Network intrusion detection method and device based on deep learning, and electronic equipment

Abstract

The invention relates to the field of network intrusion detection, and particularly discloses a network intrusion detection method and device based on deep learning, and electronic equipment, and the method comprises the steps: firstly obtaining original network traffic text data and an NSL-KDD data set collected in a network equipment log, and then carrying out the feature extraction and correlation analysis of the original network traffic text data and the NSL-KDD data set through a deep learning technology, and finally, a classification result is obtained through a classifier to judge whether a network traffic abnormity alarm is sent out or not, so that potential network security threats are found in time, corresponding defense measures are taken, and the network security is improved.

Description

Technical Field

[0001] The present application relates to the field of network intrusion detection, and more specifically, to a network intrusion detection method, device and electronic device based on deep learning. Background Art

[0002] With the rapid development and widespread application of information technology, network intrusion has become a major challenge in the field of Internet security. Network intrusion involves unauthorized access, destruction or tampering with computer systems, networks and communication equipment, which may pose a serious threat to information security. In order to deal with this problem, network intrusion detection has emerged as a security mechanism to monitor unknown access and potential threats in the network and take corresponding measures to deal with these threats.

[0003] Traditional network intrusion detection methods usually rely on feature engineering and rule matching, which requires feature extraction from network data, a time-consuming and professional knowledge-requiring process. This approach has some limitations, including the need for manual intervention and maintenance, and the problem of low efficiency in processing large amounts of data. In addition, these methods often have difficulty in discovering new attack methods in a timely manner, so they need to be constantly updated and adjusted to maintain effectiveness.

[0004] Therefore, a network intrusion detection method, device and electronic device based on deep learning are desired. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiments of the present application provide a network intrusion detection method, device and electronic device based on deep learning, which first obtains the original network traffic text data and NSL-KDD data set collected from the network device log, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally obtains the classification result through a classifier to determine whether to issue a network traffic abnormality alarm, so as to timely discover potential network security threats and take corresponding defense measures to improve the security of the network.

[0006] According to one aspect of the present application, a network intrusion detection method based on deep learning is provided, which includes:

[0007] Obtain the original network traffic text data and NSL-KDD dataset collected from network device logs;

[0008] Extracting network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set;

[0009] Based on the network traffic key feature vector and the intrusion detection data set associated feature vector, it is determined whether to issue a network traffic anomaly alarm.

[0010] According to another aspect of the present application, a network intrusion detection device based on deep learning is provided, which includes:

[0011] The network intrusion data acquisition module is used to obtain the original network traffic text data and NSL-KDD data set collected from the network device logs;

[0012] A network intrusion data extraction module, used to extract network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set;

[0013] The network traffic anomaly judgment unit is used to judge whether to issue a network traffic anomaly alarm based on the network traffic key feature vector and the intrusion detection data set associated feature vector.

[0014] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a memory, in which computer program instructions are stored, and when the computer program instructions are executed by the processor, the processor executes the deep learning-based network intrusion detection method as described above.

[0015] Compared with the prior art, the present application provides a network intrusion detection method, device and electronic device based on deep learning, which first obtains the original network traffic text data and NSL-KDD data set collected from the network equipment log, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally obtains the classification result through a classifier to determine whether to issue a network traffic abnormality alarm, so as to timely discover potential network security threats and take corresponding defense measures to improve the security of the network. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0017] Figure 1 Flowchart of a deep learning-based network intrusion detection method according to an embodiment of the present application.

[0018] Figure 2The present invention is a flowchart of extracting network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set in the deep learning-based network intrusion detection method according to an embodiment of the present application.

[0019] Figure 3 The present invention is a flowchart of performing feature encoding on the original network traffic text data collected from the network device log to obtain the key feature vector of the network traffic in the deep learning-based network intrusion detection method according to an embodiment of the present application.

[0020] Figure 4 The present invention is a flowchart of performing feature extraction on the NSL-KDD dataset to obtain multiple intrusion detection dataset feature vectors in a deep learning-based network intrusion detection method according to an embodiment of the present application.

[0021] Figure 5 4 is a block diagram of a network intrusion detection device based on deep learning according to an embodiment of the present application.

[0022] Figure 6 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0024] Exemplary Methods

[0025] Figure 1 FIG. 1 is a flow chart of a network intrusion detection method based on deep learning according to an embodiment of the present application. Figure 1 As shown, according to the deep learning-based network intrusion detection method of the embodiment of the present application, it includes: S110, acquiring the original network traffic text data and the NSL-KDD data set collected from the network device log; S120, extracting the network traffic key feature vector and the intrusion detection data set associated feature vector from the original network traffic text data collected from the network device log and the NSL-KDD data set; S130, judging whether to issue a network traffic anomaly alarm based on the network traffic key feature vector and the intrusion detection data set associated feature vector.

[0026] In the above-mentioned network intrusion detection method based on deep learning, the step S110 obtains the original network traffic text data and NSL-KDD data set collected from the network device log. It should be understood that network intrusion refers to unauthorized individuals or entities using computer network systems to illegally invade other people's networks, obtain confidential information, destroy system functions or engage in other malicious behaviors. This behavior may include using loopholes, malware or denial of service attacks to illegally access and operate network systems, posing a serious threat to network security and data protection. Traditional network intrusion detection methods usually require feature engineering and rule matching, which requires time and expertise, and there is a need for manual intervention and maintenance, as well as the problem of inefficient processing of large amounts of data. These methods are usually difficult to discover new attack methods in a timely manner, so they need to be continuously updated and adjusted to maintain effectiveness. The technical solution of the present application combines the original network traffic text data and NSL-KDD data set collected from the network device log through deep learning technology to determine whether to issue a network traffic anomaly alarm to improve the efficiency and accuracy of network intrusion detection. Among them, the original network traffic text data in the network device log contains detailed records of network communications, including the information of sent and received packets, communication protocols, source and target IP addresses, etc. These data record the actual communication activities in the network and are the key information source for deep learning models to learn network behaviors and detect anomalies. On the other hand, the NSL-KDD dataset is a commonly used network intrusion detection dataset, which contains a large amount of network traffic data and corresponding intrusion behavior data in a simulated real network environment. This dataset is widely used to evaluate the performance and effectiveness of intrusion detection systems. By combining network device log data and the NSL-KDD dataset, rich training samples and scenarios can be provided to help deep learning models better understand different types of network traffic patterns and intrusion behaviors. The purpose of obtaining these two types of data is to build a comprehensive and representative dataset to train deep learning models to identify normal network traffic and potential intrusion behaviors. Among them, the original network traffic text data provides real-time network communication information, which helps the model learn the characteristics and patterns of network traffic, while the NSL-KDD dataset provides a variety of intrusion behavior samples to help the model identify various known and unknown intrusion types. By combining these two data sources, deep learning models can more accurately learn and infer the normal and abnormal behaviors of network traffic, thereby improving the accuracy and robustness of network intrusion detection systems.

[0027] In the above-mentioned network intrusion detection method based on deep learning, the step S120 extracts the network traffic key feature vector and the intrusion detection data set associated feature vector from the original network traffic text data collected from the network device log and the NSL-KDD data set. It should be understood that the extraction of the network traffic key feature vector and the intrusion detection data set associated feature vector from the original network traffic text data collected from the network device log and the NSL-KDD data set is to effectively represent the network traffic data and the intrusion behavior, thereby supporting the deep learning model to perform accurate intrusion detection.

[0028] Figure 2 The present invention is a flowchart of extracting network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set in the network intrusion detection method based on deep learning according to an embodiment of the present application. Figure 2 As shown, in a specific embodiment of the present application, the step S120 includes: S121, feature encoding the original network traffic text data collected from the network device log to obtain the network traffic key feature vector; S122, feature extraction of the NSL-KDD data set to obtain multiple intrusion detection data set feature vectors; S123, feature encoding the multiple intrusion detection data set feature vectors to obtain the intrusion detection data set associated feature vector. It should be understood that feature encoding can convert the original text data into numerical feature vectors, which can better express the key information and patterns in the network traffic data. Among them, the extraction of the network traffic key feature vector can help the model capture the key features in the network traffic data through feature encoding, such as source and target IP addresses, port numbers, protocol types, data packet sizes and other information. These feature vectors can better describe the patterns and laws of network communication, so that the model can better understand the characteristics and changes of network traffic data. In addition, feature encoding can also help the model process different types of feature data, unify their representations, and enable the model to more effectively learn and infer patterns and abnormal behaviors in network traffic data.

[0029] Furthermore, the NSL-KDD dataset is a commonly used intrusion detection dataset, which contains different types of network traffic data and corresponding intrusion behavior labels. By performing feature extraction on these data, complex network traffic data can be converted into more informative feature vectors, thereby helping machine learning models to better understand the data and make accurate predictions. Among them, the feature extraction process involves selecting and refining the most relevant features, which may involve various aspects of network communication, such as packet size, communication frequency, protocol type, source and destination addresses, etc. By extracting these features, the dimension of the data can be reduced, redundant information can be eliminated, and key features related to intrusion behavior can be highlighted, which helps the model better distinguish between normal traffic and malicious traffic.

[0030] Furthermore, by extracting the associated feature vectors of the intrusion detection data set, the feature vectors in different data sets can be integrated into a unified feature space, so that the model can more comprehensively learn and understand the feature information in different data sets. In this way, the model can more accurately identify abnormal behaviors and intrusion attacks in network traffic, and improve the detection rate and accuracy of the intrusion detection system.

[0031] Figure 3 The present invention is a flowchart of performing feature encoding on the original network traffic text data collected from the network device log to obtain the network traffic key feature vector in the network intrusion detection method based on deep learning according to an embodiment of the present application. Figure 3As shown, in a specific embodiment of the present application, the step S121 includes: S1211, passing the original network traffic text data collected from the network device log through the original network traffic text semantic context encoder to obtain the network traffic text semantic feature vector; S1212, passing the network traffic text semantic feature vector through a network traffic feature encoder including a fully connected layer to obtain the network traffic key feature vector. It should be understood that the original network traffic text data usually contains a large amount of text information, such as the source address, destination address, protocol type, packet size, etc. of the network communication. Although this information is of great significance for describing network traffic, it may be directly used as an input feature. There may be information redundancy and difficulty in using semantic information. Through the processing of the semantic context encoder, these text data can be converted into semantic feature vectors to better express the semantic information in the text data. In this way, the original network traffic text data is converted into a vector representation with rich semantic information, so that the model can better understand the meaning and association of the text data, thereby improving the analysis and detection capabilities of network traffic. Specifically, the original network traffic text data collected from the network device log is segmented to obtain a network traffic word sequence; the embedding layer of the original network traffic text semantic context encoder is used to map each word in the network traffic word sequence to a word embedding vector to obtain a sequence of network traffic word embedding vectors; the sequence of network traffic word embedding vectors is semantically encoded based on global context using the converter-based Bert model of the original network traffic text semantic context encoder to obtain multiple feature vectors; and the multiple feature vectors are cascaded to obtain the network traffic text semantic feature vector.

[0032] Furthermore, as a commonly used layer type in neural networks, the fully connected layer has strong expression and fitting capabilities, and can perform nonlinear transformation and combination of the input semantic feature vectors, thereby obtaining a higher-dimensional and richer feature representation. Through the processing of the fully connected layer, the network traffic text semantic feature vector can be feature extracted and abstracted at a deeper level, capturing more complex feature patterns and associated information. The fully connected layer in the network traffic feature encoder can learn more abstract and advanced feature representations, which helps to extract key features in network traffic data, such as abnormal behavior, attack patterns, etc. These key feature vectors can help the system more accurately identify and classify different types of network traffic, thereby improving the performance and robustness of the security detection system. Through the processing of the network traffic feature encoder, the network traffic text semantic feature vector is converted into a network traffic key feature vector, which enables the system to better understand and utilize important information in the network traffic data. Specifically, the fully connected layer of the network traffic feature encoder containing the fully connected layer is used to perform full connection encoding on the network traffic text semantic feature vector in the forward pass of the layer to extract the high-dimensional implicit features of the feature values ​​at each position in the network traffic text semantic feature vector to obtain the network traffic key feature vector.

[0033] Figure 4 The flowchart is a method for extracting features from the NSL-KDD dataset to obtain feature vectors of multiple intrusion detection datasets in a network intrusion detection method based on deep learning according to an embodiment of the present application. Figure 4 As shown, in a specific embodiment of the present application, the step S122 includes: S1221, preprocessing the NSL-KDD dataset to obtain a dataset input sequence; S1222, passing the dataset input sequence through an LSTM-based dataset semantic encoder to obtain the multiple intrusion detection dataset feature vectors. It should be understood that by preprocessing the NSL-KDD dataset to obtain a dataset input sequence, a clear and structured data input can be provided for subsequent machine learning models, which helps to improve the training effect and prediction performance of the model, so as to be better applied to the field of network traffic analysis and security detection.

[0034] Furthermore, LSTM (Long Short-Term Memory) is a recurrent neural network variant suitable for processing sequence data, which can effectively learn long-term dependencies and is suitable for processing data with time series properties. Through the learning and memory mechanism of the LSTM network, the time information and sequence order in the data set input sequence are encoded as semantic information in the feature vector, providing a richer data representation. The LSTM-based data set semantic encoder can convert the data set input sequence into feature vectors of fixed length, which contain key information and characteristic patterns in the data set. This representation helps to reduce the data dimension and noise impact, improve the generalization ability and robustness of the model, and enable the intrusion detection system to better distinguish normal traffic from malicious traffic. Specifically, the embedding layer of the LSTM-based data set semantic encoder is used to map each word in the data set input sequence to a word embedding vector to obtain a sequence of data set word embedding vectors; the converter-based Bert model of the LSTM-based data set semantic encoder is used to perform global context semantic encoding on the sequence of data set word embedding vectors to obtain the multiple intrusion detection data set feature vectors.

[0035] In a specific embodiment of the present application, the step S123 includes: passing the multiple intrusion detection data set feature vectors through an intrusion detection data set feature encoder based on an attention mechanism to obtain multiple intrusion detection data set attention feature vectors; integrating the multiple intrusion detection data set attention feature vectors into the intrusion detection data set associated feature vector. It should be understood that the attention mechanism is widely used in deep learning, and by learning the importance of each feature in a given context, the model can focus on the features that are most helpful to the current task. Through the intrusion detection data set feature encoder based on the attention mechanism, multiple feature vectors can be dynamically weighted and combined to generate multiple intrusion detection data set attention feature vectors, which further highlight and emphasize the key features in the data set. By introducing the attention mechanism, the model can better handle the complex relationships and noise in the data set, and improve the detection ability of abnormal behavior and intrusion. The attention feature vector can not only better characterize the important features of the data set, but also help the model to more accurately distinguish normal traffic from malicious traffic, and improve the accuracy and robustness of the intrusion detection system.

[0036] Furthermore, the process of integrating the attention feature vectors of multiple intrusion detection datasets into the associated feature vector of the intrusion detection dataset aims to comprehensively utilize the information of each feature vector to obtain a more comprehensive and integrated data representation, thereby improving the intrusion detection system's ability to understand and analyze the overall dataset. This integration process can help the system better capture the associations and interactions between features. The process of integrating the attention feature vectors into the associated feature vector usually involves weighted summation or concatenation of multiple feature vectors to retain the information of each feature vector and fuse their characteristics. This integration method can make full use of the advantages of each feature vector, make up for the limitations of a single feature vector, and improve the diversity and richness of data representation.

[0037] In the above-mentioned network intrusion detection method based on deep learning, the step S130 determines whether to issue a network traffic anomaly alarm based on the network traffic key feature vector and the intrusion detection data set associated feature vector. It should be understood that through the key feature vector of the network traffic, the system can capture important features in the traffic data, such as packet size, source and destination address, protocol type, etc., which are of great significance for identifying abnormal behavior. At the same time, the associated feature vector of the intrusion detection data set can provide a comprehensive understanding of the overall data set, including the association and importance between different features, and the sensitivity to abnormal behavior. Combining these two feature vectors, the system can comprehensively consider the key features of the network traffic and the comprehensive feature representation of the intrusion detection data set, so as to more comprehensively evaluate whether the current traffic has abnormal behavior. By comparing the feature representation of the current traffic with the known intrusion mode and normal behavior mode, the system can determine whether to issue a network traffic anomaly alarm, timely discover potential security threats and take corresponding countermeasures to ensure the security and stability of the network system.

[0038] In a specific embodiment of the present application, the step S130 includes: performing sparsity constraints based on implicit feature expression on the key feature vector of network traffic and the associated feature vector of intrusion detection data set to obtain a network traffic anomaly classification feature vector; passing the network traffic anomaly classification feature vector through a classifier to obtain a classification result, and the classification result is used to determine whether to issue a network traffic anomaly alarm. It should be understood that in the technical solution of the present application, considering that the key feature vector of network traffic is extracted from the original network traffic text data, it usually contains key indicators of network traffic, such as traffic size, protocol type, port number, etc. These features mainly focus on the details and attributes of network communication to better describe the network traffic situation. The associated feature vector of the intrusion detection data set represents the intrusion detection related features extracted from the NSL-KDD data set, such as connection duration, number of failed logins, etc. These features are mainly used to identify whether the system has been invaded or attacked, and focus on security features. Since the key feature vector of network traffic and the associated feature vector of intrusion detection data set come from the fields of network traffic and intrusion detection, respectively, their feature representation methods, information content and targets are different, so there may be a problem of inconsistent representation when merging. This inconsistency may cause certain features to be unable to effectively complement or integrate each other, thus affecting the final fusion effect. In addition, some features may exist in both the key feature vector of network traffic and the associated feature vector of intrusion detection dataset. Such overlapping features will lead to information duplication. Some features may be related in a certain sense, but they may provide a lot of redundant information when fused, resulting in excessive repetition that has a negative impact on model performance. When merging feature vectors from two different sources, if the overlapping features and redundant information are not fully processed and screened, the fused feature vector will contain a large amount of unnecessary or duplicate information, thus affecting the accuracy and efficiency of the final classification result. Based on this, in the technical solution of the present application, sparsity constraints based on implicit feature expression are applied to the key feature vector of network traffic and the associated feature vector of intrusion detection dataset.

[0039] Among them, the sparsity constraint based on the implicit expression of features is performed on the key feature vector of network traffic and the associated feature vector of intrusion detection data set to obtain the network traffic anomaly classification feature vector, including: calculating the first autocorrelation sample covariance matrix of the key feature vector of network traffic, wherein the eigenvalue of each position in the first autocorrelation sample covariance matrix is ​​the variance between the eigenvalues ​​of the corresponding two positions in the key feature vector of network traffic; calculating the second autocorrelation sample covariance matrix of the associated feature vector of intrusion detection data set, wherein the eigenvalue of each position in the second autocorrelation sample covariance matrix is ​​the variance between the eigenvalues ​​of the corresponding two positions in the associated feature vector of intrusion detection data set; using the principal component analysis method to process the first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix to obtain the key feature vector of network traffic. The invention discloses a method for calculating the feature implicit expression of the network traffic key feature vector and the feature implicit expression of the intrusion detection dataset associated feature vector; using L1 regularization to calculate the feature implicit inter-feature constraint matrix between the feature implicit expression of the network traffic key feature vector and the feature implicit expression of the intrusion detection dataset associated feature vector; multiplying the network traffic key feature vector and the intrusion detection dataset associated feature vector by the feature implicit inter-feature constraint matrix respectively to map the network traffic key feature vector and the intrusion detection dataset associated feature vector into the feature space of the feature implicit inter-feature constraint matrix to obtain the mapped network traffic key feature vector and the mapped intrusion detection dataset associated feature vector; and calculating the position-weighted sum between the mapped network traffic key feature vector and the mapped intrusion detection dataset associated feature vector to obtain the network traffic anomaly classification feature vector.

[0040] Here, the key feature vectors of network traffic and the associated feature vectors of intrusion detection data sets are constrained by sparsity based on implicit feature expression, which helps to eliminate irrelevant or redundant features by retaining the most important features, thereby improving feature selectivity and reducing the complexity of the model and the risk of overfitting. In addition, the sparsity constraint based on implicit feature expression can make the fused feature training less sensitive to noise and outliers, thereby improving the robustness of the network traffic anomaly classification feature vector. At the same time, the network traffic anomaly classification feature vector after the sparsity constraint based on implicit feature expression contains only a small number of non-zero elements, making it easier to interpret, and also helps to understand the behavior of the model and identify the most important features. And because it only contains a small number of non-zero elements, it requires fewer resources in terms of storage and processing, which can significantly improve computational efficiency.

[0041] In particular, the first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix are processed using a principal component analysis method to obtain a feature implicit expression of a key feature vector of network traffic and a feature implicit expression of a feature vector associated with an intrusion detection dataset, including: creating a Spring Web application; creating a data model class, the data model class being used to represent the first autocorrelation sample covariance matrix, the second autocorrelation sample covariance matrix, the feature implicit expression of the key feature vector of network traffic, and the feature implicit expression of the feature vector associated with the intrusion detection dataset; writing the principal component analysis method in the Spring Web application; creating a REST API endpoint, the REST API endpoint being used to allow a client to send the first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix; and deploying the Spring Web application on a Web server.

[0042] It should be understood that Spring Web provides a convenient framework for creating RESTful APIs that allow clients to interact with applications through HTTP requests. This makes it easy to deploy algorithms and clients can easily access it from various platforms and devices. Moreover, Spring Web is a lightweight framework that does not have a significant impact on the performance of the application. It is also highly scalable and can handle applications from small to large. At the same time, Spring Web provides built-in security features such as authentication and authorization to protect your application from unauthorized access. Moreover, Spring Web applications can be easily deployed to various web servers such as Apache Tomcat, Nginx, and CloudFoundry. This makes it simple to deploy algorithms to production environments. Further, Spring Web has a large and active community that provides documentation, tutorials, and examples. This makes it easy to learn and use the framework. In addition, the SpringWeb mechanism allows algorithms to be integrated with other Spring components, such as data access, business logic, and messaging. This can simplify the development and maintenance of applications.

[0043] In summary, Spring Web mechanism provides a powerful and easy-to-use platform to deploy sparsity-constrained feature fusion algorithms based on implicit feature expression. It provides advantages such as RESTful API, lightweight and scalability, security, easy deployment, and community support.

[0044] Among them, the partial implementation code of using principal component analysis to process the first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix to obtain the feature implicit expression of the key feature vector of network traffic and the feature implicit expression of the associated feature vector of intrusion detection data set is as follows.

[0045]

[0046]

[0047] Furthermore, the role of the classifier is to map the input network traffic anomaly classification feature vector to different categories or labels to indicate whether the traffic data belongs to normal behavior, abnormal behavior or a specific type of intrusion behavior. By inputting the network traffic anomaly classification feature vector into the classifier, the system can quickly and accurately determine whether the current network traffic has abnormal behavior. Based on the results output by the classifier, the system can automatically determine whether it is necessary to trigger a network traffic anomaly alarm and promptly notify the network administrator or security team for further investigation and response. This automated anomaly detection and response mechanism can greatly shorten the response time of security incidents, reduce security risks, and protect network systems from potential threats and attacks.

[0048] In summary, the embodiment of the present application first obtains the original network traffic text data and the NSL-KDD data set collected from the network device log, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally obtains the classification result through the classifier to determine whether to issue a network traffic anomaly alarm, so as to timely discover potential network security threats and take corresponding defense measures to improve the security of the network.

[0049] Exemplary Systems

[0050] Figure 5 FIG. 1 is a block diagram of a network intrusion detection device based on deep learning according to an embodiment of the present application. Figure 5 As shown, according to the deep learning-based network intrusion detection device 100 of the embodiment of the present application, it includes: a network intrusion data acquisition module 110, which is used to obtain the original network traffic text data and NSL-KDD data set collected from the network device log; a network intrusion data extraction module 120, which is used to extract the network traffic key feature vector and the intrusion detection data set associated feature vector from the original network traffic text data collected from the network device log and the NSL-KDD data set; a network traffic anomaly judgment unit 130, which is used to judge whether to issue a network traffic anomaly alarm based on the network traffic key feature vector and the intrusion detection data set associated feature vector.

[0051] As described above, the network intrusion detection device 100 based on deep learning according to the embodiment of the present application can be implemented in various terminal devices, such as a server deployed with a network intrusion detection algorithm based on deep learning. In one example, the network intrusion detection device 100 based on deep learning can be integrated into the terminal device as a software module and / or a hardware module. For example, the network intrusion detection device 100 based on deep learning can be a software module in the operating system of the terminal device, or can be an application developed for the terminal device; of course, the network intrusion detection device 100 based on deep learning can also be one of the many hardware modules of the terminal device.

[0052] Alternatively, in another example, the deep learning-based network intrusion detection apparatus 100 and the terminal device may also be separate devices, and the deep learning-based network intrusion detection apparatus 100 may be connected to the terminal device via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0053] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned network intrusion detection device based on deep learning have been referred to above. Figures 1 to 4 The description of the deep learning based network intrusion detection method has been introduced in detail, and therefore, its repeated description will be omitted.

[0054] Exemplary Electronic Devices

[0055] Below, reference Figure 6 To describe an electronic device according to an embodiment of the present application.

[0056] like Figure 6 As shown, the electronic device 10 includes an input device 11, an input interface 12, a central processing unit 13, a memory 14, an output interface 15, an output device 16, and a bus 17. The input interface 12, the central processing unit 13, the memory 14, and the output interface 15 are connected to each other through the bus 17, and the input device 11 and the output device 16 are connected to the bus 17 through the input interface 14 and the output interface 15, respectively, and then connected to other components of the electronic device 10.

[0057] Specifically, the input device 11 receives input information from the outside and transmits the input information to the central processing unit 13 through the input interface 12; the central processing unit 13 processes the input information based on the computer executable instructions stored in the memory 14 to generate output information, temporarily or permanently stores the output information in the memory 14, and then transmits the output information to the output device 16 through the output interface 15; the output device 16 outputs the output information to the outside of the electronic device 10 for user use.

[0058] In one embodiment, Figure 6 The electronic device 10 shown can be implemented as a network device, which may include: a memory configured to store programs; a processor configured to run the programs stored in the memory to execute any one of the deep learning-based network intrusion detection methods described in the above embodiments.

[0059] According to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable storage medium.

[0060] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0061] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present application, but the present application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of the present application, and these modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A network intrusion detection method based on deep learning, characterized in that: include: Obtain the original network traffic text data and NSL-KDD dataset collected from network device logs; Extracting network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set; Based on the network traffic key feature vector and the intrusion detection data set associated feature vector, it is determined whether to issue a network traffic anomaly alarm.

2. The network intrusion detection method based on deep learning according to claim 1 is characterized in that: Extracting network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set, including: Performing feature encoding on the original network traffic text data collected from the network device log to obtain the network traffic key feature vector; Performing feature extraction on the NSL-KDD data set to obtain multiple intrusion detection data set feature vectors; Feature encoding is performed on the multiple intrusion detection data set feature vectors to obtain the intrusion detection data set associated feature vector.

3. The network intrusion detection method based on deep learning according to claim 2 is characterized in that: Performing feature encoding on the original network traffic text data collected from the network device log to obtain the network traffic key feature vector includes: Passing the original network traffic text data collected from the network device log through the original network traffic text semantic context encoder to obtain a network traffic text semantic feature vector; The network traffic text semantic feature vector is passed through a network traffic feature encoder including a fully connected layer to obtain the network traffic key feature vector.

4. The network intrusion detection method based on deep learning according to claim 3 is characterized in that: Feature extraction is performed on the NSL-KDD dataset to obtain multiple intrusion detection dataset feature vectors, including: Performing data preprocessing on the NSL-KDD data set to obtain a data set input sequence; The data set input sequence is passed through a data set semantic encoder based on LSTM to obtain the multiple intrusion detection data set feature vectors.

5. The network intrusion detection method based on deep learning according to claim 4 is characterized in that: Performing feature encoding on the plurality of intrusion detection data set feature vectors to obtain the intrusion detection data set associated feature vectors includes: Passing the plurality of intrusion detection dataset feature vectors through an intrusion detection dataset feature encoder based on an attention mechanism to obtain a plurality of intrusion detection dataset attention feature vectors; The multiple intrusion detection dataset attention feature vectors are integrated into the intrusion detection dataset association feature vector.

6. The network intrusion detection method based on deep learning according to claim 5 is characterized in that: Based on the network traffic key feature vector and the intrusion detection data set associated feature vector, determining whether to issue a network traffic anomaly alarm includes: The key feature vectors of network traffic and the associated feature vectors of intrusion detection datasets are constrained by sparsity based on implicit feature expression to obtain the feature vectors for network traffic anomaly classification. The network traffic anomaly classification feature vector is passed through a classifier to obtain a classification result, and the classification result is used to determine whether to issue a network traffic anomaly alarm.

7. The network intrusion detection method based on deep learning according to claim 6 is characterized in that: The key feature vectors of network traffic and the associated feature vectors of intrusion detection datasets are constrained by sparsity based on implicit feature expression to obtain the network traffic anomaly classification feature vector, including: Calculating a first autocorrelation sample covariance matrix of the network traffic key feature vector, wherein the eigenvalue of each position in the first autocorrelation sample covariance matrix is ​​the variance between the eigenvalues ​​of two corresponding positions in the network traffic key feature vector; Calculating a second autocorrelation sample covariance matrix of the associated feature vector of the intrusion detection data set, wherein the eigenvalue of each position in the second autocorrelation sample covariance matrix is ​​the variance between the eigenvalues ​​of two corresponding positions in the associated feature vector of the intrusion detection data set; Using principal component analysis to process the first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix to obtain a feature implicit expression of a key feature vector of network traffic and a feature implicit expression of a feature vector associated with an intrusion detection data set; Using L1 regularization to calculate the implicit feature constraint matrix between the implicit feature expression of the key feature vector of the network traffic and the implicit feature expression of the associated feature vector of the intrusion detection dataset; Multiplying the network traffic key feature vector and the intrusion detection data set associated feature vector by the feature implicit constraint matrix respectively to map the network traffic key feature vector and the intrusion detection data set associated feature vector into the feature space of the feature implicit constraint matrix to obtain a mapped network traffic key feature vector and a mapped intrusion detection data set associated feature vector; and The position-weighted sum between the mapped network traffic key feature vector and the mapped intrusion detection data set associated feature vector is calculated to obtain the network traffic anomaly classification feature vector.

8. The network intrusion detection method based on deep learning according to claim 7 is characterized in that: The first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix are processed using a principal component analysis method to obtain a feature implicit expression of a key feature vector of network traffic and a feature implicit expression of a feature vector associated with an intrusion detection data set, including: Create a Spring web application; Creating a data model class, the data model class is used to represent the first autocorrelation sample covariance matrix, the second autocorrelation sample covariance matrix, the feature implicit expression of the key feature vector of the network traffic, and the feature implicit expression of the intrusion detection data set associated feature vector; Writing the principal component analysis method in the Spring Web application; Creating a REST API endpoint, the REST API endpoint being used to allow a client to send the first autocorrelation sample covariance matrix and the second autocorrelation sample covariance matrix; and Deploy the Spring Web application on a Web server.

9. A network intrusion detection device based on deep learning, characterized in that: include: The network intrusion data acquisition module is used to obtain the original network traffic text data and NSL-KDD data set collected from the network device logs; A network intrusion data extraction module, used to extract network traffic key feature vectors and intrusion detection data set associated feature vectors from the original network traffic text data collected from the network device log and the NSL-KDD data set; The network traffic anomaly judgment unit is used to judge whether to issue a network traffic anomaly alarm based on the network traffic key feature vector and the intrusion detection data set associated feature vector.

10. An electronic device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the deep learning-based network intrusion detection method as described in any one of claims 1 to 8.

Images