Network intrusion detection method and device, computer equipment and storage medium

Abstract

The invention relates to a network intrusion detection method and device, computer equipment, a storage medium and a computer program product. The method comprises the following steps: constructing a multi-dimensional network intrusion detection data set; generating a network intrusion detection model based on the attack data of the generative adversarial network GAN; training in combination with the multi-teacher network of the GAN; performing network intrusion detection model training of multi-teacher distillation; and verifying and deploying the network intrusion detection model. The technical problem that in the prior art, a network intrusion detection system cannot effectively cope with continuously changing attack modes or cannot accurately recognize abnormal behaviors in high-dimensional data is solved. Efficient and accurate detection is achieved through a lightweight model, the method is suitable for dynamic and diversified network intrusion scenes, and the effect of an intrusion detection system in practical application is remarkably improved.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a network intrusion detection method, apparatus, computer equipment, storage medium and computer program product. Background Art

[0002] An intrusion detection system is an entity used to audit system and network operations to prevent malicious behavior and violations of security policies. The IDS model was first proposed in the 1980s and described by Denning et al. [An intrusion-detection model.]. Based on the location of the observed intrusion behavior, IDS can be divided into two categories: network-based intrusion detection systems and host-based intrusion detection systems. Network-based intrusion detection systems monitor and analyze network traffic and focus mainly on network security. Host-based intrusion detection systems identify malicious activities by monitoring processes and system events in the software environment associated with a specific computer. In traditional network-based intrusion detection systems, signature-based detection systems identify intrusions by matching signatures of known attack patterns. This method relies on a pre-defined rule base and can effectively detect known threats, but has limited detection capabilities for new attacks. Anomaly-based detection systems establish a baseline of normal behavior. When a behavior that deviates significantly from the baseline is detected, the system marks it as a potential intrusion. This method has advantages in detecting unknown threats, but is prone to false positives. State-based detection systems analyze packet sequences in the context of a network session to identify malicious behavior. They provide detection capabilities for complex attacks by tracking network connection states and traffic patterns.

[0003] With the development of deep learning technology, many network intrusion detection methods based on neural networks have emerged and achieved excellent results. Methods based on convolutional neural networks (CNNs) use the powerful characteristics of CNNs to automatically extract features from network traffic, especially when processing large-scale data sets. This type of method can effectively identify complex attack patterns. Methods based on long short-term memory networks (LSTMs) are good at capturing the time series characteristics of network traffic. By remembering long-term dependencies, they can better identify persistent or progressive attack behaviors. Methods based on autoencoders (AEs) construct low-dimensional representations of network traffic through unsupervised learning, which can automatically detect abnormal traffic and are suitable for discovering unknown attack types. Methods based on generative adversarial networks (GANs) enhance the generalization ability of the model through the mechanism of generating adversarial attacks. They can not only improve the accuracy of detection, but also generate adversarial samples to test the robustness of the system, further improving the defense capabilities of the intrusion detection system.

[0004] In the existing network intrusion detection system, facing the complex and dynamic network environment, the network intrusion detection method is usually required to have the ability to cope with a variety of network intrusion scenarios. Specifically, the traditional network intrusion detection system cannot effectively cope with the ever-changing attack patterns or cannot accurately identify abnormal behaviors in high-dimensional data. In addition, a single model may overfit or fail to fully extract key features when processing complex data, thus affecting the detection effect. Summary of the invention

[0005] Based on this, it is necessary to provide a network intrusion detection method, apparatus, computer equipment, storage medium and computer program product to address the above technical issues.

[0006] In a first aspect, the present application provides a network intrusion detection method, the method comprising:

[0007] Construct a multi-dimensional network intrusion detection dataset;

[0008] Generate network intrusion detection model based on attack data of generative adversarial network GAN;

[0009] Combine the GAN with a multi-teacher network for training;

[0010] Conduct network intrusion detection model training with multi-teacher distillation;

[0011] Network intrusion detection model validation and deployment.

[0012] In one embodiment, constructing a multi-dimensional network intrusion detection data set includes:

[0013] Integrate multiple data sets based on packets, flows, and host status.

[0014] In one embodiment, the network intrusion detection model includes: an attack generator and a discriminator;

[0015] The attack generator is used to generate attack data to achieve a balance between positive and negative samples;

[0016] The discriminator is used to distinguish real data from attack data.

[0017] In one embodiment, the generating a network intrusion detection model based on attack data of a generative adversarial network (GAN) includes:

[0018] The attack generator receives random noise to generate attack data;

[0019] The discriminator receives normal data and attack data and distinguishes true from false;

[0020] The attack generator deceives the discriminator to generate high-quality attack data.

[0021] In one embodiment, the training of the multi-teacher network combined with the GAN includes:

[0022] Different types of teacher networks are trained for different types of data.

[0023] In one embodiment, the network intrusion detection model verification and deployment includes:

[0024] Evaluate the generalization ability of the network intrusion detection model and quantify the performance of the network intrusion detection model through accuracy, recall and F1 score;

[0025] The verified network intrusion detection model is deployed in a predetermined scenario.

[0026] In a second aspect, the present application further provides a network intrusion detection device, characterized in that the device comprises:

[0027] Construction module, used to construct a multi-dimensional network intrusion detection dataset;

[0028] A generation module, used to generate a network intrusion detection model based on attack data of a generative adversarial network (GAN);

[0029] A first training module, used for training with a multi-teacher network of the GAN;

[0030] The second training module conducts network intrusion detection model training with multi-teacher distillation;

[0031] Verification and deployment module, used for network intrusion detection model verification and deployment.

[0032] In a third aspect, the present application further provides a computer device. The computer device includes a memory and a processor, the memory stores a computer program, and the processor implements the following steps when executing the computer program:

[0033] Construct a multi-dimensional network intrusion detection dataset;

[0034] Generate network intrusion detection model based on attack data of generative adversarial network GAN;

[0035] Combine the GAN with a multi-teacher network for training;

[0036] Conduct network intrusion detection model training with multi-teacher distillation;

[0037] Network intrusion detection model validation and deployment.

[0038] In a fourth aspect, the present application further provides a computer-readable storage medium. The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the following steps are implemented: constructing a multi-dimensional network intrusion detection data set;

[0039] Generate network intrusion detection model based on attack data of generative adversarial network GAN;

[0040] Combine the GAN with a multi-teacher network for training;

[0041] Conduct network intrusion detection model training with multi-teacher distillation;

[0042] Network intrusion detection model validation and deployment.

[0043] In a fifth aspect, the present application further provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, the following steps are implemented:

[0044] Construct a multi-dimensional network intrusion detection dataset;

[0045] Generate network intrusion detection model based on attack data of generative adversarial network GAN;

[0046] Combine the GAN with a multi-teacher network for training;

[0047] Conduct network intrusion detection model training with multi-teacher distillation;

[0048] Network intrusion detection model validation and deployment.

[0049] The above-mentioned network intrusion detection method, device, computer equipment, storage medium and computer program product, by constructing a multi-dimensional network intrusion detection data set; generating a network intrusion detection model based on attack data of a generative adversarial network GAN; training a multi-teacher network of the GAN; training a network intrusion detection model with multi-teacher distillation; and verifying and deploying a network intrusion detection model. It solves the technical problem that the network intrusion detection system in the prior art cannot effectively respond to the ever-changing attack mode or cannot accurately identify abnormal behavior in high-dimensional data; it realizes efficient and accurate detection with a lightweight model, which is suitable for dynamic and diverse network intrusion scenarios, and significantly improves the effect of the intrusion detection system in practical applications. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] Figure 1 A schematic diagram of a flow chart of a network intrusion detection method in an embodiment;

[0051] Figure 2 A schematic diagram of a training framework of an attack generator based on a GAN network in one embodiment;

[0052] Figure 3 A schematic diagram of a multi-teacher network training structure in one embodiment;

[0053] Figure 4 A schematic diagram of multi-teacher distillation learning and multi-loss constraints in one embodiment;

[0054] Figure 5 A schematic diagram of a network intrusion detection device in an embodiment;

[0055] Figure 6 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0056] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0057] In this application, the following technologies are mainly used:

[0058] Multi-teacher distillation: Multi-teacher distillation is a variant of knowledge distillation that aims to improve the performance of the student model through multiple teacher models. In traditional knowledge distillation, there is usually only one teacher model, which passes knowledge to a smaller or simpler student model to control the complexity of the model and reduce running costs. However, in multi-teacher distillation, one academic model corresponds to multiple teacher models, each of which may show superiority in different aspects. The student model integrates this knowledge by learning the outputs of multiple teacher models, thereby improving its generalization ability and robustness.

[0059] GAN: GAN (Generative Adversarial Network) is a two-part deep learning model structure, usually including a generator and a discriminator. The goal of the generator is to generate fake data that is as similar as possible to real data, while the goal of the discriminator is to distinguish between real data and generated data. The two parts of the network improve each other through adversarial training: the generator deceives the discriminator by generating more realistic data, while the discriminator continuously improves its ability to distinguish between real and fake data. After repeated training, the generator is eventually able to generate data that is difficult to distinguish from real data, which makes GAN widely used in image generation, image restoration, data enhancement and other fields.

[0060] Although the existing network intrusion detection using deep learning technology has achieved remarkable results, it still has some shortcomings. First, the computational overhead of deep learning models is high. Deep learning models are usually composed of a large number of neurons and complex hierarchical structures, and the training and inference processes require a lot of computing resources. When faced with real-time and large-scale network communications, the high computing requirements of deep learning models may lead to extended response times and inability to detect and respond to potential network attacks in a timely manner. This is an important challenge for intrusion detection systems that require real-time processing and response, especially in high-traffic network environments, where model delays and computing bottlenecks may cause attacks to cause damage before they are detected. Second, these deep learning methods often only receive the same type of data for analysis. For example, many deep learning-based intrusion detection methods usually only analyze network traffic packets, data flows, or specific host status data. Although these methods may perform well when processing a single type of data, in complex actual application environments, network attacks often involve multiple types of data and information sources. The lack of comprehensive processing capabilities for diverse data may result in the system's inability to fully and accurately identify complex attacks. The lack of comprehensive processing capabilities for diverse information in complex environments limits the application effect of deep learning models in real scenarios. This application proposes a network intrusion detection method that combines GAN and multi-teacher distillation, which effectively solves the problems of high computational overhead and insufficient comprehensive processing capabilities of diverse data in existing deep learning technologies in network intrusion detection.

[0061] In one embodiment of the present application, Figure 1 As shown, a network intrusion detection method is provided, the method comprising:

[0062] S100, constructs a multi-dimensional network intrusion detection dataset.

[0063] In order to face the complex network intrusion detection scenarios, it is necessary to integrate multiple data sets to build a large multi-dimensional network intrusion detection data set. In this paper, the construction of a multi-dimensional network intrusion detection data set requires the processing and integration of multiple data sets based on data packets, data flows, and host status. UNSW-NB15 is a data set based on data packets, with 49 features corresponding to 9 attacks. For the data set based on data flows, this application selects the ISOT data set, which is composed of several existing publicly available malicious and non-malicious data sets. And the malicious and non-malicious labels are identified respectively. Among them, malicious traffic only accounts for three percent of the data set overview. Since there is no data set specifically based on host status, the statistical features 32-41 in the KDD99 data set are used. This attribute identifies the number of failed logins, the number of connections at the same time, etc., and these features are cut out as a new data set. In this way, we have built a multi-dimensional network intrusion detection model with rich and diverse features.

[0064] S200, generating a network intrusion detection model based on attack data of a generative adversarial network GAN.

[0065] In one embodiment of the present application, the attack generator is used to generate attack data to achieve a balance between positive and negative samples. The discriminator is used to distinguish between real data and attack data. The attack generator receives random noise to generate attack data. The discriminator receives normal data and attack data and distinguishes true from false. The attack generator deceives the discriminator to generate high-quality attack data.

[0066] Specifically, the above-constructed dataset is not suitable for directly training the intrusion detection model, because the above datasets have one thing in common, that is, the positive and negative samples are extremely unbalanced. The data of normal labels is much larger than the data of abnormal labels, which is harmful to the training of the detection model. This application chooses to train an attack generator through the structure of the GAN network to expand the attack data to achieve a balance between positive and negative samples. The GAN network structure is as follows Figure 2 As shown. For an attack generator G(), it receives a random noise n and generates attack data A q The discriminator D() receives the real abnormal data A i and A q , and distinguish whether it is true or false. Through the training of the GAN network, the D_Loss constraint discriminator D(·) distinguishes between real data and generated data, and the G_Loss constraint attack generator G() deceives the discriminator to generate high-quality attack data. For data sets based on packets, data flows, and host status, an attack generator is trained with its abnormal data, namely G packet (), G flow () and G host(). These attack generators will learn the characteristics of abnormal data and generate a large amount of attack data for training to expand the abnormal data in the dataset, making the positive and negative samples more balanced during training, which is more beneficial to the training of the teacher network and the student network.

[0067] S300, training is performed in conjunction with the multi-teacher network of the GAN.

[0068] In one embodiment of the present application, different types of teacher networks need to be trained for different types of data.

[0069] Specifically, for different types of data, different types of teacher networks are trained, so that the student network can eventually cope with various types of data and more diverse intrusion environments. Figure 3 As shown, for data packets and abnormal states with attribute features as the main feature, this application uses two convolutional neural networks CNN as teachers 1 and 3, namely T1() and T3(). packet () and G host The attack data generated by (), as well as the normal data packets and normal states, are converted into feature vectors of the same dimension through a preprocessing operation. The preprocessing operation includes one-hot encoding and full connection, which ultimately converts different input data types into the same network input form, which helps the multi-teacher distillation learning of the student network. The processed input feature vectors x1 and x3 are r () and T s () to obtain the output feature vectors y1 and y3, that is, y1, y3 = T1 (x1), T3 (x3). For normal data flow and attack generator G flow () The abnormal data stream generated is first processed into a multi-variable time series feature vector x2 through one-hot encoding and full connection. The final intrusion detection must consider both the connection between whether an intrusion occurs and the characteristics of each variable in the multi-variable, and the connection with each variable in terms of time series characteristics. Therefore, this application uses a dual-branch network composed of CNN and LSTM to better extract the time series features of multiple variables and obtain the output feature vector y2=T2(x2). Finally, y1, y2, and y3 are concatenated to obtain y1, which is then passed through the output fully connected layer FC T The normal / abnormal binary classification output is obtained. During the training process, the attack generator is frozen and constrained using the BCE loss. Each teacher network is continuously trained so that features can be well extracted for each input type of data, thus preparing for the multi-teacher distillation learning of the final student network.

[0070] S400,network intrusion detection model training with multi-teacher distillation.

[0071] like Figure 4As shown, a multi-dimensional network intrusion detection dataset is used, including normal / abnormal labels y laber Data packets, data flows, and host status characteristics. These data are provided in three forms, and samples of 1 to 3 forms of data are randomly selected. s For student network training, if there is a certain type of data that is not extracted, then fill in 0 at that part of the data position to ensure that no matter what combination of data is extracted, the shape of the input data remains unchanged. The student network s() uses a dual-branch network structure composed of CNN and LSTM to ensure that it can learn both the attribute features extracted by teachers T1 and T3 and the time series features extracted by teacher T2. During the training process, the parameters of teachers T1(), T2() and T3() are frozen, and only the parameters of the student network S() are updated. The output of the student network S() is y s =S(x). Finally, the output feature y s Input to the fully connected layer FC S In, that is, y predict =FC S (y s ). The student network needs to make its output vector y s The output vector y7 of the teacher network is as close as possible, and the output vector of the student network is guaranteed to obtain the correct intrusion prediction after passing through the fully connected layer.

[0072] S01. Further, after S400, step S410 is also included: multi-task loss constraint and training. The training of the scheme uses multi-task distillation loss and cross entropy loss based on intrusion labels and predicted labels. The multi-task distillation loss needs to be calculated through the output vector y of the student model. s Calculate the distillation loss L with the output vector y7 of the teacher network KD , the formula is as follows:

[0073]

[0074] In addition to the distillation loss L KD In addition, the model also needs to predict y through invasion predici With the invasion tag y laber Calculate the cross entropy loss L CE , to constrain the model to finally obtain the correct intrusion prediction results:

[0075] L CE =-(y laerb log(y predicr ))+(1-y laber )log(1-y predicr )#(2)

[0076] The overall loss L is:

[0077] L=α1L KD +α2L CE #(3)

[0078] Among them, α1 and α2 are used to control the weights of different losses. This solution uses the Adam optimizer to optimize the above loss function L, and iteratively updates the parameters of the student model to make the model perform best in multi-task learning. This structure allows the model to refer to various forms of input features, comprehensively learn general knowledge from the teacher model, and achieve better vulnerability detection performance.

[0079] S500, network intrusion detection model validation and deployment.

[0080] In the embodiment of the present application, the verification of the network intrusion detection model requires evaluating the generalization ability of the network intrusion detection model, quantifying the performance of the network intrusion detection model through accuracy, recall and F1 score, and then deploying the verified qualified network intrusion detection model in a predetermined scenario.

[0081] Specifically, after the model is successfully trained and optimized, it is the model verification stage to verify the accuracy and effectiveness of the model in practical applications. During the verification process, the generalization ability of the model is evaluated using the test set, and its performance is quantified through key performance indicators such as precision, recall, and F1 score. These indicators reflect the reliability of the model in network intrusion detection. During the verification process, typical cases of model prediction failure can be identified through in-depth exploration of error analysis, and the shortcomings of the model under certain types of attacks can be summarized. In particular, through confusion matrix analysis, it can be clear in which specific scenarios the model performs well or has vulnerabilities. Further, by gradually stripping or enhancing certain input features, the sensitivity of the model to different attack methods can be evaluated to ensure that it has strong defense capabilities in a wide range of application scenarios. After the verification stage, the model can be deployed in a variety of predetermined scenarios, including the enterprise's network security system, for real-time monitoring and early warning of potential intrusion behaviors. In addition, the model can also be deployed on a cloud service platform to provide cloud-based network intrusion detection services for various enterprises and individual users. This detection method can timely detect abnormal traffic and malicious behavior to ensure the security of applications, user data and key businesses. Through automated and intelligent intrusion detection, the efficiency and effectiveness of network security management will be greatly improved, thus safeguarding the digital transformation of various industries. Since distillation learning controls the student network to have fewer parameters, it can also run efficiently on resource-constrained devices, such as embedded systems and edge computing devices, meeting the needs of diverse scenarios.

[0082] In summary, this application uses an innovative method that combines a joint adversarial network GAN to generate different types of data such as data packets, data flows, and state features with multi-teacher distillation; a generative adversarial network GAN is used to generate diverse attack samples to solve the problem of a low proportion of abnormal data in real network traffic and unbalanced training samples; through multi-teacher distillation technology, the teacher models that respond to different data sources can extract different modal intrusion features respectively, so that the student model can integrate knowledge through distillation learning to construct a lightweight network intrusion detection model.

[0083] Compared with the prior art, the advantage of this application is that it effectively solves the long-standing problem of unbalanced data samples. By generating adversarial samples through GAN, the model can better cope with unseen attacks, greatly improving the accuracy of unknown threat detection. In addition, the present invention improves the generalization ability and robustness of the model through multi-teacher distillation technology, making it more stable when dealing with diverse attack scenarios. Compared with traditional deep learning intrusion detection methods, the present invention also has significant advantages in computational efficiency. By controlling the number of parameters of the student model, the model can run efficiently in a resource-limited environment, and is particularly suitable for embedded devices and edge computing scenarios.

[0084] It should be understood that, although the steps in the flowcharts involved in the above embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps is not strictly limited in order, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above embodiments may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0085] Based on the same inventive concept, the embodiment of the present application also provides a network intrusion detection device for implementing the above-mentioned. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above-mentioned method, so the specific limitations in one or more network intrusion detection device embodiments provided below can refer to the limitations of the network intrusion detection method above, and will not be repeated here.

[0086] In one embodiment, if Figure 5 As shown, a network intrusion detection device is provided, comprising:

[0087] The construction module 100 is used to construct a multi-dimensional network intrusion detection data set.

[0088] The generation module 200 is used to generate a network intrusion detection model based on attack data of a generative adversarial network (GAN).

[0089] The first training module 300 is used to perform training in conjunction with the multi-teacher network of the GAN.

[0090] The second training module 400 performs multi-teacher distillation network intrusion detection model training.

[0091] The verification and deployment module 500 is used for network intrusion detection model verification and deployment.

[0092] The construction module 100 is also used to integrate multiple data sets based on data packets, data flows, and host status.

[0093] In one of the embodiments, the network intrusion detection model includes: an attack generator and a discriminator;

[0094] The attack generator is used to generate attack data to achieve a balance between positive and negative samples;

[0095] The discriminator is used to distinguish real data from attack data.

[0096] In one embodiment, the generating module 200 is further used for: the attack generator receives random noise to generate attack data; the discriminator receives normal data and attack data and distinguishes true from false;

[0097] The attack generator deceives the discriminator to generate high-quality attack data.

[0098] In one embodiment, the first training module 300 is further used to train different types of teacher networks for different types of data.

[0099] In one of the embodiments, the verification and deployment module 500 is also used to: evaluate the generalization ability of the network intrusion detection model, quantify the performance of the network intrusion detection model through accuracy, recall rate and F1 score; and deploy the verified network intrusion detection model in a predetermined scenario.

[0100] Each module in the above network intrusion detection device can be implemented in whole or in part by software, hardware and their combination. Each module can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the corresponding operations of each module.

[0101] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Figure 6As shown. The computer device includes a processor, a memory and a network interface connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store preset data. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a network intrusion detection method is implemented.

[0102] Those skilled in the art will understand that Figure 6 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0103] In one embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the above-mentioned network intrusion detection method when executing the computer program.

[0104] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the above-mentioned network intrusion detection method is implemented.

[0105] In one embodiment, a computer program product is provided, including a computer program, which implements the above-mentioned network intrusion detection method when executed by a processor.

[0106] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the above-mentioned computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, etc., but are not limited to this.

[0107] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0108] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A network intrusion detection method, characterized in that: The method comprises: Construct a multi-dimensional network intrusion detection dataset; Generate network intrusion detection model based on attack data of generative adversarial network GAN; Combine the GAN with a multi-teacher network for training; Conduct network intrusion detection model training with multi-teacher distillation; Network intrusion detection model validation and deployment.

2. The method according to claim 1, characterized in that The construction of a multi-dimensional network intrusion detection data set includes: Integrate multiple data sets based on packets, flows, and host status.

3. The method according to claim 1, characterized in that The network intrusion detection model includes: an attack generator and a discriminator; The attack generator is used to generate attack data to achieve a balance between positive and negative samples; The discriminator is used to distinguish real data from attack data.

4. The method according to claim 3, characterized in that The attack data generation network intrusion detection model based on the generative adversarial network GAN includes: The attack generator receives random noise to generate attack data; The discriminator receives normal data and attack data and distinguishes true from false; The attack generator deceives the discriminator to generate high-quality attack data.

5. The method according to claim 1, characterized in that: The training of the multi-teacher network combined with the GAN includes: Different types of teacher networks are trained for different types of data.

6. The method according to claim 1, characterized in that The network intrusion detection model verification and deployment includes: Evaluate the generalization ability of the network intrusion detection model and quantify the performance of the network intrusion detection model through accuracy, recall and F1 score; The verified network intrusion detection model is deployed in a predetermined scenario.

7. A network intrusion detection device, characterized in that: The device comprises: Construction module, used to construct a multi-dimensional network intrusion detection dataset; A generation module, used to generate a network intrusion detection model based on attack data of a generative adversarial network (GAN); A first training module, used for training with a multi-teacher network of the GAN; The second training module conducts network intrusion detection model training with multi-teacher distillation; Verification and deployment module, used for network intrusion detection model verification and deployment.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images