A network intrusion detection method based on a denoising diffusion probability model and a double-attention residual network

Abstract

The application provides a network intrusion detection method based on a denoising diffusion probability model and a double-attention residual network, and belongs to the field of network intrusion detection. Step 1, the features of original network traffic are extracted through three different types of packet layer selection, and the extracted features are represented in the form of an RGB image after cleaning; step 2, based on the network traffic RGB image generated in step 1, the local / overall features and fine-grained features of the network traffic are learned by using a denoising diffusion probability model, and network traffic samples of smaller scale attack types are generated to balance the distribution of different categories of network traffic; step 3, the expanded network traffic RGB image is divided into a training set, a validation set and a test set by using a uniform random division method, the training set is put into a network intrusion detection model based on a double-attention residual network for training, the optimal network parameters are obtained by using the validation set for verification, and finally a pre-trained network intrusion detection model is obtained.

Description

TECHNICAL FIELD

[0001] The application belongs to the field of network intrusion detection, and relates to a network intrusion detection method based on a denoising diffusion probability model and a double-attention residual network. BACKGROUND

[0002] In the current network communication era, network security, data leakage, viruses and other network security threats are becoming increasingly serious, and organized and purposeful network attack events are increasing, bringing severe challenges to network security protection work. In order to cope with network attack problems, network intrusion detection methods are used to monitor and analyze network traffic to detect malicious activities in the network and provide protection for network space security.

[0003] At present, many scholars use deep learning models to carry out network intrusion detection research, such as CNN, LSTM, TCN, etc. These models can automatically learn complex patterns from raw network traffic and accurately detect potential threats. However, traditional deep learning models will have problems such as gradient explosion due to the continuous increase of network depth and rapid degradation of accuracy after gradually tending to saturation. In addition, existing models usually consider all features of network traffic when processing massive network traffic, without deeply exploring important features in a specific network traffic layer such as network layer traffic information features and application layer information features, which have greater impact on network intrusion detection, resulting in poor model detection performance.

[0004] In the network intrusion detection task, the scale of various attack traffic is smaller than that of normal traffic, that is, the data imbalance phenomenon occurs, which leads to the problem of decreased detection effect of deep learning-based network intrusion detection models due to the inability to fully learn the traffic feature distribution. In order to solve the data imbalance problem, scholars try to use data enhancement techniques to expand network traffic samples to reduce the traffic class imbalance rate. However, due to the small amount of effective features extracted from network traffic, traditional data enhancement techniques cannot effectively learn the original distribution of network traffic, resulting in the generation of relatively blurred images by data enhancement techniques.

[0005] In order to let the deep learning model better extract effective features from the original network traffic, the network traffic dataset needs to be preprocessed. In the field of network intrusion detection, network traffic is mainly represented in the form of PCAP, CSV, and grayscale images. Compared with the above forms, each pixel point in the RGB image contains three bytes, and each pixel point stores more information, which can make the training of the model more effective. However, the features of network traffic often cannot fill all the pixel points in the RGB image, and need to be filled with 0X00, resulting in a large amount of invalid information in the RGB image.

[0006] In view of the problems existing in the network intrusion detection model, the data enhancement model and the network traffic feature representation method, the application designs a network intrusion detection method DDP-DAR based on a denoising diffusion probability model and a double attention residual network. The method first converts network traffic into an RGB image through a network traffic feature representation module; then, the local / overall features and fine-grained features of the network traffic are learned by using a network traffic data enhancement module, so as to generate some network attack type traffic samples with smaller scales to balance the distribution of different categories of network traffic; finally, the network traffic samples after data enhancement are input into a network intrusion detection model based on a double attention residual network to detect network intrusion behaviors. SUMMARY

[0007] In view of the problems existing in the network intrusion detection model, the data enhancement model and the network traffic feature representation method, the application provides a network intrusion detection method based on a denoising diffusion probability model and a double attention residual network, which comprises the following steps.

[0008] Step 1, the features of the original network traffic are extracted through three different types of packet layer selection (all layers L all , only the 5th layer L5 and only the 7th layer L7), and the extracted features are cleaned and represented in the form of an RGB image.

[0009] Step 2, based on the network traffic RGB image generated in step 1, the local / overall features and fine-grained features of the network traffic are learned by using a denoising diffusion probability model, so as to generate some network attack type traffic samples with smaller scales to balance the distribution of different categories of network traffic.

[0010] Step 3, the network traffic RGB image after expansion in step 2 is divided into a training set, a validation set and a test set by using a uniform random division method, the training set is put into a network intrusion detection model based on a double attention residual network for training, the validation set is used for verification to obtain optimal network parameters, and finally the network intrusion detection model is obtained.

[0011] In the first aspect, the specific steps of step 1 are as follows:

[0012] Step 1.1, the network traffic is captured and saved in PCAP format.

[0013] Step 1.2, the continuous original traffic is converted into three types of discrete traffic groups according to each session (Session) and three different types of packet layer selection: all layers (L all ), only the 5th layer (L5) and only the 7th layer (L7) (namely Session+L all , Session+L5 and Session+L7).

[0014] Step 1.3, randomize the MAC address and IP address in the data link layer and IP layer to avoid the IP and MAC information in the session affecting the quality of the network traffic features extracted by the feature extraction process, and clean up empty files and duplicate files.

[0015] Step 1.4, extract the features of the three types of network traffic after cleaning, and unify the length of the extracted features to 1024 bytes (hoping that the converted image is a 32x32 size RGB image), if the length is greater than 1024 bytes, the first 1024 bytes are truncated, otherwise 0X00 is supplemented at the end, then the unified length features are saved in binary form, and the byte sequence X = (b1, b2,..., bi,..., bT) of each session is obtained. T i , where bi represents the i-th byte, i∈[1, T], T is the length of the byte sequence.

[0016] Step 1.5, map each byte in each session byte sequence X to [0, 255].

[0017] Step 1.6, obtain the binary form F A , F5 and F7 of the network traffic features (F A represents all layer features extracted and processed, F5 represents session layer features extracted and processed, and F7 represents application layer features extracted and processed), fill F A in the R channel, fill F5 in the G channel, and fill F7 in the B channel to obtain the network traffic feature representation in the form of an RGB image, as shown below:

[0018] ;

[0019] Step 1.7, label the generated network traffic RGB image and set the category label corresponding to each type of traffic.

[0020] In the second aspect, the specific steps of step 2 are as follows:

[0021] Step 2.1, gradually introduce noise ε ~ N(0, I) to the original network traffic RGB image x0~q(x0), which follows a noise addition method based on a cosine function, and gradually convert the RGB image into Gaussian noise with a random normal distribution, as shown below:

[0022] ;

[0023] , where q(x T | x T-1 ) represents adding Gaussian noise to x T-1 to obtain x T ​The probability that a random variable N(·) obeys a normal distribution.

[0024] Then by using the reparameterization technique, data x T , as shown below.

[0025] ;

[0026] Wherein z is a standard normal distribution random noise.

[0027] Step 2.2, a two-dimensional Gaussian noise is randomly sampled at time T and gradually denoised to obtain a new image, and then the posterior distribution is calculated according to the Markov chain and the Bayesian formula from the standard Gaussian distribution, so as to obtain a new network traffic RGB image, wherein the posterior distribution can be expressed by the following formula:

[0028] ;

[0029] ;

[0030] .

[0031] Wherein, theta represents a learnable parameter.

[0032] Thirdly, the specific steps of step 3 are as follows:

[0033] Step 3.1, the extended network traffic data set is divided into ten parts by using uniform random division method, eight of which are taken as training data set, one is taken as validation data set, and the remaining one is taken as test data set, a deep residual network based on double attention mechanism is constructed, and the joint use of channel attention and spatial attention mechanism makes the deep residual network focus on the local important features in the network traffic RGB image and suppress the influence of other useless information on intrusion detection.

[0034] Step 3.2, the 34-layer network structure with fewer parameters in ResNet model is used to complete the training in a short time to obtain better training results, and the problems of gradient explosion and rapid degradation of accuracy after gradually tending to saturation due to the continuous increase of network depth in traditional deep learning model are solved.

[0035] Step 3.3, the network intrusion detection model based on double attention residual network is composed of five modules, which are conv1, conv2, conv3, conv4 and conv5 modules in turn, wherein the conv1 module includes a structure of 1 layer of 7x7 convolution layer with a stride of 2, which captures the global traffic feature information T of the RGB image to reduce the spatial dimension that needs to be processed by the subsequent layer, and T is calculated as shown below.

[0036] ;

[0037] where ELU is an activation function, BN is a normalization function, stride is a stride, and padding is zero padding.

[0038] The conv2 module includes one layer of 3x3 max-pooling with a stride of 2 and three layers of residual block layers including two residual blocks, the conv3 module includes four layers of residual block layers including two residual blocks, the conv4 module includes six layers of residual block layers including two residual blocks, the conv5 module includes three layers of residual block layers including two residual blocks, and the four modules of conv2, conv3, conv4 and conv5 reduce the size of the feature map through down-sampling and increase the number of output channels, and the latter module extracts higher-level flow features from the features extracted by the former module to form more fine-grained features T f where the residual blocks in the residual block layer use a complete 3x3 convolutional layer design to increase the double attention layer.

[0039] The double attention layer is connected in series with the channel attention module and the spatial attention module, inputs the feature F to the channel attention module for max-pooling (MaxPool) and global average pooling (AvgPool) operations, inputs the results of the operations into a multi-layer perceptron (MLP) to learn and output results, performs "+" operation, and then maps the results through a Sigmoid function to obtain a weight coefficient H c , and finally multiplies H c and the input feature F to obtain a scaled new feature F c * , which is specifically as follows:

[0040] .

[0041] Next, F c * is subjected to max-pooling and global average pooling to obtain two channel descriptions of HxWx1, where H and W represent the height and width of the feature map, respectively. The results of the global pooling (MaxPool) and the average pooling (AvgPool) are spliced by channel to obtain a feature map of HxWx2, the spliced results are subjected to a convolution operation C of a 7x7 convolutional layer to obtain a feature of HxWx1, and a weight coefficient H s is obtained through a Sigmoid function, and finally H s is multiplied by the input feature F to obtain a scaled new feature F*, which is specifically as follows.

[0042] ;

[0043] After feature extraction and nonlinear mapping based on double attention mechanism through multiple residual block layers, the obtained feature map T f The input global average pooling layer, and the average value of all pixel values of the feature map is added to be normalized by the Softmax function to obtain the conditional probability of each class, and finally the class with the maximum output value is selected as the input flow class L by the argmax function.

[0044] Compared with the prior art, the present application has the beneficial effects of:

[0045] 1. The traditional network flow feature representation method (PCAP, CSV, and grayscale image form) cannot effectively represent the features of network flow. The present application proposes a novel network flow feature representation method based on RGB image format. This RGB image representation method contains global features, session layer local features, and network layer local features, and reduces the frequency of using 0X00 feature padding, which can better represent network flow.

[0046] 2. For the data imbalance problem existing in network flow, the present application proposes a denoising diffusion probability model. It introduces cosine noise addition and a learnable variance parameter strategy to improve the quality of generated RGB images, thereby solving the data imbalance problem and improving the detection accuracy of network flow.

[0047] 3. For RGB images that store more network flow features, the present application proposes a network intrusion detection model based on a double attention residual network. On the basis of the ResNet-34 network, a double attention layer including a channel attention module and a spatial attention module is introduced in each residual block. Through the double attention mechanism and the deep network structure, more advanced and important network flow features are extracted from the RGB image, thereby more accurately detecting network intrusion. BRIEF DESCRIPTION OF DRAWINGS

[0048] Figure 1 is the overall flowchart of the detection model DDP-DAR of the present application.

[0049] Figure 2 is the detailed flowchart of the detection model DDP-DAR of the present application.

[0050] Figure 3 is the detection result of the DDP-DAR model of the present application and the CVAE-IDS-ResNet, BAGAN-GP-ResNet, DiffTPT-ResNet, and SU-DDPM-ResNet four models on the USTC-TFC dataset.

[0051] Figure 4The detection results of the DDP-DAR model of the application and four models of CVAE-IDS-ResNet, BAGAN-GP-ResNet, DiffTPT-ResNet and SU-DDPM-ResNet on the CTU data set. DETAILED DESCRIPTION

[0052] The application will be further described below in conjunction with the drawings and implementation cases, and it should be pointed out that the described implementation cases are only intended to facilitate the understanding of the application and do not limit the application in any way.

[0053] The application aims at the problems existing in network intrusion detection models, data enhancement models and network traffic feature representation methods, and proposes a network intrusion detection method based on a denoising diffusion probability model and a double-attention residual network, so as to effectively detect malicious attack behaviors in network traffic. The application provides a perfect network intrusion detection framework, and sufficient experiments are conducted to prove the feasibility and effectiveness of the method.

[0054] As shown in Figure 1 and Figure 2 , the network intrusion detection method based on the denoising diffusion probability model and the double-attention residual network proposed by the application comprises:

[0055] Step 201 extracts features of original network traffic through three different types of packet layer selection (all layers L all , only the 5th layer L5 and only the 7th layer L7), and represents the extracted features in the form of an RGB image after cleaning.

[0056] Step 2011 captures network traffic and saves it in PCAP format.

[0057] Step 2012 converts continuous original traffic into three types of discrete traffic groups according to each session (Session) and three different types of packet layer selection:

[0058] all layers (L all ), only the 5th layer (L5) and only the 7th layer (L7) (i.e. Session+L all , Session+L5 and Session+L7).

[0059] Step 2013 randomizes MAC addresses and IP addresses in the data link layer and the IP layer to avoid the influence of IP and MAC information in the session on the quality of network traffic features extracted by the feature extraction process, and cleans empty files and duplicate files.

[0060] Step 2014, extract features of the three types of network traffic after cleaning, and unify the length of the extracted features to 1024 bytes (expect the converted image to be a 32x32 size RGB image), if the length is greater than 1024 bytes, take the first 1024 bytes, otherwise, supplement 0X00 at the end, then save the unified length features in binary form, get the byte sequence X = (b1, b2,..., bT) of each session, where b T represents the i-th byte, i∈[1, T], T is the length of the byte sequence. i

[0061] Step 2015, map each byte b i in the byte sequence X of each session to [0, 255], each byte b i corresponds to a pixel point in the RGB image, so as to ensure the consistency of image pixel information and original bytes, if the byte b i range exceeds the range of 0 to 255, it needs to be normalized to map it to this range, the specific calculation is as follows:

[0062] ;

[0063] Where normalized_value i represents the normalized value, max_value represents the maximum value of the byte.

[0064] Step 2016, get the binary form F A , F5 and F7 of the network traffic features (F A represents all layer features extracted and processed, F5 represents session layer features extracted and processed, F7 represents application layer features extracted and processed), fill F A in the R channel, fill F5 in the G channel, and fill F7 in the B channel, to obtain the network traffic feature representation in the form of RGB image, as follows:

[0065] ;

[0066] Step 2017, label the generated network traffic RGB image, set the class label corresponding to each type of traffic.

[0067] Step 202, based on the network traffic RGB image generated in step 1, use the denoising diffusion probability model to learn the local / overall features and fine-grained features of the network traffic, and generate network traffic samples of smaller scale attack types to balance the distribution of different types of network traffic.

[0068] ​Step 2021, introduce noise ε ~ N(0, I) to the original network traffic RGB image x0~q(x0) step by step, which follows a cosine function-based noise addition method, and the specific calculation is as follows:

[0069] ;

[0070] In the time period [0, T'], where β t represents the variance that increases linearly with time step t, cos(·) represents the cosine function, and s (= 0.008) is a bias parameter.

[0071] Convert the RGB image to Gaussian noise with random normal distribution step by step, as follows:

[0072] .

[0073] where q(x T | x T-1 ) represents the probability of adding Gaussian noise to x T-1 in the forward process to obtain x T , N(·) represents that the random variable follows a normal distribution, β T represents the variance that increases linearly with time step T, and I represents the unit matrix.

[0074] Then, by using the reparameterization technique, data x T based on the initial data x0 is directly generated at any time step T, as follows.

[0075] .

[0076] where z is standard normal distribution random noise.

[0077] Step 2022, randomly sample a two-dimensional Gaussian noise at time T and gradually denoise to obtain a new image, then start from the standard Gaussian distribution and gradually calculate the posterior distribution according to the Markov chain and Bayes formula, to obtain a new network traffic RGB image, where the posterior distribution can be represented by the following formula.

[0078] ;

[0079] ;

[0080] .

[0081] where p θ represents the posterior probability calculated step by step from the standard Gaussian distribution according to the Markov chain and Bayes formula, θ represents a learnable parameter, and x T-1x T-1 represents an image at time T-1, x T x T represents an image at time T, x0 represents an original image, N(·) represents that a random variable obeys a normal distribution, and β t represents a variance that increases linearly with a time step t.

[0082] Step 203 divides the network traffic RGB image expanded by step 2 into a training set, a verification set and a test set using a uniform random division method, places the training set into the network intrusion detection model based on the dual attention residual network for training, and uses the verification set for verification to obtain optimal network parameters, and finally obtains the network intrusion detection model.

[0083] Step 2031, the expanded network traffic dataset is divided into ten parts by using a uniform random division method, eight of which are taken as a training dataset, one is taken as a verification dataset, and the remaining one is taken as a test dataset, a deep residual network based on a dual attention mechanism is constructed, and the joint use of channel attention and spatial attention mechanism makes the deep residual network focus on the local important features in the network traffic RGB image and suppress the influence of other useless information on intrusion detection.

[0084] Step 2032, a 34-layer network structure with fewer parameters in the ResNet model is used to complete the training in a shorter time to obtain better training results, and the problems of gradient explosion and rapid degradation of accuracy after the accuracy gradually tends to saturation due to the continuous increase of network depth in traditional deep learning models are solved.

[0085] Step 2033, since a larger convolution kernel can provide a larger receptive field under the same number of parameters, thereby more effectively capturing the global information of the image, so for the first two layers of the model, the first two layers of GoogLeNet structure are followed, that is, a 7x7 convolution layer with an output channel number of 64 and a stride of 2 is used, followed by a 3x3 max pooling layer with a stride of 2 for down-sampling; Specifically, the model is composed of five modules, which are conv1, conv2, conv3, conv4 and conv5 modules in turn; wherein the conv1 module includes a structure of 1 layer of 7x7 convolution layer with a stride of 2, which captures the global traffic feature information T of the RGB image to reduce the spatial dimension that needs to be processed by the subsequent layers, and T is calculated as follows:

[0086] .

[0087] Wherein, ELU is an activation function, BN is a normalization function, stride is a step length, and padding is zero padding.

[0088] The conv2 module includes a 3*3 max pooling layer with a stride of 2 and 3 residual block layers each containing 2 residual blocks, the conv3 module includes 4 residual block layers each containing 2 residual blocks, the conv4 module includes 6 residual block layers each containing 2 residual blocks, the conv5 module includes 3 residual block layers each containing 2 residual blocks, and the four modules of conv2, conv3, conv4 and conv5 reduce the size of the feature map through downsampling and increase the number of output channels, the latter module extracts higher-level flow features from the features extracted by the former module, forming more fine-grained features T f Wherein the residual blocks in the residual block layer follow the complete 3*3 convolution layer design, a batch normalization layer BN and an activation function ELU are added after each convolution layer, and a dual attention layer is added after the last BN.

[0089] The dual attention layer is connected in series with the channel attention module and the spatial attention module, the input feature F is sent to the channel attention module for max pooling (MaxPool) and global average pooling (AvgPool) operations, the results after the operations are sent to a multi-layer perceptron (MLP) to learn and output results, then the results are subjected to "+" operation, and then a weight coefficient Hc is obtained through the mapping processing of a Sigmoid function, and finally Hc is multiplied with the input feature F to obtain a scaled new feature F c * , and the specific process is as follows:

[0090] .

[0091] Then, F c * is subjected to max pooling and global average pooling to obtain two channel descriptions of H*W*1, where H and W represent the height and width of the feature map respectively. The results of the global pooling (MaxPool) and the average pooling (AvgPool) are spliced by channel to obtain a feature map with a dimension of H*W*2, the spliced results are subjected to a convolution operation C of a 7*7 convolution layer to obtain a feature with a dimension of H*W*1, and a weight coefficient H s is obtained through Sigmoid function processing. Finally, H s is multiplied with the input feature F to obtain a scaled new feature F*, and the specific process is as follows.

[0092] .

[0093] After the feature extraction and nonlinear mapping based on the dual attention mechanism of the multiple residual block layers, the obtained feature map T f =(z1,z2,……,z K) input global average pooling layer, and add all pixel values of the feature map to obtain the average value, and then normalize by the Softmax function to obtain the conditional probability of each class, and finally select the class with the maximum output value as the input flow class L by the argmax function, as shown below:

[0094] .

[0095] The present application mainly detects malicious attack behaviors existing in network traffic, and proposes a network intrusion detection method based on a denoising diffusion probability model and a double attention residual network, selects the USTC-TFC data set and the CTU data set for verification. Among them, the USTC-TFC data set includes the traffic collected in the real network environment from 2011 to 2015, in order to better show the data imbalance phenomenon, 9 kinds of malicious traffic (including Cridex, Geodo, Htbot, Miuref, Neris, Shifu, Tinba, Zeus and Virut) and 1 kind of normal traffic (Normal) are selected to form the USTC-TFC data set; The CTU data set is the botnet traffic data set captured by the Czech Technical University in the Czech Republic in 2011, which is a large-scale capture of real botnet traffic mixed with normal traffic and background traffic, containing 9 kinds of malicious traffic (including Ursnif, Coinminer, Htbot, Tinba, Zeus, Artemis, Dridex, Miuref and Trickbot) and 1 kind of normal traffic (Normal).

[0096] The network intrusion detection model DDP-DAR based on the denoising diffusion probability model and the double attention residual network proposed in the present application is compared with the network intrusion detection model CVAE-IDS-ResNet based on the conditional variational autoencoder and the residual network, the network intrusion detection model BAGAN-GP-ResNet based on the balanced generative network with gradient penalty and the residual network, the network intrusion detection model DiffTPT-ResNet based on the diffusion model with test time quick adjustment and the residual network, and the network intrusion detection model SU-DDPM-ResNet based on the accelerated denoising diffusion probability model and the residual network, and the average detection efficiency (including: Accuracy, F1-measure, FPR and ROC-AUC) of the five comparison models is calculated to illustrate the detection ability of these models.

[0097] Figure 3 The detection effect of the five models on the data set USTC-TFC is shown, from Figure 3It can be seen that the detection accuracy of the DDP-DAR proposed in the application on network traffic is the highest, and the detection accuracy of the CVAE-IDS-ResNet model is the worst, which is caused by the problem that the network traffic images generated by the model are blurred and distorted; the BAGAN-GP-ResNet model is prone to mode collapse, unstable training and other problems because it needs to train the generator and discriminator at the same time; compared with the DiffTPT-ResNet and SU-DDPM-ResNet models, the accuracy of the DDP-DAR model is higher, which verifies that the DDP-DAR model can better solve the imbalance problem existing in the network traffic, thereby improving the detection accuracy of network traffic intrusion.

[0098] Figure 4 The detection effects of the five models on the data set CTU are shown, from which it can be seen that the detection accuracy of the DDP-DAR proposed in the application on network traffic is the highest, and the detection accuracy of the CVAE-IDS-ResNet model is the worst, which is caused by the problem that the network traffic images generated by the model are blurred and distorted; the BAGAN-GP-ResNet model is prone to mode collapse, unstable training and other problems because it needs to train the generator and discriminator at the same time; compared with the DiffTPT-ResNet and SU-DDPM-ResNet models, the accuracy of the DDP-DAR model is higher, which verifies that the DDP-DAR model can better solve the imbalance problem existing in the network traffic, thereby improving the detection accuracy of network traffic intrusion. Figure 4 It can be seen that the detection accuracy of the DDP-DAR proposed in the application on network traffic is the highest, which can reach 99.67%; with the development of traffic technology, the concealment of intrusion network traffic is getting higher and higher, but the DDP-DAR model proposed in the application still has good detection effect on the intrusion network traffic and has high portability; from the confusion matrix of the DDP-DAR model, it can be seen that the DDP-DAR model has high detection accuracy on network traffic intrusion. Figure 4 It can be seen that compared with the CVAE-IDS-ResNet model, the average precision of the DDP-DAR model is increased by about 2.31%; compared with the BAGAN-GP-ResNet model, the accuracy of the DDP-DAR model is increased by about 1.53%.

Claims

1. A network intrusion detection method based on a denoising diffusion probability model and a double attention residual network, characterized in that, The method comprises the following steps: Step 1, extracting features of original network traffic through three different types of packet layer selection, and representing the extracted features in the form of RGB images after cleaning; Step 2, based on the network traffic RGB images generated in step 1, learning the local overall features and fine-grained features of the network traffic by using a denoising diffusion probability model, and generating network traffic samples of smaller scale attack types to balance the distribution of different types of network traffic; Step 3, using a uniform random division method to divide the network traffic RGB images expanded in step 2 into a training set, a validation set and a test set, putting the training set into a network intrusion detection model based on a dual attention residual network for training, and using the validation set for verification to obtain optimal network parameters, and finally obtaining a network intrusion detection model; The specific implementation of step 1 comprises the following steps: Step 1.1, capturing network traffic and saving it in PCAP format; Step 1.2, the continuous raw traffic is selected according to three different types of cladding, including all layers L all , only the 5th layer L5 and only the 7th layer L7, into three types of discrete traffic packets; Step 1.3, randomize the MAC address and IP address in the data link layer and IP layer to avoid the IP and MAC information in the session affecting the quality of the network traffic features extracted by the feature extraction process, and clean up empty files and duplicate files; step 1.4, extract the features in the three types of network traffic after cleaning, and unify the length of the extracted features to 1024 bytes, if the length is greater than 1024 bytes, the first 1024 bytes are intercepted, otherwise 0X00 is supplemented at the end, then the features with uniform length are saved as F A , F5 and F7, wherein F A represents all the extracted and processed layer features, F5 represents the extracted and processed session layer features, and F7 represents the extracted and processed application layer features, and then the traffic features are converted into RGB images; Step 1.5, labeling the generated network traffic RGB images and setting the category label corresponding to each type of traffic; The specific implementation of step 2 comprises the following steps: Step 2.1, using the denoising diffusion probability model to gradually add noise to the original network traffic RGB image in the forward process by increasing the noise in the form of cosine until the features become Gaussian noise; Step 2.2, using the denoising diffusion probability model to gradually remove noise from the Gaussian noise in the reverse process to generate new network traffic RGB images, and mixing them with the original network traffic RGB images to achieve data augmentation and solve the data imbalance problem in network traffic.

2. The method of claim 1, wherein, The specific implementation of step 3 comprises the following steps: Step 3.1, using a uniform random division method to divide the expanded network traffic dataset into ten parts, taking eight parts as training data, one part as validation data, and the remaining one part as test data, and constructing a deep residual network based on a dual attention mechanism, which focuses on local important features in network traffic RGB images and suppresses other useless information through the joint use of channel attention and spatial attention mechanisms to affect intrusion detection; Step 3.2, using a 34-layer network structure with fewer parameters in the ResNet model to complete training in a shorter time to obtain better training results, solving the problems of gradient explosion and rapid degradation of accuracy after gradually saturating due to the continuous increase of network depth in traditional deep learning models; Step 3.3, putting the training set into a network intrusion detection model based on a dual attention residual network for training, using the validation set for verification to obtain optimal network parameters, and then obtaining a pre-trained network intrusion detection model.

Images