to determine the individual's survival probability and reproductive efficiency; The original raccoon algorithm is optimized based on the initial population, the update step size, the disturbance parameter, the survival probability, and the reproduction efficiency to obtain the improved raccoon optimization algorithm.

2. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 1 is characterized in that: The method for determining the fixed period is: Set the initial period based on problem complexity and population size; The number and convergence speed of solutions are obtained based on pre-experimental data of different periods; Setting a first cycle adjustment parameter according to the number of solutions and the convergence speed; Setting the second cycle adjustment parameters based on the algorithm operation status and algorithm performance feedback; The fixed period is determined based on the initial period, the first period adjustment parameter, and the second period adjustment parameter.

3. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 1 is characterized in that: The specific conditions include a fitness stagnation condition, where the fitness stagnation condition is that the change in the optimal fitness for N consecutive generations is less than a preset threshold.

4. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 2 is characterized in that: The specific conditions also include a population diversity condition, where the population diversity condition is that the average distance between individuals in the population is lower than a distance threshold and / or the genotype diversity index used is less than an index threshold.

5. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 4 is characterized in that: The specific conditions also include performance evaluation conditions, where the quality of the optimal solution is less than a preset quality, the convergence speed of the algorithm is less than a preset speed, and the change amplitude of the solution is less than a preset amplitude.

6. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 5 is characterized in that: Also includes: Obtain intrusion detection scenario information; Determine, based on the intrusion detection scenario information, first weight information corresponding to the fitness stagnation condition, second weight information corresponding to the population diversity condition, and third weight information corresponding to the performance evaluation condition; Determine a comprehensive specific condition threshold value through the fitness stagnation condition, the first weight information, the population diversity condition, the second weight information, the performance evaluation condition and the third weight information; When the current condition threshold is greater than the comprehensive specific condition threshold, the disturbance parameter is provided to the current solution through Circle chaos mapping.

7. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 1 is characterized in that: The step of extracting invasion features from an invasion data set by using the improved raccoon optimization algorithm comprises: Defining the improved raccoon optimization algorithm as a binary coding algorithm; Redundant feature screening is performed on the intrusion data set based on the binary coding algorithm to obtain the intrusion feature.

8. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 1 is characterized in that: The step of optimizing parameters of a target support vector machine based on the improved raccoon optimization algorithm to obtain an optimized support vector machine includes: Select regularization parameters and kernel function parameters as parameters to be optimized; The improved raccoon optimization algorithm population is initialized using Circle chaos mapping, where each individual in the population represents a candidate solution for a set of parameters to be optimized. determining a fitness function as a performance parameter; In each generation, the parameters to be optimized are updated using the Levy flight strategy; Based on a fixed period and / or specific conditions, the current solution is disturbed by using Circle chaotic mapping, wherein the current solution is a specific parameter combination considered by the algorithm in a specific iteration process, and the candidate solution is all possible parameter combinations generated from the entire parameter space in the initialization phase of the algorithm; The best performing individuals are selected according to fitness for reproduction to produce a new generation of solutions; Repeat the steps of updating the parameters to be optimized, perturbing the current solution, and generating a new generation of solutions until the performance parameters or the number of iterations meet the termination condition, and determine the optimized parameters; The optimized support vector machine is configured based on the optimized parameters.

9. The network intrusion detection method based on the distributed improved raccoon algorithm according to claim 1 is characterized in that: The method of using the integrated target Flink platform to obtain real-time input features based on the improved raccoon optimization algorithm includes: Using the integrated target Flink platform and based on the Flink distributed parallel computing framework, the improved raccoon optimization algorithm is set as a parallel operator; Use the NSL-KDD dataset with doubled capacity to simulate massive intrusion detection datasets; Feature selection is performed on the massive intrusion detection data set based on the parallel operator to obtain real-time input features.

Images