Network intrusion detection method based on de-noising diffusion probability model and double-attention residual network

Abstract

The invention provides a network intrusion detection method based on a de-noising diffusion probability model and a double-attention residual network, and belongs to the field of network intrusion detection. The method comprises the following steps: step 1, selecting and extracting features of original network traffic through three different types of claddings, cleaning the extracted features, and representing the cleaned features in an RGB image form; step 2, based on the network traffic RGB image generated in the step 1, learning local / overall features and fine-grained features of the network traffic by using a denoising diffusion probability model, and generating a network traffic sample of an attack type with a small scale to balance distribution of different types of network traffic; and step 3, dividing the expanded network traffic RGB image into a training set, a verification set and a test set by using a uniform random division mode, putting the training set into the network intrusion detection model based on the double-attention residual network for training, and performing verification by using the verification set to obtain an optimal network parameter. And finally obtaining a pre-trained network intrusion detection model.

Description

Technical Field

[0001] The invention belongs to the field of network intrusion detection and relates to a network intrusion detection method based on a denoising diffusion probability model and a dual attention residual network. Background Art

[0002] In today's network communication era, network security threats such as network security, data leakage, and viruses are becoming increasingly serious, and organized and purposeful network attacks are increasing, which brings severe challenges to network security protection. In order to deal with network attack problems, network intrusion detection methods are used to monitor and analyze network traffic to detect malicious activities in the network and provide protection for cyberspace security.

[0003] At present, many scholars have conducted research on network intrusion detection using deep learning models, such as CNN, LSTM, TCN, etc. These models can automatically learn complex patterns from raw network traffic and accurately detect potential threats. However, traditional deep learning models will have problems such as gradient explosion and rapid degradation of accuracy after gradually approaching saturation due to the continuous increase in network depth; in addition, existing models usually consider all characteristics of network traffic when processing massive network traffic, and do not deeply explore important characteristics in a specific network traffic layer that have a greater impact on network intrusion detection, such as network layer traffic information characteristics and application layer information characteristics, resulting in poor model detection performance.

[0004] In network intrusion detection tasks, the scale of various types of attack traffic is smaller than normal traffic, that is, data imbalance occurs, resulting in a problem of decreased detection effect of the network intrusion detection model based on deep learning due to the inability to fully learn the distribution of traffic features. In order to solve the problem of data imbalance, scholars have tried to reduce the imbalance rate of traffic categories by expanding network traffic samples using data enhancement technology. However, due to the small number of effective features extracted from network traffic, traditional data enhancement technology cannot effectively learn the original distribution of network traffic, resulting in blurry images generated by data enhancement technology.

[0005] In order for the deep learning model to better extract effective features from the raw network traffic, the network traffic dataset needs to be preprocessed. In the field of network intrusion detection, network traffic is mainly represented in the form of PCAP, CSV, and grayscale images. Compared with the above forms, each pixel in the RGB image contains three bytes, and each pixel stores more information, which can make the model training more effective. However, the characteristics of network traffic often cannot fill all the pixels in the RGB image, and need to be filled with 0X00, resulting in a large amount of invalid information in the RGB image.

[0006] Aiming at the problems existing in network intrusion detection models, data enhancement models and network traffic feature representation, the present invention designs a network intrusion detection method DDP-DAR based on denoising diffusion probability model and dual attention residual network. The method first converts network traffic into RGB images through the network traffic feature representation module; then, the network traffic data enhancement module is used to learn the local / overall features and fine-grained features of network traffic, thereby generating smaller-scale traffic samples of certain network attack types to balance the distribution of different types of network traffic; finally, the network traffic samples after data enhancement are input into the network intrusion detection model based on dual attention residual network to detect network intrusion behavior. Summary of the invention

[0007] Aiming at the problems existing in network intrusion detection models, data enhancement models and network traffic feature representation methods, the present invention provides a network intrusion detection method based on a denoising diffusion probability model and a dual attention residual network, comprising:

[0008] Step 1, through three different types of cladding selection (all layers L all , only the 5th layer L5 and only the 7th layer L7) extract the features of the original network traffic, and represent the extracted features in the form of RGB images after cleaning;

[0009] Step 2: Based on the network traffic RGB image generated in step 1, the denoising diffusion probability model is used to learn the local / overall features and fine-grained features of the network traffic, and a smaller-scale network traffic sample of the attack type is generated to balance the distribution of different types of network traffic;

[0010] Step 3: Use uniform random partitioning to divide the network traffic RGB image expanded by step 2 into training set, validation set and test set. Put the training set into the network intrusion detection model based on dual attention residual network for training, and use the validation set for verification to obtain the optimal network parameters, and finally obtain the network intrusion detection model.

[0011] In the first aspect, the specific steps of the above step 1 are as follows:

[0012] Step 1.1, capture network traffic and save it in PCAP format;

[0013] Step 1.2: select the continuous original traffic according to each session and three different types of packet layers: all layers (L all ), only Layer 5 (L5), and only Layer 7 (L7) (i.e. Session+L all , Session+L5 and Session+L7), converted into three types of discrete traffic groups;

[0014] Step 1.3, randomize the MAC address and IP address in the data link layer and IP layer to prevent the IP and MAC information in the session from affecting the quality of the network traffic features extracted in the feature extraction process, and clean up empty files and duplicate files;

[0015] Step 1.4: extract features from the three types of cleaned network traffic, and unify the length of the extracted features to 1024 bytes (it is hoped that the converted image will be a 32×32 RGB image). If the length is greater than 1024 bytes, the first 1024 bytes are intercepted, otherwise 0X00 is added at the end, and then the features of the unified length are saved in binary form to obtain the byte sequence X = (b1, b2, ..., b T ), where b i Represents the i-th byte, i∈[1,T], T is the length of the byte sequence;

[0016] Step 1.5, map each byte in each session byte sequence X to [0,255];

[0017] Step 1.6, get the binary form F of network traffic characteristics A , F5 and F7 (F A represents all layer features after extraction and processing, F5 represents the session layer features after extraction and processing, and F7 represents the application layer features after extraction and processing). A Fill it in the R channel, fill F5 in the G channel, and fill F7 in the B channel to obtain the network traffic feature representation in the form of RGB image, as shown below:

[0018]

[0019] Step 1.7, mark the generated network traffic RGB image and set the type label corresponding to each type of traffic.

[0020] In the second aspect, the specific steps of the above step 2 are as follows:

[0021] Step 2.1, gradually introduce noise ε~N(0,I) into the original network traffic RGB image x0~q(x0). The noise follows a noise addition method based on the cosine function and gradually transforms the RGB image into a random normally distributed Gaussian noise, as shown below:

[0022]

[0023] Among them, q(x T |x T-1 ) indicates that in the forward process, T-1 Add Gaussian noise to get x TThe probability of N(·) indicates that the random variable follows a normal distribution;

[0024] Then, by using the reparameterization technique, data x based on the initial data x0 are directly generated at any time step T. T , as shown below:

[0025]

[0026] Where z is the standard normal distribution random noise;

[0027] Step 2.2, randomly sample a two-dimensional Gaussian noise at time T and gradually denoise it to obtain a new image, and then gradually calculate the posterior distribution based on the Markov chain and Bayesian formula starting from the standard Gaussian distribution to obtain a new network traffic RGB image, where the posterior distribution can be expressed by the following formula:

[0028]

[0029] Here, θ represents a learnable parameter.

[0030] In the third aspect, the specific steps of the above step 3 are as follows:

[0031] Step 3.1: Use the uniform random partitioning method to divide the expanded network traffic data set into ten parts, take eight of them as training data sets, one as validation data set, and the remaining one as test data set, and construct a deep residual network based on the dual attention mechanism. Through the joint use of channel attention and spatial attention mechanism, the deep residual network focuses on the local important features in the network traffic RGB image and suppresses the influence of other useless information on intrusion detection;

[0032] Step 3.2, using the 34-layer network structure with fewer parameters in the ResNet model, complete the training in a shorter time to obtain better training results, and solve the problem of gradient explosion and rapid degradation of accuracy after gradually approaching saturation in traditional deep learning models due to the continuous increase of network depth;

[0033] Step 3.3, the network intrusion detection model based on dual attention residual network consists of 5 modules, namely conv1, conv2, conv3, conv4 and conv5 modules, where the conv1 module includes a 7×7 convolution layer structure with a stride of 2, which captures the global flow feature information T of the RGB image to reduce the spatial dimension that needs to be processed by the subsequent layers. The calculation of T is as follows:

[0034] T=ELU(BN(C 7′7 (X i ,stride,padding)))

[0035] Among them, ELU is the activation function, BN is the normalization function, stride is the step size, and padding is zero padding;

[0036] The conv2 module includes a 3×3 maximum pooling layer with a stride of 2 and 3 residual block layers containing 2 residual blocks. The conv3 module includes 4 residual block layers containing 2 residual blocks. The conv4 module includes 6 residual block layers containing 2 residual blocks. The conv5 module includes 3 residual block layers containing 2 residual blocks. The conv2, conv3, conv4 and conv5 modules reduce the size of the feature map and increase the number of output channels by downsampling. The latter module extracts higher-level flow features from the features extracted by its previous module to form a more fine-grained feature T. f , where the residual block in the residual block layer uses the full 3×3 convolutional layer design to add a dual attention layer;

[0037] The dual attention layer serially connects the channel attention module and the spatial attention module, sends the input feature F to the channel attention module for maximum pooling (MaxPool) and global average pooling (AvgPool) operations, and sends the results of the operations to the multi-layer perceptron (MLP) for learning to output the results and perform a "+" operation, and then the weight coefficient H is obtained through the mapping process of the Sigmoid function. c Finally, H c Multiply it with the input feature F to get the scaled new feature F c * , as shown below:

[0038]

[0039] Next, F c * Perform maximum pooling and global average pooling to obtain two H×W×1 channel descriptions, where H and W represent the height and width of the feature map, respectively. Concatenate the results of global pooling (MaxPool) and average pooling (AvgPool) by channel to obtain a feature map with a dimension of H×W×2. Perform a convolution operation C of a 7×7 convolution layer on the concatenated result to obtain a feature dimension of H×W×1, and process it through the Sigmoid function to obtain the weight coefficient H s , and finally H s Multiplying the input feature F yields the scaled new feature F*, as shown below:

[0040]

[0041] After multiple residual block layers of feature extraction and nonlinear mapping based on the dual attention mechanism, the obtained feature map T fThe global average pooling layer is input, and all pixel values ​​of the feature map are added and averaged to be normalized by the Softmax function to obtain the conditional probability of each category. Finally, the category with the maximum output value is selected as the input traffic category L through the argmax function.

[0042] Compared with the prior art, the present invention has the following beneficial effects:

[0043] 1. Traditional network traffic feature representation methods (PCAP, CSV, grayscale images) cannot effectively represent the characteristics of network traffic. The present invention proposes a novel network traffic feature representation method based on RGB image format. This RGB image representation method includes global features, session layer local features and network layer local features, while reducing the frequency of using 0X00 feature filling, which can better represent network traffic.

[0044] 2. Aiming at the data imbalance problem existing in network traffic, the present invention proposes a denoising diffusion probability model, which introduces cosine noise addition and learnable variance parameter strategy to improve the quality of generated RGB images, thereby solving the data imbalance problem and improving the detection accuracy of network traffic.

[0045] 3. For RGB images that store more network traffic features, the present invention proposes a network intrusion detection model based on a dual-attention residual network. On the basis of the ResNet-34 network, a dual attention layer including a channel attention module and a spatial attention module is introduced in each residual block. Through the dual attention mechanism and deep network structure, more advanced and more important network traffic features are extracted from the RGB image, thereby more accurately detecting network intrusions. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] Figure 1 It is the overall flow chart of the detection model DDP-DAR of the present invention.

[0047] Figure 2 It is a detailed flow chart of the detection model DDP-DAR of the present invention.

[0048] Figure 3 The DDP-DAR model of the present invention and CVAE-IDS-ResNet, BAGAN-GP-ResNet,

[0049] Detection results of the four models DiffTPT-ResNet and SU-DDPM-ResNet on the USTC-TFC dataset.

[0050] Figure 4 The DDP-DAR model of the present invention and CVAE-IDS-ResNet, BAGAN-GP-ResNet,

[0051] Detection results of the four models DiffTPT-ResNet and SU-DDPM-ResNet on the CTU dataset. DETAILED DESCRIPTION

[0052] The present invention is further described below in conjunction with the accompanying drawings and implementation examples. It should be noted that the implementation examples described are only intended to facilitate the understanding of the present invention and do not have any limiting effect on it.

[0053] The present invention aims to address the problems existing in network intrusion detection models, data enhancement models, and network traffic feature representation methods, and proposes a network intrusion detection method based on a denoising diffusion probability model and a dual attention residual network to effectively detect malicious attack behaviors in network traffic. The present invention provides a complete network intrusion detection framework, and conducts sufficient experiments to prove the feasibility and effectiveness of the method.

[0054] like Figure 1 and Figure 2 As shown, the network intrusion detection method based on denoising diffusion probability model and dual attention residual network proposed by the present invention includes:

[0055] Step 201 selects three different types of cladding (all layers L all , only the 5th layer L5 and only the 7th layer L7) extract the features of the original network traffic, and represent the extracted features in the form of RGB images after cleaning;

[0056] Step 2011, capturing network traffic and saving it in PCAP format;

[0057] Step 212, the continuous original traffic is selected according to each session and three different types of packet layers:

[0058] All layers (L all ), only Layer 5 (L5), and only Layer 7 (L7) (i.e. Session+L all , Session+L5 and Session+L7), converted into three types of discrete traffic groups;

[0059] Step 213, randomizing the MAC address and IP address in the data link layer and the IP layer to prevent the IP and MAC information in the session from affecting the quality of the network traffic features extracted in the feature extraction process, and cleaning up empty files and duplicate files;

[0060] Step 2014: extract features from the three types of cleaned network traffic, and unify the length of the extracted features to 1024 bytes (it is hoped that the converted image will be a 32×32 RGB image). If the length is greater than 1024 bytes, the first 1024 bytes are intercepted, otherwise 0X00 is added at the end, and then the features of the unified length are saved in binary form to obtain the byte sequence X = (b1, b2, ..., b T ), where b i Represents the i-th byte, i∈[1,T], T is the length of the byte sequence;

[0061] Step 215, each byte b in the byte sequence X of each session i Mapped to [0,255], each byte b i Corresponding to a pixel in the RGB image, thus ensuring the consistency of the image pixel information with the original byte, if the byte b i If the range exceeds the range of 0 to 255, it needs to be normalized to map it into this range. The specific calculation is as follows:

[0062]

[0063] Among them, normalized_value i Indicates the normalized value, max_value represents the maximum value represented by bytes;

[0064] Step 2016, obtaining the binary form F of the network traffic feature A , F5 and F7 (F A represents all layer features after extraction and processing, F5 represents the session layer features after extraction and processing, and F7 represents the application layer features after extraction and processing). A Fill it in the R channel, fill F5 in the G channel, and fill F7 in the B channel to obtain the network traffic feature representation in the form of RGB image, as shown below:

[0065]

[0066] Step 2017, marking the generated network traffic RGB image, and setting a type label corresponding to each type of traffic;

[0067] Step 202 uses a denoising diffusion probability model to learn local / overall features and fine-grained features of network traffic based on the network traffic RGB image generated in step 1, and generates smaller-scale network traffic samples of attack types to balance the distribution of different types of network traffic.

[0068] Step 2021, gradually introduce noise ε~N(0,I) into the original network traffic RGB image x0~q(x0), and the noise follows a noise addition method based on a cosine function. The specific calculation is as follows:

[0069]

[0070] In the time period [0,T'], β t represents the variance that increases linearly with the time step t, cos(·) represents the cosine function, and s(=0.008) is a bias parameter;

[0071] The RGB image is gradually converted into a random normally distributed Gaussian noise, as shown below:

[0072]

[0073] Among them, q(x T |x T-1 ) indicates that in the forward process, T-1 Add Gaussian noise to get x T The probability of N(·) indicates that the random variable follows a normal distribution, β T represents the variance that increases linearly with the time step T, and I represents the identity matrix;

[0074] Then, by using the reparameterization technique, data x based on the initial data x0 are directly generated at any time step T. T , as shown below:

[0075]

[0076] Where z is the standard normal distribution random noise;

[0077] Step 2022, randomly sample a two-dimensional Gaussian noise at time T and gradually perform denoising to obtain a new image, and then gradually calculate the posterior distribution based on the Markov chain and Bayesian formula from the standard Gaussian distribution to obtain a new network traffic RGB image, where the posterior distribution can be expressed by the following formula:

[0078]

[0079] Among them, p θ represents the posterior probability calculated step by step according to the Markov chain and Bayesian formula starting from the standard Gaussian distribution, θ represents a learnable parameter, x T-1 represents the image at time T-1, x T represents the image at time T, x0 represents the original image, N(·) represents the random variable obeying the normal distribution, β t represents the variance that increases linearly with time step t;

[0080] Step 203 uses a uniform random partitioning method to divide the network traffic RGB image expanded by step 2 into a training set, a validation set, and a test set, puts the training set into a network intrusion detection model based on a dual attention residual network for training, and uses the validation set for verification to obtain the optimal network parameters, and finally obtains a network intrusion detection model;

[0081] Step 2031, using a uniform random partitioning method to divide the expanded network traffic data set into ten parts, taking eight of them as training data sets, one as a validation data set, and the remaining one as a test data set, constructing a deep residual network based on a dual attention mechanism, and using the channel attention and spatial attention mechanisms together to allow the deep residual network to focus on the local important features in the network traffic RGB image and suppress the influence of other useless information on intrusion detection;

[0082] Step 2032, using a 34-layer network structure with fewer parameters in the ResNet model to complete training in a shorter time to obtain better training results, and solve the problem of gradient explosion and rapid degradation of accuracy after gradually approaching saturation in traditional deep learning models due to the continuous increase in network depth;

[0083] Step 2033, since a larger convolution kernel can provide a larger receptive field with the same number of parameters, thereby more effectively capturing the global information of the image, the first two layers of the model use the structure of the first two layers of GoogLeNet, that is, a 7×7 convolution layer with an output channel number of 64 and a stride of 2, followed by a 3×3 maximum pooling layer with a stride of 2 for downsampling; specifically, the model consists of 5 modules, namely conv1, conv2, conv3, conv4 and conv5 modules; the conv1 module includes a 7×7 convolution layer with a stride of 2, which captures the global flow feature information T of the RGB image to reduce the spatial dimension that needs to be processed by the subsequent layers. The calculation of T is as follows:

[0084] T=ELU(BN(C 7′7 (X i ,stride,padding)))

[0085] Among them, ELU is the activation function, BN is the normalization function, stride is the step size, and padding is zero padding;

[0086] The conv2 module includes a 3×3 maximum pooling layer with a stride of 2 and 3 residual block layers containing 2 residual blocks. The conv3 module includes 4 residual block layers containing 2 residual blocks. The conv4 module includes 6 residual block layers containing 2 residual blocks. The conv5 module includes 3 residual block layers containing 2 residual blocks. The conv2, conv3, conv4 and conv5 modules reduce the size of the feature map and increase the number of output channels by downsampling. The latter module extracts higher-level flow features from the features extracted by its previous module to form a more fine-grained feature T. f , where the residual block in the residual block layer uses the complete 3×3 convolution layer design, adds a batch normalization layer BN and activation function ELU after each convolution layer, and adds a dual attention layer after the last BN layer;

[0087] The dual attention layer serially connects the channel attention module and the spatial attention module, sends the input feature F to the channel attention module for maximum pooling (MaxPool) and global average pooling (AvgPool), sends the result of the operation to the multi-layer perceptron (MLP) for learning to output the result and perform a "+" operation, and then obtains the weight coefficient Hc through the mapping process of the Sigmoid function. Finally, Hc is multiplied by the input feature F to obtain the scaled new feature F c * , as shown below:

[0088]

[0089] Next, F c * Perform maximum pooling and global average pooling to obtain two H×W×1 channel descriptions, where H and W represent the height and width of the feature map, respectively. Concatenate the results of global pooling (MaxPool) and average pooling (AvgPool) by channel to obtain a feature map with a dimension of H×W×2. Perform a convolution operation C of a 7×7 convolution layer on the concatenated result to obtain a feature dimension of H×W×1, and process it through the Sigmoid function to obtain the weight coefficient H s . Finally H s Multiplying the input feature F yields the scaled new feature F*, as shown below:

[0090]

[0091] After multiple residual block layers of feature extraction and nonlinear mapping based on the dual attention mechanism, the obtained feature map T f =(z1,z2,……,z K) (where K is the number of categories) is input into the global average pooling layer, and all pixel values ​​of the feature map are added and averaged to obtain the conditional probability of each category through the Softmax function for normalization. Finally, the category with the maximum output value is selected as the input traffic category L through the argmax function, as shown below:

[0092]

[0093] The present invention mainly detects malicious attack behaviors in network traffic, proposes a network intrusion detection method based on denoising diffusion probability model and dual attention residual network, and selects USTC-TFC dataset and CTU dataset for verification. Among them, USTC-TFC dataset includes traffic collected in real network environment from 2011 to 2015. In order to better show the data imbalance phenomenon, 9 malicious traffics (including Cridex, Geodo, Htbot, Miuref, Neris, Shifu, Tinba, Zeus and Virut) and 1 normal traffic (Normal) are selected to form USTC-TFC dataset; CTU dataset is a botnet traffic dataset captured by Czech Technical University in Czech Republic in 2011. This dataset is a large-scale capture of real botnet traffic mixed with normal traffic and background traffic, including 9 malicious traffics (including Ursnif, Coinminer, Htbot, Tinba, Zeus, Artemis, Dridex, Miuref and Trickbot) and 1 normal traffic (Normal).

[0094] The present invention compares the proposed network intrusion detection model DDP-DAR based on a denoising diffusion probability model and a dual attention residual network with the network intrusion detection model CVAE-IDS-ResNet based on a conditional variational autoencoder and a residual network, the network intrusion detection model BAGAN-GP-ResNet based on a balanced generative network with gradient penalty and a residual network, the network intrusion detection model DiffTPT-ResNet based on a diffusion model with fast test time adjustment and a residual network, and the network intrusion detection model SU-DDPM-ResNet based on an accelerated denoising diffusion probability model and a residual network, and illustrates the detection capabilities of these models by calculating the average detection efficiency (including: Accuracy, F1-measure, FPR and ROC-AUC) of the five compared models.

[0095] Figure 3 The detection effects of five models on the USTC-TFC dataset are shown. Figure 3It can be seen that the DDP-DAR proposed in the present invention has the highest detection accuracy for network traffic, while the CVAE-IDS-ResNet model has the worst detection accuracy. This is the result of the blurring and distortion of the network traffic images generated by the model. The BAGAN-GP-ResNet model is prone to problems such as mode collapse and unstable training because it needs to train the generator and the discriminator at the same time. Compared with the DiffTPT-ResNet and SU-DDPM-ResNet models, the DDP-DAR model has a higher accuracy, which verifies that the DDP-DAR model can better solve the imbalance problem in network traffic, thereby improving the detection accuracy of network traffic intrusion.

[0096] Figure 4 The detection effects of five models on the CTU dataset are shown. Figure 4 It can be seen that the DDP-DAR proposed in the present invention has the highest detection accuracy for network traffic, which can reach 99.67%; with the development of traffic technology, the concealment of intrusion network traffic is getting higher and higher, but the DDP-DAR model proposed in the present invention still has a good detection effect on intrusion network traffic and has high portability; Figure 4 It can be seen that compared with the CVAE-IDS-ResNet model, the average accuracy of the DDP-DAR model is improved by about 2.31%; compared with the BAGAN-GP-ResNet model, the accuracy of the DDP-DAR model is improved by about 1.53%.

Claims

1. A network intrusion detection method based on denoising diffusion probability model and dual attention residual network, characterized in that: The steps include: Step 1: extract the features of the original network traffic through three different types of packet layers, and represent the extracted features in the form of RGB images after cleaning; Step 2: Based on the network traffic RGB image generated in step 1, the denoising diffusion probability model is used to learn the local / overall features and fine-grained features of the network traffic, and a smaller-scale network traffic sample of the attack type is generated to balance the distribution of different types of network traffic; Step 3: Use uniform random partitioning to divide the network traffic RGB image expanded by step 2 into training set, validation set and test set. Put the training set into the network intrusion detection model based on dual attention residual network for training, and use the validation set for verification to obtain the optimal network parameters, and finally obtain the network intrusion detection model.

2. The method according to claim 1, characterized in that: The specific implementation of step 1 includes the following steps: Step 1.1, capture network traffic and save it in PCAP format; Step 1.2: select the continuous original traffic according to three different types of packet layers (including all layers L all , Layer 5 only L5 and Layer 7 only L7), into three types of discrete traffic groupings; Step 1.3, randomize the MAC address and IP address in the data link layer and IP layer to prevent the IP and MAC information in the session from affecting the quality of the network traffic features extracted in the feature extraction process, and clean up empty files and duplicate files; Step 1.4, extract the features of the three types of network traffic after cleaning, and unify the length of the extracted features to 1024 bytes. If the length is greater than 1024 bytes, the first 1024 bytes are intercepted, otherwise 0X00 is added at the end, and then the features of the unified length are saved in binary form as F A , F5 and F7 (F A represents all layer features after extraction and processing, F5 represents the session layer features after extraction and processing, and F7 represents the application layer features after extraction and processing), and then converts the traffic features into RGB images; Step 1.5, mark the generated network traffic RGB image and set the type label corresponding to each type of traffic.

3. The method according to claim 1, characterized in that: The specific implementation of step 2 includes the following steps: Step 2.1, using the denoising diffusion probability model, gradually add noise to the original network traffic RGB image by adding noise through cosine in the forward process until the feature is completely transformed into Gaussian noise; In step 2.2, the denoising diffusion probability model is used to gradually remove the noise from the Gaussian noise in the reverse process to generate a new network traffic RGB image, which is mixed with the original network traffic RGB image to achieve data enhancement and solve the data imbalance problem in network traffic.

4. The method according to claim 1, characterized in that: The specific implementation of step 3 includes the following steps: Step 3.1: Use the uniform random partitioning method to divide the expanded network traffic data set into ten parts, take eight of them as training data sets, one as validation data set, and the remaining one as test data set, and construct a deep residual network based on the dual attention mechanism. Through the joint use of channel attention and spatial attention mechanism, the deep residual network focuses on the local important features in the network traffic RGB image and suppresses the influence of other useless information on intrusion detection; Step 3.2, using the 34-layer network structure with fewer parameters in the ResNet model, complete the training in a shorter time to obtain better training results, and solve the problem of gradient explosion and rapid degradation of accuracy after gradually approaching saturation in traditional deep learning models due to the continuous increase of network depth; In step 3.3, the training set is put into the network intrusion detection model based on the dual attention residual network for training, and the validation set is used for verification to obtain the optimal network parameters, thereby obtaining a pre-trained network intrusion detection model.

Images