Underwater acoustic communication intrusion detection method and system based on CNN-LSTM

Abstract

The invention relates to an underwater acoustic communication intrusion detection method and system based on CNN-LSTM. The method comprises the following steps: constructing an underwater sensor network intrusion attack system consisting of a routing layer, an MAC (Media Access Control) layer and a physical layer on the basis of an underwater communication node, a relay node and a shore-based communication server; performing simulation attack on the underwater sensor network based on the intrusion attack system, and collecting attack data in the underwater sensor network in real time; performing iteration and intrusion detection in the improved CNN-LSTM fusion model to obtain a target CNN-LSTM fusion model for underwater acoustic communication intrusion detection; the improved CNN-LSTM fusion model is a CNN model and an LSTM model which are connected through an intermediate layer component. The intrusion of the network layer and the abnormal attacks of the MAC layer and the physical layer are considered, and intrusion detection is performed through the improved CNN-LSTM fusion model, so that the detection capability of the model on various network attacks is improved, and the underwater acoustic communication intrusion detection precision is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of underwater acoustic network communication, and in particular to an underwater acoustic communication intrusion detection method and system based on CNN-LSTM. Background Art

[0002] In recent years, with the increasing global attention to marine national defense security, the marine field has risen to the core of international strategic competition. Marine underwater network security plays a unique role in the national defense of my country's strategic locations. Underwater sensor networks (UWSNs) face many threats such as deep sea noise, frequency shift, bit error, propagation delay, channel openness, and multipath effects during deployment, which increase the risk of network attacks and interference. In order to maintain the stability of marine communications and network security, anomaly detection has become a sharp weapon. Existing research mainly focuses on intrusion detection and identification at the network layer, ignoring the problems of abnormal attacks and low detection indicators at the MAC layer and physical layer.

[0003] Therefore, the traditional underwater acoustic communication intrusion detection method has the problem of low intrusion detection accuracy because it is aimed at intrusion detection and identification at the network layer. Summary of the invention

[0004] Based on this, in order to solve the above technical problems, a method and system for underwater acoustic communication intrusion detection based on CNN-LSTM is provided, which can improve the accuracy of underwater acoustic communication intrusion detection.

[0005] A method for underwater acoustic communication intrusion detection based on CNN-LSTM, the method comprising:

[0006] Based on underwater communication nodes, relay nodes, and shore-based communication servers, an underwater sensor network intrusion attack system consisting of a routing layer, a MAC layer, and a physical layer is constructed, and the underwater sensor network with shore-based communication server equipment is simulated through the attack system;

[0007] Based on the intrusion attack system, a simulated attack is performed on the underwater sensor network, the attack data in the underwater sensor network is collected in real time, and the attack data is processed by using the FFT algorithm and the sliding window mechanism to obtain an attack data set; a communication transmission data set across the physical layer, the MAC layer and the routing layer is constructed;

[0008] Input the attack data set and the transmission data set into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model;

[0009] Perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model, and output the underwater acoustic communication intrusion detection result;

[0010] Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

[0011] In one embodiment, the method further comprises:

[0012] Get various evaluation indicators;

[0013] According to each of the evaluation indicators, tracking the change of verification loss during the training phase of the target CNN-LSTM fusion model;

[0014] Based on the loss change, the performance of the target CNN-LSTM fusion model is evaluated to obtain an evaluation result.

[0015] In one embodiment, the evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

[0016] In one embodiment, the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM;

[0017] The method further comprises:

[0018] Collecting water test data, and inputting the water test data into the improved CNN-LSTM fusion model;

[0019] Extracting features of the water test data through the CNN part in the improved CNN-LSTM fusion model, and performing data processing on the extracted features to obtain processed time series data;

[0020] The time series data is trained and processed through the LSTM part in the improved CNN-LSTM fusion model, and the detection results in the training process are output.

[0021] In one of the embodiments, in the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function construction;

[0022] The LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and a cross entropy loss function is used as a model evaluation indicator.

[0023] In one embodiment, the training process of the improved CNN-LSTM fusion model includes:

[0024] Obtain and preprocess the ocean dataset, convert the data type of the processed ocean dataset, and generate the target dataset;

[0025] Inputting the target data set into a classification recognition model, classifying the elements in the target data set and assigning data labels to obtain an input data set;

[0026] The input data set is divided into a training set, a validation set and a test set, and the improved CNN-LSTM fusion model is trained based on the training set, the validation set and the test set.

[0027] In one embodiment, obtaining an ocean data set and preprocessing it, converting the data type of the processed ocean data set to generate a target data set, includes:

[0028] Acquire an ocean data set, perform denoising on the ocean data set, and fill in empty value cells in the ocean data set to obtain a processed ocean data set;

[0029] The cell contents in the processed ocean data set are converted into text format, and the category data are mapped to fixed numerical values ​​to generate a target data set.

[0030] In one embodiment, the target data set is input into a classification recognition model, and the elements in the target data set are classified and assigned data labels to obtain an input data set, including:

[0031] Inputting the target data set into a classification recognition model, and identifying normal data and abnormal data through the classification recognition model;

[0032] The normal data is assigned a normal value label and the abnormal data is assigned an abnormal sample label by using the classification recognition model;

[0033] Normal data with normal numerical labels and abnormal data with abnormal sample labels are used as input data sets.

[0034] In one embodiment, the attack data set and the transmission data set are input into an improved CNN-LSTM fusion model for iteration and intrusion detection, including:

[0035] Searching for data carrying the abnormal sample label from the attack data set as abnormal attack data, and searching for data carrying the normal value label from the transmission data set as normal transmission data;

[0036] The abnormal attack data and the normal transmission data are input into the improved CNN-LSTM fusion model, and the improved CNN-LSTM fusion model is used for iteration.

[0037] A CNN-LSTM-based underwater acoustic communication intrusion detection system, the system comprising:

[0038] The attack system establishment module is used to build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and simulate an underwater sensor network with shore-based communication server equipment through the attack system;

[0039] A simulated attack module is used to simulate an attack on the underwater sensor network based on the intrusion attack system, collect attack data in the underwater sensor network in real time, and process the attack data using an FFT algorithm and a sliding window mechanism to obtain an attack data set; and construct a communication transmission data set across the physical layer, MAC layer, and routing layer;

[0040] A model optimization module, used for inputting the attack data set and the transmission data set into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjusting and optimizing the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model;

[0041] A detection module, used for performing underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and outputting underwater acoustic communication intrusion detection results;

[0042] Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

[0043] The above-mentioned underwater acoustic communication intrusion detection method and system based on CNN-LSTM constructs an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer, and conducts simulated attacks to collect attack data. Since the intrusion of the network layer and the abnormal attacks of the MAC layer and the physical layer are taken into consideration, the efficiency and convenience of collecting attack data can be improved; the CNN and LSTM models are connected through the intermediate layer components to obtain an improved CNN-LSTM fusion model, which uses CNN for feature extraction and LSTM for processing time series data, thereby improving the model's detection ability for various network attacks, thereby improving the accuracy of underwater acoustic communication intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1 This is an application environment diagram of an underwater acoustic communication intrusion detection method based on CNN-LSTM in one embodiment;

[0045] Figure 2A schematic diagram of a flow chart of an underwater acoustic communication intrusion detection method based on CNN-LSTM in an embodiment;

[0046] Figure 3 A schematic diagram of a cross-layer intrusion detection solution for an underwater sensor network in an embodiment;

[0047] Figure 4 A schematic diagram of an improved CNN-LSTM fusion model architecture in an embodiment;

[0048] Figure 5 It is a flowchart of the experimental process of an underwater acoustic communication intrusion detection method based on CNN-LSTM in an embodiment;

[0049] Figure 6 It is a structural block diagram of an underwater acoustic communication intrusion detection system based on CNN-LSTM in one embodiment;

[0050] Figure 7 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0052] The underwater acoustic communication intrusion detection method based on CNN-LSTM provided in the embodiment of the present application can be applied to Figure 1 In the application environment shown. Figure 1As shown, the application environment includes a computer device 110. The computer device 110 can build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and simulate an underwater sensor network with shore-based communication server devices through the attack system; the computer device 110 can simulate attacks on the underwater sensor network based on the intrusion attack system, collect attack data in the underwater sensor network in real time, and use FFT algorithm and sliding window mechanism to process the attack data to obtain an attack data set; build a communication transmission data set across the physical layer, MAC layer, and routing layer; the computer device 110 can convert the attack data set, transmission data set, and physical layer into a single data set; The data set is input into the improved CNN-LSTM fusion model for iteration and intrusion detection, and the improved CNN-LSTM fusion model is adjusted and optimized according to the output result to obtain the target CNN-LSTM fusion model; the computer device 110 can perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and output the underwater acoustic communication intrusion detection result; wherein the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through the intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the full connection layer and the softmax layer. Among them, the computer device 110 can be, but is not limited to, various personal computers, laptops, smart phones, robots and other devices.

[0053] In one embodiment, Figure 2 As shown, a method for underwater acoustic communication intrusion detection based on CNN-LSTM is provided, including the following steps:

[0054] Step 202, based on underwater communication nodes, relay nodes, and shore-based communication servers, an underwater sensor network intrusion attack system consisting of a routing layer, a MAC layer, and a physical layer is constructed, and the underwater sensor network with shore-based communication server equipment is simulated through the attack system.

[0055] To address the problem of abnormal attack detection on a single routing layer, we can build an underwater sensor network intrusion attack system based on underwater networking equipment such as underwater communication nodes, relay nodes, and shore-based communication servers, which consists of a routing layer, a MAC layer, and a physical layer.

[0056] Next, the attack system can simulate underwater networking with shore-based server equipment, and perform underwater acoustic replay attacks, MAC attacks, and cross-node server malicious attacks by setting attack transmission protocols. Specifically, for the principle construction and experimental environment field construction of the cross-layer intrusion detection scheme in the ocean underwater acoustic transmission protocol stack and the experimental effect of the ocean underwater sensor network networking, the prototype model construction and testing in this embodiment are mainly built into three sets of underwater sensor network physical layer sound signal transmission attack systems through GPD single-chip microcomputer chip development board and audio power amplifier equipment and audio power chip transceiver devices, one set of equipment is used as the sender device of underwater transmission sound signals, another set of equipment is used as the receiver device of underwater transmission sound signals, and the last set of equipment is used as the attacker device of underwater transmission sound signals. As the initiator of attack data, certain attack data signals can be set through computer equipment to disrupt and confuse normal underwater sensor network data transmission.

[0057] In this embodiment, by building a prototype attack system of the receiver, sender, and attacker, normal communication data and abnormal transmission data are collected and transmitted, and the normal data and abnormal data streams transmitted at the bottom physical layer are sorted out, and encapsulated and transmitted to the MAC layer and routing layer in the underwater sensor network protocol stack, thereby forming cross-layer data transmitted from the bottom physical layer to the upper layer as part of the overall data set. There is no need for manual real-time collection and analysis of ocean hydroacoustic data, which improves the efficiency of hydroacoustic communication intrusion detection.

[0058] Among them, a preliminary plan for underwater acoustic network physical layer data transmission and collection was built to implement the underwater acoustic network prototype system, which was feasible after experimental verification. The underwater acoustic communication prototype is based on components such as GPD microcontroller development board, audio power amplifier, voice module, and audio power chip transceiver. A three-node underwater sensor network acoustic signal transmission system is built. The system is divided into three parts: one part acts as the transmitter of the sound signal, the other part as the receiver, and the third part is designed as the attack end, which is used to launch attack signals to interfere with and confuse the standard underwater sensor network data transmission process. The construction and testing of the underwater acoustic communication prototype is mainly aimed at experimentally verifying the feasibility and efficiency of the physical layer data communication and collection mechanism, verifying the next step of the communication machine, receiver and jamming equipment, and exploring potential security vulnerabilities and their impact on marine underwater acoustic networking.

[0059] Through the physical layer prototype model detection scheme, three sets of hardware transceiver equipment and attack equipment are constructed to verify the feasibility of data and the feasibility of the attack collection experiment of physical layer sound signals. In order to collect real transmission data in a large-scale equipment test field in the marine underwater sensor network, the physical layer data transmission experiment of the prototype equipment is carried out in the school waters. The prototype equipment is embedded with a PDB6016 microcomputer chip. The chip is a SOP16 package and is designed to serve the system on chip (SoC). It integrates a CPU8051 microprocessor, a USB interface, a design without an external crystal oscillator, a dual-channel high-resolution DAC (24 bits) and a mono ADC (16 bits) suitable for personal computers. In the hardware device, an audio power amplifier chip model 8002A is welded on the PDB6016B chip. It is a class AB, mono, bridge-type power amplifier with shutdown mode. The feature of 8002A is that it can achieve high-quality audio output without a large number of peripherals, and its SOP package makes it particularly suitable for low-power portable devices. At the same time, the WT588D voice sampling module is welded, which supports SPI-Flash with a capacity of 2Mbit-32Mbit; it has a 13Bit / DA converter and 12Bit / PWM audio processing inside, supports 6K-22KHz WAV audio; it has two output modes of DAC / PWM; it can load up to 500 segments of voice signals for editing. It can maximize the functions of the WT588D voice module; it can insert silence at will, and the silence time range is 10ms-25min, which can be used to simulate malicious generalized attack methods such as delayed attacks and signal repetition recognition in ocean water sound.

[0060] The physical layer prototype device design and implementation uses Altium Designer 2023 for PCB circuit design and plate making, unified wiring package pin design, PCB board making and polishing, and finally the development board chip and sensor welding and serial port debugging and design code burning; the physical layer prototype device design and implementation uses PCB main chip board and SMD capacitors of different specifications, a total of 10 soldered on the main board, four SMD resistors, 3 8002A audio sampling modules, 3 USB-A SMD USB driver-free amplifiers, 3 16-pin PDB6016 audio sound signal modules, 3 WT588D voice modules, 3 4 ohm 2W waterproof full diffusion speakers, among which the waterproof speaker supports sampling sound and diffusion in underwater environment, several 28AWG waterproof audio cables, and finally the shell is packaged in the same way.

[0061] In underwater sensor networks, the underwater acoustic communication system converts information such as text, voice and images into electrical signals, which are then digitized through an encoder; the converted electrical signals are converted into acoustic signals by the transducer and propagate through the water medium to reach the receiving end; the receiving transducer then converts the acoustic signals back into electrical signals, which are interpreted by the electrical receiver as sound, text and image information. This process relies on the principle of sound generation, that is, the vibration of objects. In the marine environment, the medium for information transmission changes from air to seawater, which involves a special sending and receiving device, namely the underwater acoustic transducer, to achieve the mutual conversion of acoustic energy and electrical energy, so as to transmit and receive acoustic signals of diverse frequencies and intensities in different media, thereby achieving data reception and transmission.

[0062] The experiment used the above three sets of the same underwater acoustic physical layer prototype equipment and connected them with three mobile personal PCs. Three experimental objects were set respectively, namely the speak data sender, the listen data receiver, and the hark malicious attacker. The equipment was tested in an underwater environment. After the sample was set, the listen receiver interface was opened first, and then the speak sender was opened to wait for synchronization. The hark attack was used for interference. The established attack sample value was used to simulate the attacker transmitting abnormal data. The other two devices were modulated for receiving collection and decoding processing. The PC was used to collect malicious attack data and normal transmission data.

[0063] The cross-layer communication acquisition test uses a prototype device to capture the hydroacoustic signal of the physical layer and its received signal, and then further processes the data and data packets generated by the physical layer through the modulation and demodulation process. On this basis, a comprehensive attack simulation range including the physical layer, media access control (MAC) layer and routing layer is established in the KaliLinux environment. The range aims to capture and store the data transmitted in this cross-layer system through packet capture tools to achieve comprehensive collection and recording of data flows. Three personal computers (PCs) with the same configuration are deployed as hardware platforms. At the physical layer, data is transmitted using external ports, and then packaged and transmitted through the upper layer protocol stack. By using the Kali Linux attack tool, attack traffic targeting the MAC layer and malicious traffic for text injection into the routing layer are designed to simulate attacks. Using Wireshark, a widely used network packet analysis software, as a data acquisition tool, by combining the Wireshark tool in the Kali Linux environment, a cross-physical layer, MAC layer and routing layer attack simulation range is successfully built, which can not only simulate and attack normal and abnormal data flows, but also capture, analyze and store transmissions.

[0064] Underwater acoustic communication systems are designed for underwater information exchange, and information is transmitted through the propagation of sound waves in water. The main processes include data encoding, signal modulation, sound wave emission and propagation, signal reception and demodulation. First, the information text, data set or sound is converted into an electrical signal, relying on digital signal processing technology, including sampling, quantization and encoding; then, the electrical signal is modulated, and various technologies such as FM, PM, AM, OFDM and PSK are used to adjust the characteristics of the signal to adapt to the water medium propagation and reduce interference; the modulated signal is converted into sound waves through the transducer, and when it propagates in water, it will encounter challenges such as attenuation, multipath effect, environmental noise and Doppler effect. The transducer at the receiving end receives the sound wave, converts it back into an electrical signal, and then demodulates and demodulates it.

[0065] Fast Fourier Transform (FFT), an algorithmically extremely efficient implementation mechanism of Discrete Fourier Transform (DFT), plays a vital role in the field of underwater acoustic communications and provides a core technical foundation for the analysis and optimization of signal transmission processes.

[0066] The prototype equipment was used to conduct preliminary verification of the acquisition of physical layer underwater acoustic signal transmission, and the simulation of replay attack and sending delay attack was performed at the physical layer. This work aims to collect and analyze the normal signal waveform and malicious interference signal waveform of physical layer transmission on a large scale. Preliminary experimental results show that in order to obtain more realistic and effective data tests and evaluate the underwater communication detection performance under real sea conditions, a comprehensive underwater sensor network equipment was deployed in the target sea area using the system architecture design of the real sea underwater acoustic communication detection scheme. The communication experiment sets the underwater sensor network and communication equipment at different distances. In order to obtain real data under control variables, the design includes data collection of underwater acoustic communication at the same depth but at different distances. Such a deployment strategy aims to collect real data sets that can be used for analysis by precisely controlling experimental variables. Specifically, the focus is on evaluating the underwater acoustic communication system in the face of physical layer attacks, mainly replay attacks, delay attacks, and frequency band interference attacks, as well as MAC attacks and ARP attacks received when the physical layer data is transmitted to the upper layer protocol stack, transmitted to the shore-based and central service nodes, and receiving devices containing server nodes, as well as text attacks on the routing layer, and transmission collection is performed at the same time to improve the training and detection of the model. In addition, the system will also evaluate the transmission efficiency and accuracy of normal signals and interference signals in actual sea environments.

[0067] Step 204, based on the intrusion attack system, simulate the attack on the underwater sensor network, collect the attack data in the underwater sensor network in real time, and use the FFT algorithm and sliding window mechanism to process the attack data to obtain an attack data set; construct a communication transmission data set across the physical layer, MAC layer and routing layer.

[0068] The constructed attack system can simulate attacks on underwater sensor networks and collect attack data in underwater sensor networks in real time. Specifically, the attack system can provide a large amount of real-time attack data for the improved CNN-LSTM fusion model to quickly improve the number of model iterations and detection performance. By collecting attack data in real time, an attack data set is constructed, and then the communication transmission data set across the physical layer, MAC layer, and routing layer is constructed. On the basis of attacking the underwater sensor network, the attack data set and the transmission data set are used as the data drive of the improved CNN-LSTM fusion model, so as to train and adjust the model and improve the detection accuracy of the model.

[0069] When conducting a simulated attack, Figure 3 As shown, the data is first sampled, and the data set is reconstructed according to the sampled data. The upper-layer device transmission is continued through the collected physical layer signal, and normal communication data and abnormal transmission data are transmitted in the protocol stack. The normal data and abnormal data streams transmitted at the bottom of the physical layer are sorted out, and encapsulated and transmitted to the MAC layer and routing layer in the underwater sensor network protocol stack. The receiving device in the upper-layer protocol stack and the shore-based node with server function are continued to be detected, and the transmission data is sampled. The cross-layer data transmitted from the bottom physical layer to the upper layer is used as part of the overall data set.

[0070] Data processing is to decode and analyze the data collected from the underwater acoustic communication machine and the data from the communication board to obtain a large number of time series of underwater acoustic time domain diagrams. It is a typical time series data and plays an indispensable role in ocean underwater acoustic transmission. Here, the time series of ocean underwater acoustic transmission data is input into the rule tool of data through the sliding window mechanism. The sliding window mechanism can transform the time series into regular segmented window data. The sequence reconstruction method based on the sliding window mechanism has become an efficient data processing method. By systematically segmenting and reorganizing the original time series data, defining the scale of the sliding window and the scale of the window movement, the moving window is traversed and intercepted in sequence until the entire time series set is traversed. The processed Ocean-100m-16fsk-200VOL, Ocean-150m-16fsk-200VOL, and Ocean-200m-16fsk-200VOL three ocean water test data sets are obtained in sequence. The sliding window sequence reconstruction method has great practical value and convenience in the application of time series analysis and prediction due to its simplicity. It can provide a label set for complex time series analysis, effectively extract the time series features contained in the data, and lay the foundation for subsequent intrusion detection.

[0071] Step 206, input the attack data set and the transmission data set into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain the target CNN-LSTM fusion model.

[0072] like Figure 3 As shown in the figure, the proposed improved CNN-LSTM fusion model is used to lay out the ocean communication data transceiver equipment at different distances in sequence through the cross-layer intrusion detection solution architecture of the underwater acoustic protocol stack. The Ocean-100m-16fsk-200VOL ocean water test dataset, Ocean-150m-16fsk-200VOL ocean water test dataset, and Ocean-200m-16fsk-200VOL ocean water test dataset are used for transmission communication collection and processing. On the basis of the cross-layer intrusion detection scheme of the underwater acoustic protocol stack, the internal structure of the optimized and improved CNN-LSTM fusion model is used to enhance the model's ability to detect abnormal communication data in ocean data and the specific performance evaluation. By controlling the training parameter settings of each model and conducting comparative experiments with other deep learning models, the comprehensive performance indicators such as recall, precision, F1 score, and accuracy are evaluated. By increasing the distance of ocean underwater acoustic communication, it is concluded that the optimized and improved CNN-LSTM fusion model also has excellent robustness. It is concluded that the optimized and improved CNN-LSTM fusion model is superior to other models in ocean cross-layer communication transmission, and at the same time shows a more stable and excellent detection efficiency, which also greatly improves the improvement of the CNN-LSTM algorithm.

[0073] In one embodiment, the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM. The improved model inherits the advantages of the CNN model in processing feature data using convolution and pooling and the advantages of the LSTM model in processing time series data, making it more suitable for processing underwater acoustic communication data.

[0074] In this embodiment, in order to improve the prediction accuracy of the benchmark model LSTM, a CNN-LSTM fusion model for cross-layer data intrusion detection in an ocean-oriented underwater sensor network is constructed. Specifically, Figure 4As shown in the figure, a CNN-LSTM fusion model is proposed to detect intrusions in UWSN networks using the deep learning architecture of convolutional neural network (CNN), long short-term memory (LSTM) and CNN-LSTM. The marine test field platform experimental data set is used for research, and the normal data and abnormal data in the marine node transmission are determined. The comparative experimental analysis is used to compare with other studies in the literature. The CNN-LSTM fusion model has the highest and best intrusion detection accuracy in the data set. The improved CNN-LSTM fusion model has greatly improved the accuracy and other performance of intrusion detection.

[0075] In this embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided, which may also include a model training process, and the specific process includes: collecting water test data, and inputting the water test data into an improved CNN-LSTM fusion model; extracting features of the water test data through the CNN part in the improved CNN-LSTM fusion model, and performing data processing on the extracted features to obtain processed time series data; training and processing the time series data through the LSTM part in the improved CNN-LSTM fusion model, and outputting the detection results in the training process.

[0076] Among them, in order to solve the problem of anomaly detection in underwater cross-layer communication data transmission, the unique advantages of CNN and LSTM are integrated and combined to build a dual-model connection architecture. In the CNN-LSTM integrated architecture, the first part uses CNN to extract features from the sampled data; the second part uses LSTM to process the time series data after sampling.

[0077] In one embodiment, Figure 4 As shown in the figure, in the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function construction; the LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and the cross entropy loss function is used as the model evaluation indicator.

[0078] That is, in this embodiment, in the improved CNN-LSTM fusion model, the first part of the CNN model sets two convolutional layers, two maximum pooling layers and an activation function component, and then builds an LSTM network; finally, optimization processing is performed by deploying a fully connected layer and a softmax layer, and the cross entropy loss function is used as an evaluation indicator.

[0079] In the analysis of underwater sensor abnormal attack data, due to the imbalance in the number of normal and abnormal samples, this characteristic of data distribution poses a challenge to detection accuracy, so the cross entropy loss function is chosen to use the predicted probability to distinguish the classification difficulty of the sample, and optimize this weight distribution in the iterative process, so as to reduce the focus on easy-to-classify samples, thereby concentrating resources on identifying difficult-to-distinguish abnormal samples, thereby improving the accuracy of the classification task. The expression of the cross entropy loss function can be expressed as: Among them, L refers to the loss function, θ represents the parameter set of the model, N is the total number of samples, and y i represents the true label value of the i-th sample, x i is the corresponding input feature, and f(x i ; θ) represents the value based on the input x i and the model prediction output of parameters θ.

[0080] Among them, the cross entropy loss function evaluates the inconsistency between the model output probability and the true distribution, which is crucial for classification tasks. It imposes severe penalties on wrong predictions and is sensitive to probability fine-tuning, thereby quickly improving learning efficiency and accuracy. The calculation formula can be expressed as: Where N is the number of samples, y i is the true label of the i-th sample, It represents the predicted probability that the i-th sample is judged as the positive class.

[0081] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided, which may also include a training process of an improved CNN-LSTM fusion model, the specific process including: obtaining an ocean data set and preprocessing it, converting the data type of the processed ocean data set to generate a target data set; inputting the target data set into a classification and recognition model, classifying the elements in the target data set and assigning data labels to obtain an input data set; dividing the input data set into a training set, a validation set, and a test set, and training the improved CNN-LSTM fusion model based on the training set, the validation set, and the test set.

[0082] like Figure 4As shown, intrusion detection is based on sampled water test data input, and the improved CNN-LSTM fusion model architecture is improved by adding intermediate layer components to the CNN model and the LSTM model. The main advantage of the CNN model is to use multi-layer convolution settings and pooling processing to extract local features of the data, thereby reducing the number of parameters and internal calculation complexity in the data setting, and improving the ability to generalize and identify features; LSTM is a very special type of recurrent neural network. When processing data containing time labels and time series labels, it can use its own memory unit to remember the unique information processed in the previous step and apply it to the prediction of subsequent time steps. In this embodiment, the proposed improved model integrates the advantages of the CNN model using convolutional layers and pooling layers to process data features and the advantages of the LSTM model to process time series data, so that it has a great performance improvement in marine communication intrusion detection.

[0083] Among them, in one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method provided may also include a data preprocessing process, and the specific process includes: obtaining an ocean data set, denoising the ocean data set, and filling the empty value cells in the ocean data set to obtain a processed ocean data set; converting the cell content in the processed ocean data set into a text format, and mapping the category data to a fixed numerical value to generate a target data set.

[0084] Data preprocessing can include two stages to deal with the problems existing in the collected marine datasets, especially some key feature columns are subject to a lot of noise interference and missing values. These problems hinder the direct application of data to learning algorithms because the missing information will affect the accuracy and reliability of the model. To address this challenge, the empty value cells in all feature columns are first processed by filling the "0" value to indicate missing information; data type conversion is performed to convert the cell content in memory into text format, and the category data is mapped to a fixed value for numerical processing. By adopting the minimum-maximum normalization technique, the data scale can be unified, which promotes the efficiency and generation capacity of the neural network model. It can accurately adjust the data range to adapt it to the model requirements while maintaining the relative relationship of the data. In this process, the preprocessing process improves the consistency of the data and ensures that the feature values ​​maintain their position in the original range after transformation, which is crucial for subsequent classification and model training.

[0085] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method provided may also include a process of assigning data labels, and the specific process includes: inputting the target data set into a classification recognition model, and identifying normal data and abnormal data through the classification recognition model; assigning normal numerical labels to normal data and abnormal sample labels to abnormal data through the classification recognition model; and using normal data with normal numerical labels and abnormal data with abnormal sample labels as input data sets.

[0086] Among them, the elements in the data set are classified and assigned labels or identifiers. Here, the data set data is labeled normal and abnormal, with normal numerical labels as "1" and abnormal sample labels as "2" to facilitate subsequent analysis or model training. The data processing denoising and data label classification process generally first defines a set of labels or categories based on the research purpose or the required analysis results. The labels should accurately reflect the phenomena or characteristics observed in the data set, which is crucial to ensure the accuracy of subsequent annotations. Specifically, one or more labels can be assigned to each element based on the characteristics of the data element and the defined label category, and the data elements can be identified and classified through a pre-trained model; then it is crucial to ensure the consistency and accuracy of the label assignment, and compare and coordinate the annotation results; finally, data cleaning and preprocessing are performed: after labeling, the data may need to be further cleaned and preprocessed to ensure data quality, including correcting incorrect labels, processing missing values, or removing outliers.

[0087] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided that can also include a data set segmentation process to promote the effectiveness of model training and evaluation. Specifically, the entire data set can be subdivided into three independent subsets, namely a training set, a validation set, and a test set, wherein the training set accounts for 60% of the total data and provides basic data for learning for the model; the validation set and the test set each account for 20%, which are used for model tuning and performance evaluation, respectively. Through this method, it is intended to establish a solid framework to support the model development process, ensure the maximization of its learning ability while avoiding overfitting or underfitting problems. In addition, by evaluating the model performance on an independent test set, the model's generalization ability for unknown data can be more accurately estimated.

[0088] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method is provided, which may also include an intrusion detection process, the specific process including: searching for data carrying abnormal sample labels from an attack data set as abnormal attack data, and searching for data carrying normal numerical labels from a transmission data set as normal transmission data; inputting the abnormal attack data and the normal transmission data into an improved CNN-LSTM fusion model, and iterating through the improved CNN-LSTM fusion model.

[0089] In the process of CNN-LSTM intrusion detection experimental analysis, a convolutional neural network (CNN), long short-term memory network (LSTM) and improved fusion model CNN-LSTM were used to design and implement an innovative intrusion detection algorithm. The unique capabilities of the three deep learning frameworks were used to identify and classify network security threats. CNN, LSTM and improved architecture CNN-LSTM models were constructed and optimized to improve the accuracy of intrusion detection.

[0090] Step 208, performing underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model, and outputting the underwater acoustic communication intrusion detection result; wherein the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through intermediate layer components, redeploys the convolution layer, the maximum pooling layer, and the activation function components, and is optimized through the fully connected layer and the softmax layer.

[0091] In one embodiment, a CNN-LSTM-based underwater acoustic communication intrusion detection method provided may also include a process of performing performance evaluation on the model, and the specific process includes: obtaining various evaluation indicators; tracking and verifying loss changes during the training phase of the target CNN-LSTM fusion model according to each evaluation indicator; and performing performance evaluation on the target CNN-LSTM fusion model based on the loss changes to obtain an evaluation result.

[0092] Among them, the evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

[0093] In this embodiment, a series of performance evaluations are performed on the improved CNN-LSTM fusion model to verify its effectiveness as an intrusion detection system. The performance evaluation is based on a series of carefully selected indicators, including accuracy, precision, recall, F1 score and loss value, ensuring the comprehensiveness and multi-dimensionality of the evaluation. The prediction performance of different models on different test sets is verified by using multiple evaluation indicators to verify the effectiveness and feasibility of the improved CNN-LSTM fusion model. The improved CNN-LSTM fusion model is used to perform factual analysis on the marine network node framework in the real-life marine water test field to verify the performance evaluation indicators of the model. The data used in the experiment comes from the data samples transmitted in the underwater sensor network attack system. In particular, in order to carefully evaluate the model's detection capabilities for various types of network attacks, the use of a comprehensive overall evaluation is included in the scope of consideration. Specifically, a continuous monitoring mechanism can be introduced, that is, by tracking the loss changes during the verification process to evaluate the performance of the model in the training phase, and a clear training termination condition is set: if the verification loss is not improved in 50 consecutive training cycles, the training process is automatically terminated. This measure not only prevents the possibility of overtraining, but also ensures the efficiency and clarity of model training. Therefore, once the training process is terminated, the model evaluation activity is also terminated, ensuring the real-time and relevance of the evaluation process.

[0094] In one embodiment, when an underwater acoustic communication intrusion detection method based on CNN-LSTM is experimented, the experimental process is as follows: Figure 5 As shown, there can be a first experimental stage, a second experimental stage, a third experimental stage, and a fourth experimental stage. Among them, the first experimental stage can include: data preprocessing, data format conversion, data denoising, and data normalization; the second experimental stage can include: data set division, division into training set, test set, and verification set; the third experimental stage can include: training optimization and parameter adjustment of the improved CNN-LSTM fusion model; the fourth experimental stage can include: performance evaluation, detection accuracy, calculation loss, and result classification.

[0095] In this embodiment, for intrusion detection and identification at the network layer, a cross-layer underwater sensor network intrusion attack system is built, and underwater acoustic communication intrusion attack detection is performed through an improved CNN-LSTM fusion model architecture. The specific work includes building an underwater sensor network intrusion attack system based on underwater communication nodes, relay nodes, shore-based communication servers and other underwater networking equipment, and constructed by routing layer, MAC layer and physical layer for the problem of abnormal attack detection currently focused on in the research of a single routing layer; the attack system simulates underwater networking with shore-based server equipment, performs underwater acoustic replay attack, MAC attack and cross-node server malicious attack by setting attack transmission protocol, collects attack data in the network in real time, uses FFT algorithm and sliding window mechanism to process data samples, and constructs communication transmission data set across physical layer, MAC layer and routing layer; the attack system can provide a large amount of real-time attack data for the underwater acoustic communication intrusion detection model to quickly improve the number of iterations and detection performance of the model.

[0096] Based on the cross-layer intrusion attack system of underwater sensor networks, the abnormal attack data and normal transmission data collected by the system are used as the data driver of the deep learning model, and an improved underwater acoustic communication intrusion detection algorithm with a CNN-LSTM fusion model architecture is proposed. The CNN and LSTM models are connected through the intermediate layer components, the convolution layer, the maximum pooling layer and the activation function components are redeployed, and the fully connected layer and the softmax layer are used for optimization processing. The improved algorithm inherits the advantages of the CNN model in processing feature data using convolution and pooling, and the advantages of the LSTM model in processing time series data, making it more suitable for processing underwater acoustic communication data. The model performance comparison experiment is carried out by controlling the experimental parameters, and the detection rate, accuracy, recall rate and F1 score are introduced as performance evaluation indicators to evaluate the performance of the improved CNN-LSTM fusion model.

[0097] It should be understood that, although the various steps in the above-mentioned flow chart are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the above-mentioned flow chart may include a plurality of sub-steps or a plurality of stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these sub-steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0098] In one embodiment, Figure 6As shown, a CNN-LSTM-based underwater acoustic communication intrusion detection system is provided, including: an attack system establishment module 610, a simulated attack module 620, a model optimization module 630 and a detection module 640, wherein:

[0099] The attack system establishment module 610 is used to build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and simulate an underwater sensor network with shore-based communication server equipment through the attack system;

[0100] The simulated attack module 620 is used to simulate the attack on the underwater sensor network based on the intrusion attack system, collect the attack data in the underwater sensor network in real time, and process the attack data using the FFT algorithm and the sliding window mechanism to obtain the attack data set; construct the communication transmission data set across the physical layer, the MAC layer and the routing layer;

[0101] The model optimization module 630 is used to input the attack data set and the transmission data set into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model;

[0102] A detection module 640 is used to perform underwater acoustic communication intrusion detection based on a target CNN-LSTM fusion model and output underwater acoustic communication intrusion detection results;

[0103] Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through intermediate layer components, redeploys the convolution layer, maximum pooling layer, and activation function components, and is optimized through the fully connected layer and softmax layer.

[0104] In one embodiment, the detection module 640 is also used to obtain various evaluation indicators; according to the various evaluation indicators, track the change of verification loss during the training phase of the target CNN-LSTM fusion model; and perform performance evaluation on the target CNN-LSTM fusion model based on the loss change to obtain an evaluation result. The evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

[0105] In one embodiment, the improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM; the model optimization module 630 is also used to collect water test data and input the water test data into the improved CNN-LSTM fusion model; the CNN part in the improved CNN-LSTM fusion model is used to extract features of the water test data, and the extracted features are processed to obtain processed time series data; the time series data is trained and processed by the LSTM part in the improved CNN-LSTM fusion model, and the detection results in the training process are output.

[0106] In one embodiment, in the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function construction; the LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and a cross entropy loss function is used as a model evaluation indicator.

[0107] In one embodiment, the model optimization module 630 is also used to obtain and preprocess an ocean data set, perform data type conversion on the processed ocean data set, and generate a target data set; input the target data set into a classification and recognition model, classify the elements in the target data set and assign data labels to obtain an input data set; divide the input data set into a training set, a validation set, and a test set, and train the improved CNN-LSTM fusion model based on the training set, the validation set, and the test set.

[0108] In one embodiment, the model optimization module 630 is also used to obtain an ocean data set, denoise the ocean data set, and fill in empty value cells in the ocean data set to obtain a processed ocean data set; convert the cell content in the processed ocean data set into text format, and map the category data to a fixed numerical value to generate a target data set.

[0109] In one embodiment, the model optimization module 630 is also used to input the target data set into the classification recognition model, identify normal data and abnormal data through the classification recognition model; assign normal numerical labels to normal data and assign abnormal sample labels to abnormal data through the classification recognition model; and use normal data with normal numerical labels and abnormal data with abnormal sample labels as input data sets.

[0110] In one embodiment, the detection module 640 is also used to search for data carrying abnormal sample labels from the attack data set as abnormal attack data, and to search for data carrying normal numerical labels from the transmission data set as normal transmission data; the abnormal attack data and the normal transmission data are input into the improved CNN-LSTM fusion model, and iterated through the improved CNN-LSTM fusion model.

[0111] In one embodiment, a computer device is provided. The computer device may be a terminal, and its internal structure diagram may be as follows: Figure 7 As shown. The computer device includes a processor, a memory, a network interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a method for underwater acoustic communication intrusion detection based on CNN-LSTM is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse, etc.

[0112] Those skilled in the art will understand that Figure 7 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0113] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and when the processor executes the computer program, the steps of a method for underwater acoustic communication intrusion detection based on CNN-LSTM are implemented.

[0114] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps of the underwater acoustic communication intrusion detection method based on CNN-LSTM are implemented.

[0115] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory can include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM) or flash memory. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM is available in many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM).

[0116] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0117] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for underwater acoustic communication intrusion detection based on CNN-LSTM, characterized in that: The method comprises: Based on underwater communication nodes, relay nodes, and shore-based communication servers, an underwater sensor network intrusion attack system consisting of a routing layer, a MAC layer, and a physical layer is constructed, and the underwater sensor network with shore-based communication server equipment is simulated through the attack system; Based on the intrusion attack system, a simulated attack is performed on the underwater sensor network, the attack data in the underwater sensor network is collected in real time, and the attack data is processed by using the FFT algorithm and the sliding window mechanism to obtain an attack data set; a communication transmission data set across the physical layer, the MAC layer and the routing layer is constructed; Input the attack data set and the transmission data set into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjust and optimize the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model; Perform underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model, and output the underwater acoustic communication intrusion detection result; Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

2. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 1 is characterized in that: The method further comprises: Get various evaluation indicators; According to each of the evaluation indicators, tracking the change of verification loss during the training phase of the target CNN-LSTM fusion model; Based on the loss change, the performance of the target CNN-LSTM fusion model is evaluated to obtain an evaluation result.

3. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 2 is characterized in that: The evaluation indicators include accuracy, precision, recall, F1 score, and loss value.

4. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 1 is characterized in that: The improved CNN-LSTM fusion model is a dual-model connection architecture based on CNN and LSTM; The method further comprises: Collecting water test data, and inputting the water test data into the improved CNN-LSTM fusion model; Extracting features of the water test data through the CNN part in the improved CNN-LSTM fusion model, and performing data processing on the extracted features to obtain processed time series data; The time series data is trained and processed through the LSTM part in the improved CNN-LSTM fusion model, and the detection results in the training process are output.

5. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 4 is characterized in that: In the improved CNN-LSTM fusion model, the CNN part is provided with a convolution layer, a maximum pooling layer, and an activation function construction; The LSTM part is constructed after the CNN part, and a fully connected layer and a softmax layer are deployed after the LSTM part, and a cross entropy loss function is used as a model evaluation indicator.

6. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 4 is characterized in that: The training process of the improved CNN-LSTM fusion model includes: Obtain and preprocess the ocean data set, convert the data type of the processed ocean data set, and generate the target data set; Inputting the target data set into a classification recognition model, classifying the elements in the target data set and assigning data labels to obtain an input data set; The input data set is divided into a training set, a validation set and a test set, and the improved CNN-LSTM fusion model is trained based on the training set, the validation set and the test set.

7. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 6 is characterized in that: Obtain and preprocess the ocean dataset, convert the data type of the processed ocean dataset, and generate the target dataset, including: Acquire an ocean data set, perform denoising on the ocean data set, and fill in empty value cells in the ocean data set to obtain a processed ocean data set; The cell contents in the processed ocean data set are converted into text format, and the category data are mapped to fixed numerical values ​​to generate a target data set.

8. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 6 is characterized in that: The target data set is input into the classification recognition model, and the elements in the target data set are classified and assigned data labels to obtain the input data set, including: Inputting the target data set into a classification recognition model, and identifying normal data and abnormal data through the classification recognition model; The normal data is assigned a normal value label and the abnormal data is assigned an abnormal sample label by using the classification recognition model; Normal data with normal numerical labels and abnormal data with abnormal sample labels are used as input data sets.

9. The underwater acoustic communication intrusion detection method based on CNN-LSTM according to claim 8 is characterized in that: The attack data set and the transmission data set are input into the improved CNN-LSTM fusion model for iteration and intrusion detection, including: Searching for data carrying the abnormal sample label from the attack data set as abnormal attack data, and searching for data carrying the normal value label from the transmission data set as normal transmission data; The abnormal attack data and the normal transmission data are input into the improved CNN-LSTM fusion model, and the improved CNN-LSTM fusion model is used for iteration.

10. A CNN-LSTM-based underwater acoustic communication intrusion detection system, characterized in that: The system comprises: The attack system establishment module is used to build an underwater sensor network intrusion attack system composed of a routing layer, a MAC layer, and a physical layer based on underwater communication nodes, relay nodes, and shore-based communication servers, and simulate an underwater sensor network with shore-based communication server equipment through the attack system; A simulated attack module is used to simulate an attack on the underwater sensor network based on the intrusion attack system, collect attack data in the underwater sensor network in real time, and process the attack data using an FFT algorithm and a sliding window mechanism to obtain an attack data set; and construct a communication transmission data set across the physical layer, MAC layer, and routing layer; A model optimization module, used for inputting the attack data set and the transmission data set into the improved CNN-LSTM fusion model for iteration and intrusion detection, and adjusting and optimizing the improved CNN-LSTM fusion model according to the output results to obtain a target CNN-LSTM fusion model; A detection module, used for performing underwater acoustic communication intrusion detection based on the target CNN-LSTM fusion model and outputting underwater acoustic communication intrusion detection results; Among them, the improved CNN-LSTM fusion model is a model that connects the CNN and LSTM models through an intermediate layer component, redeploys the convolution layer, the maximum pooling layer and the activation function component, and is optimized through the fully connected layer and the softmax layer.

Images