Network intrusion detection method and system based on SLAN

Abstract

The invention discloses a network intrusion detection method and system based on an SLAN, and relates to the technical field of network intrusion detection, and the method comprises the steps: receiving and storing data from a network; constructing a model, performing feature extraction to obtain a first feature, and performing time sequence feature capture on the first feature to obtain a second feature; performing feature enhancement on the second feature to obtain a third feature, and integrating and processing the third feature to obtain a fourth feature; and classifying the intrusion according to the fourth feature, and taking measures. By using the lightweight convolution operation and the Channel Shuffle mechanism, the calculation complexity and memory use are greatly reduced, so that during real-time network traffic processing, feature extraction can be completed with lower calculation overhead, local modes and complex features can be effectively extracted from network traffic data, and the real-time network traffic processing efficiency is improved. The sensitivity and the detection accuracy of attack behaviors are improved, different types of network attacks can be adapted, and the detection capability of unknown attacks is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, in particular to a network intrusion detection method and system based on SLAN. Background Art

[0002] Network security issues are becoming increasingly serious. Network intrusion detection systems (IDS) are an important means of protecting computer networks from malicious attacks. Traditional intrusion detection methods mainly rely on feature matching to detect abnormal activities in network traffic based on a known attack feature library. However, these methods have limitations when facing new and unknown attacks because they rely on pre-defined attack patterns.

[0003] In recent years, the rise of deep learning technology has provided new solutions for network intrusion detection. Deep learning models such as convolutional neural networks (CNN) and long short-term memory networks (LSTM) can automatically extract and learn features from complex network traffic data, enhancing the ability to identify abnormal behaviors. However, these models still face challenges when processing high-dimensional and time-series data, especially how to effectively extract key features from massive data and accurately classify them.

[0004] The present invention constructs the ShufflenetV2-LSTM-Attention Network (SLAN) model. SLAN combines the advantages of ShufflenetV2, LSTM and attention mechanism, and provides a more intelligent and efficient solution for network intrusion detection through multi-angle feature fusion and dynamic learning mechanism, which can better cope with the evolving network threats. Summary of the invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is: how to solve the problem that traditional network intrusion detection methods are unable to effectively extract and utilize traffic patterns, timing dynamics and channel-level features in network traffic data, and it is difficult to deeply capture and analyze timing features, thereby being insufficient in identifying new and unknown attacks; how to effectively extract key features from massive data and accurately classify them.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a network intrusion detection method based on SLAN, comprising: receiving and storing data from the network; building a model, performing feature extraction to obtain a first feature, capturing the time series feature of the first feature to obtain a second feature; performing feature enhancement on the second feature to obtain a third feature, integrating and processing the third feature to obtain a fourth feature; classifying the intrusion according to the fourth feature, and taking measures.

[0008] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, the data from the network includes timing signal segments and historical traffic data; the data blocks of timing signal segments and traffic data enter the processing stage, each data packet is regarded as a data block containing multi-dimensional features, the data is organized into a two-dimensional matrix, each data block represents a different part or stage of the signal and traffic data, and feature extraction is performed on the data block.

[0009] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, the model refers to SLAN, namely ShufflenetV2-LSTM-Attention Network, ShufflenetV2-LSTM and attention mechanism; the first features include traffic patterns, timing dynamics and channel-level features.

[0010] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, the feature extraction includes using the ShufflenetV2 model to extract features from network traffic data to obtain the first feature, the convolutional layer CNN of ShufflenetV2 is combined with the Leaky ReLU activation function to extract local patterns and complex features from the data, and the Leaky ReLU allows negative values ​​to be transmitted with a small slope.

[0011] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, the timing feature capture includes extracting features and then inputting them into the LSTM network to capture the timing characteristics and time dependencies of the data, ensuring that the model understands the dynamic changes in network traffic, and obtaining the second feature.

[0012] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, wherein: the feature enhancement includes introducing an attention mechanism to strengthen the model's attention to key features, so as to obtain a third feature; the integration and processing of the third feature includes integrating and processing the features enhanced by the attention mechanism through a fully connected layer and an inner product operation, so as to obtain a fourth feature.

[0013] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, the classification of intrusions includes using the fourth feature to construct an ROC curve, analyzing the recognition performance under different thresholds, and based on the optimal threshold determined by the ROC curve, performing binary classification processing on the network signal to divide the signal into two categories: recognizable intrusion and non-ROC probability range. The recognizable intrusion is the determined malicious attack behavior. For the identified recognizable intrusion behavior, corresponding defense measures are automatically taken and relevant information is recorded. At the same time, unrecognizable intrusions within the non-ROC probability range are regarded as potential threats and marked for subsequent analysis.

[0014] Another object of the present invention is to provide a system of a network intrusion detection method based on SLAN, which can solve a network intrusion detection problem based on SLAN by constructing a network intrusion detection system.

[0015] To solve the above technical problems, the present invention provides the following technical solutions: a network intrusion detection system based on SLAN, comprising a data acquisition module, a feature extraction module, a feature enhancement integration module and a classification module; the data acquisition module is used to receive and store data from the network; the feature extraction module is used to build a model, perform feature extraction, obtain a first feature, and perform time series feature capture on the first feature to obtain a second feature; the feature enhancement integration module is used to perform feature enhancement on the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature; the classification module is used to classify the intrusion according to the fourth feature and take measures.

[0016] A computer device includes a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the steps of the above-mentioned SLAN-based network intrusion detection method are implemented.

[0017] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned SLAN-based network intrusion detection method.

[0018] The beneficial effects of the present invention are as follows: the ShufflenetV2 network of the SLAN-based network intrusion detection method provided by the present invention greatly reduces the computational complexity and memory usage by using lightweight convolution operations and Channel Shuffle mechanisms. This design enables feature extraction to be completed with low computational overhead during real-time network traffic processing. Accurate local feature capture: The convolution layer of ShufflenetV2 combined with the Leaky ReLU activation function can effectively extract local patterns and complex features from network traffic data. The extraction of such local features is crucial for discovering hidden attack patterns and abnormal behaviors.

[0019] Long Short-Term Memory (LSTM) Network: LSTM network can effectively capture long-term dependencies in data by introducing a gating mechanism. This is particularly important for processing dynamic changes in network traffic (such as the temporal characteristics of attack patterns).

[0020] Self-attention mechanism: This mechanism helps the model focus on key features when facing variable network traffic, thereby improving sensitivity to attack behaviors and detection accuracy. Advantages of Leaky ReLU: The Leaky ReLU activation function can effectively avoid the "neuron death" problem when processing network traffic data. Its nonlinear characteristics enable the model to better handle noise and abnormal data, and improve its responsiveness to features.

[0021] The system can update and learn dynamic classification thresholds in real time according to changes in the network environment. This dynamic adjustment capability enables the system to adapt to different types of network attacks and improves the detection ability of unknown attacks. Real-time monitoring and defense: The system can not only detect network intrusions, but also automatically take corresponding defense measures and record relevant information. For detected "identifiable intrusions", the system will perform defense processing; for potential threats "not within the ROC probability range", they will be marked for subsequent in-depth analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0023] Figure 1 The present invention provides a flow chart of a SLAN-based network intrusion detection method according to the first embodiment of the present invention.

[0024] Figure 2 A convolutional neural network traffic feature extraction structure diagram of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0025] Figure 3 A schematic diagram of ChannelShuffle of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0026] Figure 4 A comparison diagram of the ShufflenetV2 basic units of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0027] Figure 5 An LSTM model structure diagram of a SLAN-based network intrusion detection method provided for the first embodiment of the present invention.

[0028] Figure 6 A feature extraction diagram of Transformer+ResNet-CNN of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0029] Figure 7 An architectural diagram of a SLAN model of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0030] Figure 8 An intrusion attack monitoring design diagram of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0031] Fig. 9 A structural diagram of a SLAN-based network intrusion detection system provided for the second embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0033] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0034] Example 1, reference Figures 1 to 8 , which is the first embodiment of the present invention, provides a network intrusion detection method based on SLAN, including: receiving and storing data from the network; building a model, performing feature extraction to obtain a first feature, capturing the time series feature of the first feature to obtain a second feature; enhancing the second feature to obtain a third feature, integrating and processing the third feature to obtain a fourth feature; classifying the intrusion according to the fourth feature, and taking measures.

[0035] The present invention constructs the ShufflenetV2-LSTM-Attention Network (SLAN) model. SLAN combines the advantages of ShufflenetV2, LSTM and attention mechanism, and provides a more intelligent and efficient solution for network intrusion detection through multi-angle feature fusion and dynamic learning mechanism, which can better cope with the evolving network threats.

[0036] Convolutional Neural Network (CNN) was originally designed to process images and videos, but it is also applicable to text data. CNN is good at identifying local features of data. It reduces the number of network parameters by sharing weights, extracts diversified features using multiple channels, and gradually obtains higher-level semantic information through multi-layer convolution. For network traffic data, CNN can effectively extract timing patterns and traffic features, providing higher-precision recognition of traffic anomalies and attack behaviors. Figure 2 shown.

[0037] The main function of convolution is to use the convolution kernel to perform convolution operations on the input data to extract key data content, which is similar to the filter in signal processing. Pooling can not only reduce model parameters, but also maintain invariance to operations such as translation, scaling, and rotation.

[0038] The convolution kernel slides on the matrix of network traffic data to extract local features. Suppose we represent the network traffic data as a matrix V(w i ), convolution kernel F k = k*d will perform sliding calculations on this matrix, and obtain local eigenvalues ​​by convolution operations with local areas of the data matrix. This step is similar to the filter in signal processing, which extracts important features from the data through convolution operations. The calculation formula is as follows:

[0039] c i =f(F k *V(w i )+b)

[0040] Among them, c i · represents the local eigenvalue obtained by one convolution calculation. After traversing the matrix V once, the complete local eigenvector C = (c1, c2…, c3) can be obtained. In order to reduce the vector dimension, C is also pooled after convolution to obtain the reduced dimension feature d = (d1, d2,…, d3).

[0041] Pooling operation To reduce the dimension of the feature vector and maintain robustness to operations such as translation, scaling, and rotation of the data, we perform a pooling operation on the local feature vector obtained by convolution. Pooling operation can reduce computational complexity and extract more stable features. Common pooling methods include maximum pooling (taking the maximum value in the local area) and average pooling (calculating the average value of the local area). Features after dimensionality reduction = pooling (V)

[0042] ShuffleNetV2 is a lightweight convolutional neural network proposed by Megvii Research Institute in 2018. It is an upgraded version of ShuffleNetV1.

[0043] One of the biggest features of the ShuffleNet series of networks is the use of the Channel Shuffle operation, which aims to smoothly disrupt the original data channels and establish connections between data in different channels. It is often used to solve the problem of data information not flowing between channels in a separated convolutional network. Figure 3 As shown, this operation is usually divided into three steps: first, dividing the data into N groups by channel, second, transposing the data, and third, concatenating the transformed data into new features.

[0044] The ShuffleNet series of networks are characterized by efficient computing, high accuracy and lightweight design, and are mainly used in tasks such as image classification and target detection. The comparison chart of the basic units of ShuffleNetV1 and ShufflenetV2 is as follows: Figure 4 shown.

[0045] Among them, (a) and (b) are the basic units of ShuffleNetV2. ShuffleNetV2 innovatively proposed four improvement criteria: first, when the number of input and output channels is the same, the memory access cost (MAC) is minimized; second, when the number of groups is too large during group convolution, the MAC will increase; third, fragmentation (i.e. branching) operations will reduce parallel acceleration; fourth, element-wise operations will increase memory and time.

[0046] In the basic module (a), the Channel Split operation is first used to divide the input channel into two parts to reduce the number of branch channels. Referring to criterion one, the left branch performs identity mapping, the right branch uses three continuous convolutions, and the input and output channels are the same. According to criterion two, the 1×1 convolution in the structure no longer uses grouped convolution. According to criterion three, fewer categories of branches are used inside the unit structure, such as the left branch directly performs identity mapping. According to criterion four, the outputs of the two branches no longer use the Add operation, but the Concat operation, and then the Concat results of the two branches are Channel Shuffled to ensure that the information of the two branches flows between each other. For the downsampling module (b), Channel Split is no longer used. Both the left and right branches use convolutions with a stride of 2 for downsampling. Finally, the two branches are Concat operated, the feature map space size is halved, and the number of channels is doubled. The overall framework of ShufflenetV2 is shown in Table 1.

[0047] Table 1 Overall framework of ShufflenetV2

[0048]

[0049]

[0050] The Long Short-Term Memory (LSTM) network is a specially designed recurrent neural network (RNN) that aims to solve the gradient vanishing and gradient exploding problems that occur in traditional RNNs during training. Compared with ordinary RNNs, LSTM introduces a gating mechanism to manage the retention and forgetting of information, thereby better capturing long-term dependencies in text. This makes LSTM perform better when processing long sequences.

[0051] The basic structure of the LSTM network is as follows Figure 5 shown.

[0052] Forget gate: This gate controls which information should be discarded. It receives information from the previous hidden state and the current input information and passes them to a sigmoid function, which outputs a value between 0 and 1. Values ​​close to 0 indicate that the information should be discarded, and values ​​close to 1 indicate that it should be retained. Its calculation formula is as follows:

[0053] f t =σ(W f *[h t-1 ,x t ]+b f )

[0054] Among them, f t is the output of the forget gate, σ is the sigmoid function, W f is the weight matrix, h t-1 is the hidden state at the previous moment, x t is the current input, b f is the bias term.

[0055] Input gate: This gate is responsible for updating the cell state. First, it passes the previous hidden state and the current input into a sigmoid function to determine how much information to update. Then, the same input is passed into a tanh function to generate a vector of candidate values. Finally, the input gate updates the cell state by multiplying the two results. Its calculation formula is as follows:

[0056] i t =σ([W f *[h t-1 ,x t ]+b i )

[0057] C t =tanh(W c *[h t-1 ,x t ]+b c )

[0058] C t =f t *Ct-1 +i t *C t

[0059] Among them, i t is the output of the input gate, C t is the candidate cell state, C t is the updated cell state, W f and C t =tanh(W c *[h t-1 ,x t ]+b c ) is the weight matrix, b i and b c is the bias term.

[0060] Output gate: This gate determines the value of the next hidden state. It first passes the previous hidden state and the current input into a sigmoid function, outputting a value between 0 and 1. It then passes the updated cell state into the tanh function and multiplies the result with the output of the sigmoid function to determine the information contained in the hidden state. Ultimately, the hidden state serves as the output of the current cell. Its calculation formula is as follows:

[0061] O t =σ([W o *[h t-1 ,x t ]+b o )

[0062] h t =O t *tanh(C t )

[0063] Among them, O t is the output of the output gate, h t is the current hidden state, W o is the weight matrix, b o is the bias term.

[0064] Although traditional LSTM can only use the output information of the previous moment to predict the output of the current moment, in some cases, the output information of the current moment may also be related to the output of the future moment. To solve this problem, the bidirectional long short-term memory network (BiLSTM) was introduced. BiLSTM consists of a forward LSTM and a reverse LSTM, but the forward and reverse LSTM networks are not directly connected. Its output is jointly determined by the hidden states of the forward and reverse LSTM layers. In this way, BiLSTM can capture future and past information in the sequence at the same time.

[0065] The self-attention mechanism is a neural network mechanism for processing sequence data. Its core idea is to strengthen the correlation representation within the sequence by calculating the dependencies between each position in the sequence, thereby capturing richer contextual information. Its working principle includes the following steps: Input representation: First, each element in the input sequence (such as words, image blocks, etc.) is converted into a high-dimensional vector representation, and these vectors form an input matrix; Calculate attention weights: For each position in the input sequence, the attention weight is obtained by calculating the correlation between the position and all other positions. This correlation is usually calculated by a dot product operation, and then normalized (for example, using the Softmax function) to obtain a weight matrix; Weighted summation: Use the calculated attention weights to perform weighted summation on the representations of all positions in the input sequence; Output generation: Pass the result of the weighted summation to the subsequent network layer to generate the final output representation.

[0066] LeakyReLU (Leaky Rectified Linear Unit) is a variant of the ReLU activation function, which is used to solve the problem of neuron death that may be caused by ReLU under negative input. Unlike ReLU, LeakyReLU has a small non-zero slope in the negative input area, usually with a value such as 0.01 or 0.1. This improvement enables LeakyReLU to better handle abnormal and noisy data, improve the robustness of the model, and increase its flexibility in different application scenarios. The mathematical expression of the LeakyReLU function is shown as follows:

[0067]

[0068] S1. Receive and store data from the network.

[0069] Multi-angle feature fusion,The data blocks of time series signal segments and traffic data enter the processing stage.,Network traffic data usually consists of different features, such as source IP address,,destination IP address, port number, protocol type, packet length, etc.,Each data packet can be regarded as a data block containing multi-dimensional,features, which can be organized into a two-dimensional matrix. Figure 6In the figure, multiple data blocks (such as "Data Block 1", "Data Block 2" to "Data Block N") are shown. Each data block represents a different part or stage of the signal and traffic data. The data blocks are used to perform "ShutfleNetV2 convolution", "LSTM" (i.e., long short-term memory network) and "Channel Split feature extraction" to capture long-term dependencies in sequence data and extract channel-level features. The feature dimensions of network traffic data are regarded as different "channels". Channel Split first splits the input features according to the channel dimension and allows different feature channels (such as packet size, port number, etc.) to be processed independently in the model. The feature matrix output after the convolution operation can contain a combination of local features, such as traffic patterns or frequency features of port usage. During the processing, the time series features are further processed. The "Concat operation" in the process can recombine these parts together to generate a richer feature representation. Finally, the "self-attention mechanism" is introduced in the process, which is particularly suitable for processing sequence data. In this process, the self-attention mechanism may be used to enhance the model's ability to understand the complex relationship between time series signals and traffic data. Ultimately, after a series of complex processing and analysis, the raw timing signals and traffic data are converted into a more advanced form that is easier to understand and analyze.

[0070] S2. Build a model, perform feature extraction, obtain a first feature, and capture the time series feature of the first feature to obtain a second feature.

[0071] S3. Enhance the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature.

[0072] like Figure 7 As shown in the figure, the architecture diagram of the SLAN model, ShufflenetV2+LSTM is used to process the input data, feature extraction: In the first stage, the ShufflenetV2 model is used to extract features from network traffic data. The convolutional layer (CNN) of ShufflenetV2 is combined with the Leaky ReLU activation function to extract local patterns and complex features from the data. LeakyReLU effectively avoids the problem of "neuron death" caused by breakpoints by allowing negative values ​​to be transmitted with a small slope, that is, the situation where some neurons output is always zero during the training process.

[0073] Time series feature capture: The extracted features are then input into the LSTM network. LSTM is good at capturing the time series features and time dependencies of data. This step ensures that the model can understand the dynamic changes in network traffic.

[0074] Feature enhancement: The attention mechanism is introduced to further strengthen the model's focus on key features. The Leaky ReLU activation function is combined with the attention mechanism to maintain sensitivity to important features, especially when processing network traffic data, the features of which may show different significance at different time steps. The nonlinear characteristics of the Leaky ReLU enhance the model's ability to respond to these features.

[0075] Feature processing: The features enhanced by the attention mechanism are integrated and processed through fully connected layers and inner product operations. These steps ensure efficient fusion and conversion of feature information.

[0076] Classification and output: In the final stage, the features are compressed through the pooling layer and finally classified through the Softmax layer to output the intrusion detection results.

[0077] S4. Classify the intrusion according to the fourth feature and take measures.

[0078] ROC curve optimization: By optimizing the construction process of the ROC curve, the system can find the best balance between accuracy and false alarm rate. Dynamic threshold adjustment: The system can dynamically adjust the classification threshold by updating and learning historical data according to changes in the network environment to deal with different types of network attacks.

[0079] like Figure 8 As shown. During the detection process, signal data from the network is received and stored, including historical traffic data. Signal data is read from the data classification storage module to perform complex feature extraction. Using the extracted features, the ROC curve is constructed to analyze the recognition performance under different thresholds. Based on the optimal threshold determined by the ROC curve, the network signal is classified into two categories: "identifiable intrusion" and "non-ROC probability range". "Identifiable intrusion" is a malicious attack behavior determined by the system. For the identified "identifiable intrusion" behavior, the system automatically takes corresponding defense measures and records relevant information. At the same time, for unidentifiable intrusions "non-ROC probability range", the system regards them as potential threats and marks them for subsequent analysis.

[0080] A specific method for network intrusion detection that combines the network architecture of ShufflenetV2, LSTM, and attention mechanism. ShufflenetV2 is used for efficient feature extraction, combined with LSTM to process time series data, and attention mechanism for dynamic feature enhancement. Use the convolutional layer of ShufflenetV2 with the LeakyReLU activation function to extract local features of network traffic data. Introduce the Leaky ReLU activation function to handle negative value problems and improve the stability and robustness of feature extraction. ROC curve optimization method to adjust the accuracy and false alarm rate of the detection system. Dynamic threshold adjustment mechanism to update the classification threshold in real time according to historical data and changes in the network environment. Realize real-time monitoring, automatic defense, and potential threat marking of network traffic data.

[0081] Example 2, reference Fig. 9 , which is the second embodiment of the present invention, is different from the previous embodiment in that it provides a SLAN-based network intrusion detection system, including: a data acquisition module 100, a feature extraction module 200, a feature enhancement integration module 300 and a classification module 400.

[0082] The data collection module 100 is used to receive and store data from the network.

[0083] The feature extraction module 200 is used to construct a model, perform feature extraction, obtain a first feature, and perform time series feature capture on the first feature to obtain a second feature.

[0084] The feature enhancement and integration module 300 is used to enhance the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature.

[0085] The classification module 400 is used to classify the intrusion according to the fourth feature and take measures.

[0086] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc., which can store program codes.

[0087] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0088] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering or, if necessary, processing in another suitable manner, and then stored in a computer memory.

[0089] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0090] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network intrusion detection method based on SLAN, characterized in that: include, Receive and store data from the network; Build a model, perform feature extraction, obtain the first feature, and capture the time series feature of the first feature to obtain the second feature; The second feature is enhanced to obtain the third feature, and the third feature is integrated and processed to obtain the fourth feature; The intrusion is classified according to the fourth characteristic and measures are taken.

2. A SLAN-based network intrusion detection method as claimed in claim 1, characterized in that: The data from the network includes time series signal segments and historical traffic data; The data blocks of timing signal segments and traffic data enter the processing stage. Each data packet is regarded as a data block containing multi-dimensional features. The data is organized into a two-dimensional matrix. Each data block represents a different part or stage of the signal and traffic data, and feature extraction is performed on the data blocks.

3. A SLAN-based network intrusion detection method as claimed in claim 2, characterized in that: The model refers to SLAN, namely ShufflenetV2-LSTM-Attention Network, ShufflenetV2-LSTM and attention mechanism; The first characteristics include traffic patterns, timing dynamics, and channel-level characteristics.

4. A SLAN-based network intrusion detection method as claimed in claim 3, characterized in that: The feature extraction includes using the ShufflenetV2 model to extract features from network traffic data to obtain a first feature. The convolutional layer CNN of ShufflenetV2 is combined with the Leaky ReLU activation function to extract local patterns and complex features from the data. The Leaky ReLU allows negative values ​​to be passed with a small slope.

5. A SLAN-based network intrusion detection method as claimed in claim 4, characterized in that: The timing feature capture includes extracting features and then inputting them into the LSTM network to capture the timing features and time dependencies of the data, ensuring that the model understands the dynamic changes in network traffic, and obtaining the second feature.

6. A SLAN-based network intrusion detection method as claimed in claim 5, characterized in that: The feature enhancement includes introducing an attention mechanism to strengthen the model's attention to key features, thereby obtaining a third feature; The integrating and processing the third feature includes integrating and processing the features enhanced by the attention mechanism through a fully connected layer and an inner product operation to obtain a fourth feature.

7. A SLAN-based network intrusion detection method as claimed in claim 6, characterized in that: The intrusion classification includes using the fourth feature to construct an ROC curve, analyzing the recognition performance under different thresholds, and performing binary classification processing on the network signal based on the optimal threshold determined by the ROC curve, and dividing the signal into two categories: recognizable intrusion and non-ROC probability range. The recognizable intrusion is the determined malicious attack behavior. For the identified recognizable intrusion behavior, corresponding defense measures are automatically taken and relevant information is recorded. At the same time, unrecognizable intrusions within the non-ROC probability range are regarded as potential threats and marked for subsequent analysis.

8. A system using a SLAN-based network intrusion detection method as claimed in any one of claims 1 to 7, characterized in that: It includes a data collection module (100), a feature extraction module (200), a feature enhancement integration module (300) and a classification module (400); The data acquisition module (100) is used to receive and store data from the network; The feature extraction module (200) is used to construct a model, perform feature extraction, obtain a first feature, and perform time series feature capture on the first feature to obtain a second feature; The feature enhancement and integration module (300) is used to enhance the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature; The classification module (400) is used to classify the intrusion according to the fourth feature and take measures.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of a network intrusion detection method based on SLAN described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of a network intrusion detection method based on SLAN described in any one of claims 1 to 7 are implemented.

Images