Attack intrusion detection method and system based on tree convolutional neural network

Abstract

The invention provides an attack intrusion detection method and system based on a tree convolutional neural network. The method comprises the following steps: shunting a data packet flow extracted from a network flow track of a data set by using a time window, and then converting the data packet flow into an array structure; inputting the data packet flow of the array structure into a tree-shaped convolutional neural network to obtain a network attack category; the tree-shaped convolutional neural network is obtained through training by using a training set, and the training set comprises a data flow sample and an actual network attack category corresponding to the data flow sample. According to the method, the data stream is preprocessed, and the extracted data packet stream is shunted by using the time window, so that the hierarchical relationship and the structural characteristics of the data can be effectively captured; attack intrusion detection is carried out by using the tree-shaped convolutional neural network, continuously changing attack modes and diversified attack types can be resisted, a novel attack mode is updated and learned, meanwhile, the detection capability of known attack types is kept, and efficient and reliable network attack detection is realized.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to an attack intrusion detection method and system based on a tree-like convolutional neural network. Background Art

[0002] With the rapid development of the Internet and the widespread popularity of network applications, network security issues have become increasingly prominent. Cyber ​​attacks not only threaten personal privacy and data security, but also pose a serious challenge to the economic interests of enterprises and national security. As network threats continue to increase, researchers have explored a variety of methods to improve the accuracy and efficiency of detection.

[0003] Traditional machine learning methods include support vector machine (SVM), decision tree (DT), random forest (RF), and K-nearest neighbor (KNN) etc. These methods usually rely on feature engineering, which is to extract a set of manually designed features from network traffic data and then use these features for classification and detection.

[0004] Deep learning methods have greatly improved the effectiveness of network attack detection through automatic feature learning capabilities. In recent years, deep learning models such as Convolutional Neural Network (CNN), Recurrent Neural Network (RNN) and Long Short Term Memory (LSTM) have been widely used in network attack detection. Graph Neural Network (GNN) has performed well in processing structured data in recent years. Network traffic data can be naturally represented as a graph structure, which makes GNN a promising method for network attack detection. In order to make full use of the advantages of different methods, some studies have proposed hybrid models. For example, CNN and LSTM models are combined for network attack detection. CNN is used to extract spatial features, while LSTM is used to capture temporal dependencies. Compared with models such as support vector machines, recurrent neural networks, spiking neural networks (SNN) and feedforward neural networks (FNN), the hybrid model performs well on multiple public datasets and shows superior results.

[0005] The above network attack detection systems mostly rely on feature extraction and rule-based detection mechanisms. Although they can detect known attack patterns to a certain extent, their effectiveness gradually decreases with increasingly complex and changeable attack behaviors. Based on this, how to design efficient network attack detection methods has become an important research direction in the field of network security. Summary of the invention

[0006] The present invention provides an attack intrusion detection method and system based on a tree-like convolutional neural network, which is used to solve the defect of low accuracy of network attack detection in the prior art. On the one hand, by using a tree-like convolutional neural network for attack intrusion detection, the detection accuracy can be effectively improved, and it has good adaptability and learning ability for new attack modes; at the same time, the preprocessing method can better capture the timing characteristics of the data packet flow, providing more effective input for subsequent detection.

[0007] The present invention provides an attack intrusion detection method based on a tree-like convolutional neural network, comprising:

[0008] Use time windows to separate the packet flows extracted from the network traffic trace of the dataset and convert them into array structures;

[0009] Inputting the data packet stream of the array structure into a tree-like convolutional neural network to obtain a network attack category output by the tree-like convolutional neural network;

[0010] The tree-like convolutional neural network is trained by using a training set, where the training set includes data stream samples and actual network attack categories corresponding to the data stream samples.

[0011] According to an attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention, the method uses a time window to divert the data packet flow extracted from the network traffic trajectory of the data set and convert it into an array structure, including:

[0012] Obtain all data packets of the same bidirectional service flow in each time window from the traffic tracking file in the data set,

[0013] Extract features from each packet;

[0014] Generate samples with an array structure of [n, f] according to the characteristics of the data packets of the same bidirectional business flow in each time window, where n is the maximum number of data packets collected for each bidirectional business flow in the time window, and f is the number of characteristics of the data packets;

[0015] An array is constructed according to the samples, wherein each row in the array represents samples of data packets of each bidirectional business flow captured in the same time window, and each column represents samples of data packets of the same bidirectional business flow.

[0016] According to an attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention, the features extracted from each data packet do not include IP addresses, TCP ports, UDP ports, link layer encapsulation types, and application layer attributes.

[0017] According to an attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention, after generating samples with an array structure of [n, f] according to the characteristics of the data packets of the same bidirectional service flow in each time window, the method further includes:

[0018] Normalize each feature of the data packet in the sample to [0,1];

[0019] If the number of data packets in the time window is less than n, the features of the missing data packets in the sample are zero-filled.

[0020] According to an attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention, before inputting the data packet flow of the array structure into the tree-like convolutional neural network and obtaining the network attack category output by the tree-like convolutional neural network, the method further includes:

[0021] The duration and n corresponding to the time window are used as hyperparameters of the tree-like convolutional neural network;

[0022] The F-measure score of the tree-like convolutional neural network is used as a performance indicator to tune the hyperparameters.

[0023] According to an attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention, the calculation formula of the F-measure score is:

[0024]

[0025]

[0026]

[0027] Among them, F-measure is the F-measure score, PPV is precision, TPR is recall, TP is true positive, which refers to the number of positive samples correctly classified as positive, FP is false positive, which refers to the number of negative labeled samples misclassified as positive, and FN is false negative, which refers to the number of positive samples misclassified as negative.

[0028] The present invention also provides an attack intrusion detection system based on a tree-like convolutional neural network, comprising:

[0029] A preprocessing module, which is used to separate the packet flows extracted from the network traffic trace of the data set using a time window and convert them into an array structure;

[0030] A detection module, used for inputting the data packet flow of the array structure into a tree-like convolutional neural network to obtain a network attack category output by the tree-like convolutional neural network;

[0031] The tree-like convolutional neural network is trained by using a training set, where the training set includes data stream samples and actual network attack categories corresponding to the data stream samples.

[0032] The present invention also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, an attack intrusion detection method based on a tree-like convolutional neural network as described above is implemented.

[0033] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described attack intrusion detection methods based on a tree-like convolutional neural network.

[0034] The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements any of the above-mentioned attack intrusion detection methods based on a tree-like convolutional neural network.

[0035] The attack intrusion detection method and system based on the tree-like convolutional neural network provided by the present invention preprocess the data stream, use the time window to divert the extracted data packet stream, consider the sharing characteristics of the communication link to simulate the online traffic capture process, and facilitate the tree-like convolutional neural network to effectively capture the hierarchical relationship and structural characteristics of the data. The tree-like convolutional neural network Tree-CNN is used for attack intrusion detection, which can resist the ever-changing attack patterns and diversified attack types. The tree-like convolutional neural network can maintain the detection capability of known attack types while updating and learning new attack patterns, thereby realizing efficient and reliable network attack detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1It is a flow chart of the attack intrusion detection method based on the tree-like convolutional neural network provided by the present invention;

[0038] Figure 2 It is a structural schematic diagram of a Tree-CNN network in the attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention;

[0039] Figure 3 It is an example of Tree-CNN in incremental learning in the attack intrusion detection method based on tree convolutional neural network provided by the present invention;

[0040] Figure 4 It is a schematic diagram of the preprocessing process of a data set in the attack intrusion detection method based on a tree-like convolutional neural network provided by the present invention;

[0041] Figure 5 It is a schematic diagram of the sensitivity of the model to the hyperparameter n in the attack intrusion detection method based on the tree-like convolutional neural network provided by the present invention;

[0042] Figure 6 It is a schematic diagram of the sensitivity of the model to the hyperparameter t in the attack intrusion detection method based on the tree-like convolutional neural network provided by the present invention;

[0043] Figure 7 It is a structural schematic diagram of an attack intrusion detection system based on a tree-like convolutional neural network provided by the present invention;

[0044] Figure 8 It is a structural schematic diagram of the electronic device provided by the present invention. DETAILED DESCRIPTION

[0045] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0046] Combine the following Figure 1 The invention describes an attack intrusion detection method based on a tree-like convolutional neural network, comprising:

[0047] Step 101, using a time window to split the data packet flow extracted from the network traffic trajectory of the data set and convert it into an array structure;

[0048] Network traffic consists of data flows between endpoints. Due to the shared nature of communication links, packets from different data flows are multiplexed, resulting in packets from the same flow being transmitted separately. Therefore, processing real-time traffic is completely different from processing static datasets containing complete flows. Many existing works rely on the ability to generate flow-level statistics, which is not feasible in online systems.

[0049] In this embodiment, a window is created to convert the flows extracted from the network traffic traces of the dataset into an array-like data structure and divide them into sub-flows based on the time window. By shaping the input into packet flows in this way, a spatial data representation is created that enables a convolutional neural network (CNN) to learn the characteristics of various attacks and benign flows through convolutional filters sliding on these inputs, thereby identifying significant patterns. This form of input is compatible with the traffic captured in online deployments.

[0050] Step 102, inputting the data packet flow of the array structure into a tree-like convolutional neural network to obtain a network attack category output by the tree-like convolutional neural network;

[0051] The tree-like convolutional neural network is trained by using a training set, where the training set includes data stream samples and actual network attack categories corresponding to the data stream samples.

[0052] Compared with traditional planar convolutional neural networks, tree-convolutional neural networks (Tree-CNN) show significant advantages in processing unstructured data and complex time series data, especially in the field of network attack detection, where they show great potential in combating ever-changing attack patterns and diverse attack types.

[0053] In addition, tree-like convolutional neural networks also have unique advantages in solving the problem of "catastrophic forgetting", which involves the loss of memory of old tasks when the model learns new tasks, which may lead to a decrease in detection performance. Through its special structural design and optimization strategy, tree-like convolutional neural networks can maintain the ability to detect known attack types while updating and learning new attack patterns, achieving efficient and reliable network attack detection.

[0054] Inspired by hierarchical classifiers, the Tree-CNN model performs cyberattack detection by connecting multiple nodes in a tree-like manner. Each node contains a deep convolutional neural network (DCNN) that is trained to classify the node's input into one of its child nodes. The highest node of the tree is the root node, where the first step of classification is performed. Branch nodes act as intermediate nodes, and each node has a parent node and two or more child nodes. Based on the classification label, the input is passed to the child nodes, which further classify the input until it reaches the leaf node. Each leaf node is uniquely associated with a cyberattack category. Figure 2 The root node and branch nodes of the two-stage classification network are shown. Each output second-level branch node is a leaf node, which is the output node of the branch CNN.

[0055] First, assume that there is a trained model for identifying a certain number of attacks. The model can be a layered model with multiple convolutional neural networks, or just a convolutional neural network acting as a root node with multiple leaf nodes. The new task is to learn to identify attacks belonging to M new categories. Starting from the root node, a portion of samples from the new training set are provided as input. The output layer generates a three-dimensional matrix O K×M×I , where K is the number of child nodes of the root node, M is the number of new categories, and I is the number of samples in each category. The element O(k, m, i) in the matrix represents the output of the kth neuron for the i-th sample belonging to the m-th category.

[0056] Then calculate the average output O avg (k, m):

[0057]

[0058] Then calculate the Softmax likelihood:

[0059]

[0060] Get the likelihood matrix L K×M , where the elements are:

[0061] L(k,m)=P(O avg (k,m))

[0062] Then from L K×MGenerate an ordered list S containing M objects. Each object uniquely corresponds to one of the new M classes. Each object S[i] contains the label, the top 3 average Softmax output values, and its corresponding node, sorted in descending order by the highest Softmax value, v1≥v2≥v3. The sorting is to ensure that new categories with high likelihood values ​​are added to the Tree-CNN first, and the Softmax likelihood values ​​are used instead of the number of samples classified to each child node because they convert the output response to an exponential scale, which helps to better identify the similarity of the traffic to one of the existing labels. After constructing S, look at its first element S[1] and take one of three actions:

[0063] 1. Add a new category to an existing child node: If v1 is greater than the next value v2 by a threshold α (customized), the category shows strong similarity and association with a specific child node. The new category will be added to the corresponding child node;

[0064] 2. Merge two child nodes to form a new node and add a new category: If the new category has more than one child node with a strong probability, we can combine them to form a new child node. This happens when v1-v2<α and v2-v3>β (another threshold defined by the user). For example, if the first 3 likelihood values ​​are v1=0.48, v2=0.45, v3=0.05. Assuming n2 is a leaf node, merge n2 into n1 and add the new class to n1.

[0065] 3. Add the new category as a new child node: If the probability of the new category is not significantly higher than the other values ​​(v1-v2<α and v2-v3<β), or all child nodes are full, then expand the network horizontally by adding the new category as a new child node. This node will be a leaf node.

[0066] As the root node continues to add new branches and sub-branches, branch nodes with more sub-nodes tend to be heavier. New incoming categories tend to have higher Softmax likelihoods, and branch nodes have more sub-nodes. To prevent Tree-CNN from becoming unbalanced, a maximum number of sub-nodes that a branch node can have is set. When calculating L(k, m), replace Indicates k complete branches that have reached the limit on the number of child nodes per branch. First, set S to 1 and mark the corresponding position in Tree-CNN, remove the column related to the category from L(k, m), check and modify the output nodes of those complete branch nodes. Finally, generate an ordered list S and iteratively apply the condition to the new S[1] until all new categories are assigned to positions under the root node.

[0067] Figure 3A specific example of Tree-CNN in incremental learning is shown. In the initial state, the network is a convolutional neural network that can classify three categories (C1, C2, C3). The goal is to improve the classification ability of the network by introducing three new categories. The Softmax probability table is shown in the figure. Category C4 meets condition 1, and it is added to the leaf node corresponding to C1 and converted into a new branch node B1; for category C5, condition 2 is met, and we merge C2 and C3 into a new branch node C5; for category C6, since its Softmax probability is not significantly higher than other categories, it is directly added to the network as a new category.

[0068] Although this example is for a single-layer Tree-CNN, the algorithm can be extended to deeper Tree-CNN models. When the root node completes the tree growth algorithm for M categories, it can proceed to the next layer of the tree. The same steps apply to the expansion of child nodes. When new classes are added, the tree growth process is semi-supervised, and the algorithm will decide how to grow the tree under user constraints. Users can limit parameters according to system requirements, such as the maximum number of child nodes of a node, the maximum depth of the tree, etc.

[0069] After the location of the new class is determined in the tree, training based on supervised gradient descent is performed on the new or modified nodes. This makes it unnecessary to modify the entire network, only the affected part of the network needs to be retrained or fine-tuned. In each incremental learning phase, the root node is trained based on all available data because it needs to learn how to classify all objects into the new branch nodes. During inference, a branch node is only activated when the root node classifies the input to a branch node. If the root node is misclassified, the result will be wrong regardless of how the branch node is classified. Therefore, branch nodes are only trained with the class they are assigned to. If the lookup table of a branch node has not changed during the incremental learning phase, it is kept as is.

[0070] The datasets used by users assign unique labels to each object class. However, the root and branch nodes of Tree-CNN group, merge, and split these classes according to the algorithm's needs. To ensure label consistency, each node in Tree-CNN maintains its own label transition lookup table. For example, when a new class is added to an existing output node of the root node, the lookup table is updated to reflect the new class assignment. Similarly, when a new class is added as a new node, the class label and the new output node are added as new entries in the lookup table. Ultimately, each class is associated with a unique leaf node, so leaf nodes do not require a lookup table. Whenever two nodes are merged, the node with the lower average Softmax value will be integrated with the node with the higher average Softmax value of the new class under consideration. If the two Softmax values ​​are equal, a random selection is made. At the root node level, the lookup table is modified as follows: the class label originally assigned to node A is now assigned to node B. The lookup table of node B after the merger will add these class labels from node A as new entries and assign them to the new leaf nodes.

[0071] This embodiment preprocesses the data flow, uses a time window to divert the extracted data packet flow, considers the sharing characteristics of the communication link to simulate the online traffic capture process, and facilitates the tree-like convolutional neural network to effectively capture the hierarchical relationship and structural characteristics of the data. The tree-like convolutional neural network Tree-CNN is used for attack intrusion detection, which can combat the ever-changing attack patterns and diverse attack types. The tree-like convolutional neural network can maintain the detection capability of known attack types while updating and learning new attack patterns, thereby achieving efficient and reliable network attack detection.

[0072] Based on the above embodiment, the present embodiment uses a time window to divert the data packet flow extracted from the network traffic trajectory of the data set and convert it into an array structure, including:

[0073] Obtain all data packets of the same bidirectional service flow in each time window from the traffic tracking file in the data set,

[0074] Extract features from each packet;

[0075] Generate samples with an array structure of [n, f] according to the characteristics of the data packets of the same bidirectional business flow in each time window, where n is the maximum number of data packets collected for each bidirectional business flow in the time window, and f is the number of characteristics of the data packets;

[0076] An array is constructed according to the samples, wherein each row in the array represents samples of data packets of each bidirectional business flow captured in the same time window, and each column represents samples of data packets of the same bidirectional business flow.

[0077] Given a traffic trace file in the dataset and a predefined time window of length t seconds, all packets captured from time t0 to t0+t are collected from the file. From each packet, the algorithm extracts multiple features, such as 15 features.

[0078] In order to simulate the online traffic capture process, this embodiment collects traffic for a certain period of time t and sends it to the tree-like convolutional neural network for anomaly detection. Therefore, the tree-like convolutional neural network needs to make decisions based on part of the traffic, rather than relying on the entire life cycle of the traffic. In order to simulate this process, this embodiment groups the data packets of the same bidirectional service flow in chronological order to form samples with an array structure of [n,f]. Among them, n is the maximum number of data packets collected by the parsing process for each flow within the time window, and f is the number of features.

[0079] Repeat the same operation for the data packets in the time window [t0+t, t0+2t] until the end of the file. The preprocessing process of the data set is as follows Figure 4 The output of this process can be viewed as a two-dimensional array of samples. Each row in the array represents a sample of packets captured in the same time window, while each column represents a sample of packets belonging to the same bidirectional flow.

[0080] Logically, this embodiment assumes that a short time window enables the online system to detect network attacks within a very short time frame. On the contrary, higher t and n values ​​provide the detection algorithm with more information about the traffic, and this embodiment expects to obtain higher detection accuracy.

[0081] Based on the above embodiments, the features extracted from each data packet in this embodiment do not include IP (Internet Protocol) addresses, TCP (Transmission Control Protocol) ports or UDP (User Datagram Protocol) ports (specific to the terminal host and user application), link layer encapsulation types (depending on the network interface), and application layer attributes (such as IRC (Internet Relay Chat) or HTTP (Hypertext Transfer Protocol) protocol attributes).

[0082] This embodiment eliminates features that are not conducive to the promotion of the model, thereby improving the universality of the model.

[0083] On the basis of the above embodiment, after generating samples with an array structure of [n, f] according to the characteristics of the data packets in each time window of the same bidirectional service flow, this embodiment further includes:

[0084] Normalize each feature of the data packet in the sample to [0,1];

[0085] If the number of data packets in the time window is less than n, the features of the missing data packets in the sample are zero-filled.

[0086] Data streams longer than n within the time window are truncated, while shorter data streams are zero-padded at the end in the next stage after normalization so that each sample has a fixed length n, because having samples of fixed length is a necessary condition for CNN to be able to learn on the complete sample set.

[0087] Based on the above embodiment, before inputting the data packet flow of the array structure into the tree-like convolutional neural network and obtaining the network attack category output by the tree-like convolutional neural network, the present embodiment also includes:

[0088] The duration and n corresponding to the time window are used as hyperparameters of the tree-like convolutional neural network;

[0089] The F-measure score of the tree-like convolutional neural network is used as a performance indicator to tune the hyperparameters.

[0090] Tuning hyperparameters is a critical step in optimizing model accuracy, as their values ​​can significantly affect the model's complexity and learning process. Before conducting experiments, appropriate hyperparameter values ​​were selected based on preliminary tuning results and empirical descriptions of each parameter. Next, a grid search strategy was used to systematically explore the hyperparameter space, using the F-measure score as the performance metric.

[0091] In the grid search, the training process for each point will continue indefinitely until the loss function does not decrease for 25 consecutive times. Then, the F-measure score of the point is recorded and moved to the next point. The entire dataset is divided into training set, validation set and test set. In order to ensure the generalization ability of the model, only the validation set is used for hyperparameter tuning, and the test set is not used to avoid artificially improving the model performance. The test set remains completely invisible and is only used for the final experimental results.

[0092] The maximum number of packets, n, is important for characterizing the traffic and capturing its temporal patterns. The parameter n represents the maximum number of packets of a flow that are recorded in chronological order in a sample. The resulting collection of packets describes a portion of the life of the flow within a given time window, including relative timing information of the packets. For repetition-based network attacks that use a small set of information at an approximately constant rate, a small value of n is sufficient to discover temporal patterns between packet features, and thus only requires a limited number of trainable parameters. However, more complex attacks (such as the one performed with the HOIC tool, which uses multiple HTTP headers to make requests look legitimate) require a larger number of packets to achieve the desired accuracy. Experiments were performed with n between 1 and 100, and the performance was compared based on the F-measure score.

[0093] Figure 5 The effect of n values ​​on F-measure for different time window durations is shown. When n < 5, the F-measure score increases steadily with the value of n and then stabilizes when n ≥ 5. However, an increase in the F-measure score is still observed before n = 100. Although lower n values ​​can be used to speed up detection time (fewer convolution operations) and reduce storage and RAM requirements (smaller sample size), a balance needs to be struck between high accuracy and low resource consumption.

[0094] The time window t is used to simulate the capture process of the online system. The F-measure scores for time windows ranging from 1 to 100 seconds are evaluated under different n values. The results are shown in Figure 6 As shown in Figure 2. Although the number of samples in the training set decreases as t increases, CNN is relatively insensitive to this hyperparameter when n>1. When n=1, the traffic is represented by samples of shape [1,f], i.e., there is only one packet, regardless of the duration of the time window. In this case, since CNN cannot associate the attributes of different packets within the same sample, the F-measure score is more affected by the number of samples in the training set (the more samples, the better).

[0095] After a comprehensive grid search of multiple hyperparameter combinations, the preprocessing hyperparameter combination with the largest F-measure score on the validation set was selected, namely n = 100 and t = 100. These choices balance resource consumption while ensuring model performance, achieving the desired goals of the study.

[0096] Based on the above embodiments, the proposed preprocessing method and Tree-CNN model are evaluated in detail in this embodiment. The evaluation indicators include accuracy (ACC), precision rate (PPV), recall rate (TPR) and F-measure score (F-measure), which are expressed by the following formula:

[0097]

[0098] Among them, F-measure is the F-measure score, PPV is precision, TPR is recall, ACC is accuracy; TP is true positive, which refers to the number of positive samples correctly classified as positive; TN is true negative, which refers to the number of negative samples correctly predicted as negative; FP is false positive, which refers to the number of negative labeled samples misclassified as positive; FN is false negative, which refers to the number of positive samples misclassified as negative.

[0099] This embodiment can use ISCX 2012 and CIC-IDS 2017 datasets for experiments. These two datasets provide network communication data recorded in pcap (Packet Capture) format, covering normal network traffic and various network attack behaviors, such as distributed denial of service (DDoS), infiltration, website attack, and brute force.

[0100] In the data preprocessing stage, the original data packets are converted into an array-like structure. During the dataset construction process, each dataset is divided into a training set (80%) and a test set (20%), of which 10% of the training set is used for model validation. This division is based on data streams, ensuring that samples of the same data stream are assigned to the same category, thereby avoiding data leakage during training. Through the method of annual data ratio balancing, the training data of each year are merged to form a comprehensive training set. The validation set and the test set are processed in the same way, and finally the training set and validation set for model training and parameter adjustment, as well as the test set for model performance evaluation, are obtained. In addition, the test set can be used in an integrated manner or separated by year for advanced performance comparison.

[0101] The experiments were conducted on Windows 11 operating system, using Anaconda as the running environment, and using the Pytorch deep learning framework. The hardware configuration included an NVIDIA RTX 4060 GPU (Graphics Processing Unit) equipped with 8GB of memory. The experiments were conducted using the test set of the dataset, and the results were compared with several classic and advanced machine learning models.

[0102] Experiments were conducted on various types of network attacks, and the performance of the Tree-CNN model was compared with the support vector machine (SVM), decision tree (DT), random forest (RF), K-nearest neighbor (KNN), and CNN-LSTM models. The detailed detection results under different network attacks are shown in Tables 1 to 4.

[0103] Table 1 Results of machine learning algorithm for detecting penetration attacks

[0104]

[0105] Table 2 Results of machine learning algorithm for Web Attack detection

[0106]

[0107] Table 3 Results of machine learning algorithm for detecting DDoS attacks

[0108]

[0109] Table 4 Results of machine learning algorithm for Brute Force detection

[0110]

[0111]

[0112] Experimental results show that although CNN-LSTM is slightly higher in some indicators, our Tree-CNN model performance is still competitive overall. Our model can effectively distinguish various malicious network attacks from normal traffic. Thanks to the convolution method of Tree-CNN, the model can accurately identify the attack pattern regardless of its position in the flow. Our preprocessing method combined with Tree-CNN solves the limitations of traditional deep learning models in processing time context. Although LSTM has advantages in processing time series, it has disadvantages in training difficulty and long sequence processing speed.

[0113] Overall, the Tree-CNN model shows significant superiority in detecting different types of network attacks, especially DDoS and brute force attacks. This performance advantage proves the effectiveness and applicability of our proposed method and provides strong support for future network security research.

[0114] The following is a description of the attack intrusion detection system based on a tree-like convolutional neural network provided by the present invention. The attack intrusion detection system based on a tree-like convolutional neural network described below and the attack intrusion detection method based on a tree-like convolutional neural network described above can be referenced to each other.

[0115] like Figure 7 As shown, the system includes a pre-processing module 701 and a detection module 702, wherein:

[0116] The preprocessing module 701 is used to use a time window to divert the data packet flow extracted from the network traffic trajectory of the data set and convert it into an array structure;

[0117] The detection module 702 is used to input the data packet flow of the array structure into the tree-like convolutional neural network to obtain the network attack category output by the tree-like convolutional neural network;

[0118] The tree-like convolutional neural network is trained by using a training set, where the training set includes data stream samples and actual network attack categories corresponding to the data stream samples.

[0119] This embodiment preprocesses the data flow, uses a time window to divert the extracted data packet flow, considers the sharing characteristics of the communication link to simulate the online traffic capture process, and facilitates the tree-like convolutional neural network to effectively capture the hierarchical relationship and structural characteristics of the data. The tree-like convolutional neural network Tree-CNN is used for attack intrusion detection, which can combat the ever-changing attack patterns and diverse attack types. The tree-like convolutional neural network can maintain the detection capability of known attack types while updating and learning new attack patterns, thereby achieving efficient and reliable network attack detection.

[0120] Figure 8 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 8 As shown, the electronic device may include: a processor 810, a communication interface 820, a memory 830 and a communication bus 840, wherein the processor 810, the communication interface 820 and the memory 830 communicate with each other through the communication bus 840. The processor 810 may call the logic instructions in the memory 830 to execute an attack intrusion detection method based on a tree-like convolutional neural network, the method comprising: using a time window to divert a data packet flow extracted from a network traffic trajectory of a data set and converting it into an array structure; inputting the data packet flow of the array structure into a tree-like convolutional neural network to obtain a network attack category; the tree-like convolutional neural network is obtained by training using a training set, the training set comprising a data stream sample and an actual network attack category corresponding to the data stream sample.

[0121] In addition, the logic instructions in the above-mentioned memory 830 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0122] On the other hand, the present invention also provides a computer program product, which includes a computer program. The computer program can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the attack intrusion detection method based on a tree-like convolutional neural network provided by the above methods, and the method includes: using a time window to divert the data packet flow extracted from the network traffic trajectory of the data set and convert it into an array structure; inputting the data packet flow of the array structure into a tree-like convolutional neural network to obtain a network attack category; the tree-like convolutional neural network is obtained by training using a training set, and the training set includes data flow samples and actual network attack categories corresponding to the data flow samples.

[0123] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the attack intrusion detection method based on a tree-like convolutional neural network provided by the above-mentioned methods, the method comprising: using a time window to divert the data packet flow extracted from the network traffic trajectory of a data set and convert it into an array structure; inputting the data packet flow of the array structure into a tree-like convolutional neural network to obtain a network attack category; the tree-like convolutional neural network is obtained by training using a training set, and the training set includes data flow samples and actual network attack categories corresponding to the data flow samples.

[0124] The system embodiment described above is merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative work.

[0125] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An attack intrusion detection method based on a tree-like convolutional neural network, characterized in that: include: Use time windows to separate the packet flows extracted from the network traffic trace of the dataset and convert them into array structures; Inputting the data packet stream of the array structure into a tree-like convolutional neural network to obtain a network attack category output by the tree-like convolutional neural network; The tree-like convolutional neural network is trained by using a training set, where the training set includes data stream samples and actual network attack categories corresponding to the data stream samples.

2. The attack intrusion detection method based on tree-like convolutional neural network according to claim 1 is characterized in that: The method uses a time window to separate the data packet flow extracted from the network traffic trajectory of the data set and convert it into an array structure, including: Obtain all data packets of the same bidirectional service flow in each time window from the traffic tracking file in the data set, Extract features from each packet; Generate samples with an array structure of [n, f] according to the characteristics of the data packets of the same bidirectional business flow in each time window, where n is the maximum number of data packets collected for each bidirectional business flow in the time window, and f is the number of characteristics of the data packets; An array is constructed according to the samples, wherein each row in the array represents samples of data packets of each bidirectional business flow captured in the same time window, and each column represents samples of data packets of the same bidirectional business flow.

3. The attack intrusion detection method based on tree-like convolutional neural network according to claim 2 is characterized in that: The features extracted from each data packet do not include IP address, TCP port, UDP port, link layer encapsulation type and application layer attributes.

4. The attack intrusion detection method based on tree-like convolutional neural network according to claim 2 is characterized in that: After generating samples with an array structure of [n, f] according to the characteristics of the data packets in each time window of the same bidirectional service flow, the method further includes: Normalize each feature of the data packet in the sample to [0,1]; If the number of data packets in the time window is less than n, the features of the missing data packets in the sample are zero-filled.

5. The attack intrusion detection method based on tree-like convolutional neural network according to claim 2 is characterized in that: Before inputting the data packet flow of the array structure into the tree-like convolutional neural network to obtain the network attack category output by the tree-like convolutional neural network, the method further includes: The duration and n corresponding to the time window are used as hyperparameters of the tree-like convolutional neural network; The F-measure score of the tree-like convolutional neural network is used as a performance indicator to tune the hyperparameters.

6. The attack intrusion detection method based on tree-like convolutional neural network according to claim 2 is characterized in that: The calculation formula of the F-measure score is: Among them, F-measure is the F-measure score, PPV is precision, TPR is recall, TP is true positive, which refers to the number of positive samples correctly classified as positive, FP is false positive, which refers to the number of negative labeled samples misclassified as positive, and FN is false negative, which refers to the number of positive samples misclassified as negative.

7. An attack intrusion detection system based on a tree-like convolutional neural network, characterized in that: include: A preprocessing module, which is used to separate the packet flows extracted from the network traffic trace of the data set using a time window and convert them into an array structure; A detection module, used for inputting the data packet flow of the array structure into a tree-like convolutional neural network to obtain a network attack category output by the tree-like convolutional neural network; The tree-like convolutional neural network is trained by using a training set, where the training set includes data stream samples and actual network attack categories corresponding to the data stream samples.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the program, the attack intrusion detection method based on the tree-like convolutional neural network as described in any one of claims 1 to 6 is implemented.

9. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the attack intrusion detection method based on a tree-like convolutional neural network as described in any one of claims 1 to 6 is implemented.

10. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the attack intrusion detection method based on a tree-like convolutional neural network as described in any one of claims 1 to 6 is implemented.

Images