A network intrusion detection method and system based on SLAN

Abstract

The application discloses a network intrusion detection method and system based on SLAN, relates to the technical field of network intrusion detection, and comprises the following steps: receiving and storing data from a network; constructing a model, performing feature extraction, obtaining first features, performing time sequence feature capturing on the first features, and obtaining second features; performing feature enhancement on the second features to obtain third features, integrating and processing the third features to obtain fourth features; classifying intrusions according to the fourth features and taking measures. Through the use of light-weight convolution operation and Channel Shuffle mechanism, the application greatly reduces the calculation complexity and memory usage, so that the feature extraction can be completed with lower calculation cost when processing real-time network traffic, local patterns and complex features can be effectively extracted from network traffic data, the sensitivity to attack behaviors and the detection accuracy are improved, different types of network attacks can be adapted to, and the detection capability for unknown attacks is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network intrusion detection, in particular to a network intrusion detection method and system based on SLAN. Background Art

[0002] Network security issues are becoming increasingly serious. Network intrusion detection systems (IDS) are a crucial tool for protecting computer networks from malicious attacks. Traditional intrusion detection methods primarily rely on signature matching, detecting anomalous activity in network traffic based on a library of known attack signatures. However, these methods are limited in the face of new and unknown attacks because they rely on predefined attack patterns.

[0003] In recent years, the rise of deep learning technology has provided new solutions for network intrusion detection. Deep learning models such as convolutional neural networks (CNNs) and long short-term memory networks (LSTMs) can automatically extract and learn features from complex network traffic data, enhancing the ability to identify abnormal behavior. However, these models still face challenges when processing high-dimensional and time-series data, particularly in effectively extracting key features from massive amounts of data and accurately classifying them.

[0004] This paper constructs the ShufflenetV2-LSTM-Attention Network (SLAN) model. SLAN combines the advantages of ShufflenetV2, LSTM, and the attention mechanism. Through multi-angle feature fusion and dynamic learning mechanisms, it provides a more intelligent and efficient solution for network intrusion detection, enabling better response to evolving network threats. Summary of the Invention

[0005] In view of the above-mentioned problems, the present invention is proposed.

[0006] Therefore, the problem to be solved by the present invention is: how to solve the problem that traditional network intrusion detection methods are unable to effectively extract and utilize traffic patterns, timing dynamics and channel-level features in network traffic data, and it is difficult to deeply capture and analyze timing features, thereby having deficiencies in identifying new and unknown attacks, and how to effectively extract key features from massive data and accurately classify them.

[0007] To solve the above technical problems, the present invention provides the following technical solutions: a network intrusion detection method based on SLAN, comprising: receiving and storing data from the network; constructing a model, performing feature extraction to obtain a first feature, capturing the time series feature of the first feature to obtain a second feature; performing feature enhancement on the second feature to obtain a third feature, integrating and processing the third feature to obtain a fourth feature; classifying the intrusion according to the fourth feature, and taking measures.

[0008] As a preferred scheme of the network intrusion detection method based on SLAN, wherein: the data from the network includes time sequence signal segments and historical traffic data; the time sequence signal segments and the data blocks of the traffic data enter the processing stage, each data packet is regarded as a data block containing multi-dimensional features, the data is organized into a two-dimensional matrix, each data block represents different parts or stages of the signal and the traffic data, and feature extraction is performed on the data block.

[0009] As a preferred scheme of the network intrusion detection method based on SLAN, wherein: the model refers to SLAN, namely ShufflenetV2-LSTM-Attention Network, ShufflenetV2-LSTM and attention mechanism; and the first features include traffic patterns, time sequence dynamics and channel level features.

[0010] As a preferred scheme of the network intrusion detection method based on SLAN, wherein: the feature extraction includes extracting first features from the network traffic data by using a ShufflenetV2 model, the convolutional layer CNN of ShufflenetV2 combines with a Leaky ReLU activation function to extract local patterns and complex features from the data, and the Leaky ReLU allows negative values to pass through with a small slope.

[0011] As a preferred scheme of the network intrusion detection method based on SLAN, wherein: the time sequence feature capturing includes inputting the extracted features into an LSTM network to capture time sequence features and time dependence of the data, ensuring that the model understands dynamic changes in the network traffic, and obtaining second features.

[0012] As a preferred scheme of the network intrusion detection method based on SLAN, wherein: the feature enhancement includes introducing an attention mechanism to strengthen the model's attention to key features, and obtaining third features; and the integration and processing of the third features includes integrating and processing the features enhanced by the attention mechanism through a fully connected layer and an inner product operation, and obtaining fourth features.

[0013] As a preferred solution of the SLAN-based network intrusion detection method described in the present invention, the intrusion classification includes using the fourth feature to construct an ROC curve, analyzing the recognition performance under different thresholds, and performing binary classification processing on the network signal based on the optimal threshold determined by the ROC curve, dividing the signal into two categories: recognizable intrusion and non-ROC probability range. The recognizable intrusion is the determined malicious attack behavior. For the identified recognizable intrusion behavior, corresponding defense measures are automatically taken and relevant information is recorded. At the same time, unrecognizable intrusions within the non-ROC probability range are regarded as potential threats and marked for subsequent analysis.

[0014] Another object of the present invention is to provide a system for a network intrusion detection method based on SLAN, which can solve a network intrusion detection problem based on SLAN by constructing a network intrusion detection system.

[0015] To solve the above technical problems, the present invention provides the following technical solutions: a network intrusion detection system based on SLAN, comprising a data acquisition module, a feature extraction module, a feature enhancement and integration module, and a classification module; the data acquisition module is used to receive and store data from the network; the feature extraction module is used to build a model, perform feature extraction, obtain a first feature, and perform time series feature capture on the first feature to obtain a second feature; the feature enhancement and integration module is used to perform feature enhancement on the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature; the classification module is used to classify the intrusion according to the fourth feature and take measures.

[0016] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned SLAN-based network intrusion detection method when executing the computer program.

[0017] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the above-mentioned SLAN-based network intrusion detection method.

[0018] The present invention provides the following beneficial effects: The ShufflenetV2 network, a SLAN-based network intrusion detection method, significantly reduces computational complexity and memory usage by utilizing lightweight convolution operations and a Channel Shuffle mechanism. This design enables feature extraction with low computational overhead during real-time network traffic processing. Accurate local feature capture: The ShufflenetV2 convolutional layer, combined with the Leaky ReLU activation function, effectively extracts local patterns and complex features from network traffic data. Extracting these local features is crucial for discovering hidden attack patterns and abnormal behavior.

[0019] Long Short-Term Memory (LSTM) Networks: LSTM networks, by introducing a gating mechanism, can effectively capture long-term dependencies in data. This is particularly important for processing dynamic changes in network traffic, such as the temporal characteristics of attack patterns.

[0020] Self-attention mechanism: This mechanism helps the model focus on key features when facing volatile network traffic, thereby improving sensitivity to attack behaviors and detection accuracy. Advantages of the Leaky ReLU: The Leaky ReLU activation function effectively avoids the "neuron death" problem when processing network traffic data. Its nonlinear characteristics enable the model to better handle noisy and abnormal data, improving its responsiveness to features.

[0021] The system can update and learn dynamic classification thresholds in real time based on changes in the network environment. This dynamic adjustment capability enables the system to adapt to different types of network attacks and improves its ability to detect unknown attacks. Real-time monitoring and defense: The system not only detects network intrusions but also automatically implements appropriate defensive measures and records relevant information. For detected "identifiable intrusions," the system will perform defensive processing; potential threats "outside the ROC probability range" will be flagged for further analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0023] Figure 1 The present invention provides a flowchart of a SLAN-based network intrusion detection method according to the first embodiment.

[0024] Figure 2 A convolutional neural network traffic feature extraction structure diagram of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0025] Figure 3 A schematic diagram of Channel Shuffle of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0026] Figure 4 A comparison diagram of the ShufflenetV2 basic units of a SLAN-based network intrusion detection method provided by the first embodiment of the present invention.

[0027] Figure 5 This is a structural diagram of an LSTM model of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0028] Figure 6 This is a feature extraction diagram of Transformer+ResNet-CNN for a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0029] Figure 7 This is an architectural diagram of a SLAN model of a SLAN-based network intrusion detection method provided in the first embodiment of the present invention.

[0030] Figure 8 This is a design diagram of an intrusion attack monitoring method based on SLAN provided by the first embodiment of the present invention.

[0031] Figure 9 This is a structural diagram of a SLAN-based network intrusion detection system provided by the second embodiment of the present invention. DETAILED DESCRIPTION

[0032] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0033] In the following description, many specific details are set forth to facilitate a full understanding of the present invention. However, the present invention may also be implemented in other ways different from those described herein. Those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0034] Example 1, reference Figures 1 to 8 , which is the first embodiment of the present invention, provides a network intrusion detection method based on SLAN, including: receiving and storing data from the network; building a model, performing feature extraction to obtain a first feature, capturing the time series feature of the first feature to obtain a second feature; enhancing the second feature to obtain a third feature, integrating and processing the third feature to obtain a fourth feature; classifying the intrusion according to the fourth feature, and taking measures.

[0035] This paper constructs the ShufflenetV2-LSTM-Attention Network (SLAN) model. SLAN combines the advantages of ShufflenetV2, LSTM, and the attention mechanism. Through multi-angle feature fusion and dynamic learning mechanisms, it provides a more intelligent and efficient solution for network intrusion detection, enabling better response to evolving network threats.

[0036] Convolutional Neural Network (CNN) was originally designed to process images and videos, but it is also applicable to text data. CNN is good at identifying local features of data. It reduces the number of network parameters by sharing weights, extracts diverse features using multiple channels, and gradually obtains higher-level semantic information through multi-layer convolution. For network traffic data, CNN can effectively extract time series patterns and traffic features, providing higher-precision identification of traffic anomalies and attack behaviors. Figure 2 shown.

[0037] The main function of convolution is to apply a convolution operation to input data using a convolution kernel to extract key data content, similar to filters in signal processing. Pooling not only reduces model parameters but also maintains invariance to operations such as translation, scaling, and rotation.

[0038] The convolution kernel slides on the matrix of network traffic data to extract local features. Assume that we represent the network traffic data as a matrix V(w i ), convolution kernel F k = k*d will perform a sliding calculation on this matrix and obtain the local eigenvalues ​​by convolving the local area of ​​the data matrix. This step is similar to the filter in signal processing, which extracts important features from the data through convolution. The calculation formula is as follows:

[0039] c i =f(F k *V(w i )+b)

[0040] Among them, c i Represents the local eigenvalues ​​obtained by a single convolution. After traversing the matrix V once, the complete local eigenvector C = (c1, c2…, c3) is obtained. To reduce the vector dimension, a pooling operation is performed on C after convolution, resulting in the reduced-dimensional feature d = (d1, d2,…, d3).

[0041] Pooling operation To reduce the dimensionality of the feature vector and maintain robustness to operations such as translation, scaling, and rotation of the data, we perform a pooling operation on the local feature vector obtained by convolution. Pooling operation can reduce computational complexity and extract more stable features. Common pooling methods include maximum pooling (taking the maximum value in a local area) and average pooling (calculating the average value of a local area). Features after dimensionality reduction = pooling (V)

[0042] ShuffleNetV2 is a lightweight convolutional neural network proposed by Megvii Research Institute in 2018. It is an upgraded version of ShuffleNetV1.

[0043] One of the biggest features of the ShuffleNet series of networks is the use of the Channel Shuffle operation, which aims to mix up the original data channels and allow data from different channels to interact. This is often used to solve the problem of information not flowing between channels in a separable convolutional network. As shown in Figure 3 , this operation usually consists of three steps: first, the data is divided into N groups by channel; second, the data is transposed; and third, the transformed data is spliced into new features.

[0044] The ShuffleNet series of networks is characterized by efficient computation, high accuracy, and lightweight design, and is mainly used for image classification and object detection tasks. A comparison of the basic units of ShuffleNetV1 and ShufflenetV2 is shown in Figure 4 .

[0045] where (a) and (b) are the basic units of ShuffleNetV2. ShuffleNetV2 innovatively proposes four improvement criteria: first, when the input and output channel numbers are the same, the Memory Access Cost (MAC) is minimized; second, when using grouped convolution, too many groups will increase the MAC; third, fragmentation (i.e., branching) operations will reduce parallel acceleration; and fourth, element-wise operations will increase memory and time.

[0046] In the basic module (a), the Channel Split operation is first used to divide the input channels into two parts, reducing the number of branch channels. Referring to criterion one, the left branch performs an identity mapping, and the right branch uses three consecutive convolutions with the same input and output channels. According to criterion two, the 1x1 convolution in the structure no longer uses grouped convolution. According to criterion three, fewer types of branches are used within the unit structure, such as the left branch performing an identity mapping. According to criterion four, the outputs of the two branches no longer use the Add operation, but use the Concat operation, followed by Channel Shuffle to ensure that the information of the two branches flows to each other. For the down-sampling module (b), Channel Split is no longer used, and both the left and right branches use convolution with a stride of 2 for down-sampling. Finally, the two branches are concatenated, the spatial size of the feature map is halved, and the number of channels is doubled. The overall framework of ShufflenetV2 is shown in Table 1.

[0047] Table 1 Overall framework of ShufflenetV2

[0048]

[0049]

[0050] The Long Short-Term Memory (LSTM) network is a specially designed recurrent neural network (RNN) designed to address the vanishing and exploding gradient problems that plague traditional RNNs during training. Compared to standard RNNs, LSTMs employ a gating mechanism to manage information retention and forgetting, allowing them to better capture long-term dependencies in text. This makes LSTMs superior when processing long sequences.

[0051] The basic structure of the LSTM network is as follows Figure 5 shown.

[0052] Forget gate: This gate controls which information should be discarded. It receives information from the previous hidden state and the current input information and passes them through a sigmoid function, which outputs a value between 0 and 1. Values ​​close to 0 indicate that the information should be discarded, and values ​​close to 1 indicate that it should be retained. Its calculation formula is as follows:

[0053] f t =σ(W f *[h t-1 ,x t ]+b f )

[0054] Among them, f t is the output of the forget gate, σ is the sigmoid function, W f is the weight matrix, h t-1 is the hidden state at the previous moment, x t is the current input, b f is the bias term.

[0055] Input gate: This gate is responsible for updating the cell state. First, it passes the previous hidden state and the current input into a sigmoid function to determine how much information to update. Then, the same input is passed into a tanh function to generate a vector of candidate values. Finally, the input gate updates the cell state by multiplying these two results. Its calculation formula is as follows:

[0056] i t =σ([W f *[h t-1 ,x t ]+b i )

[0057] C t =tanh(W c *[h t-1 ,x t ]+b c )

[0058] C t =f t *Ct-1 +i t *C t

[0059] where i t is the output of the input gate, C t is the candidate cell state, C t is the updated cell state, W f and C t = tanh(W c *[h t-1 ,x t ]+b c ) are the weight matrices, and b i and b c are the bias terms.

[0060] Output gate: This gate determines the value of the next hidden state. It first passes the previous hidden state and the current input into a sigmoid function, which outputs a value between 0 and 1. Then, it passes the updated cell state into a tanh function and multiplies the result with the output of the sigmoid function to determine the information contained in the hidden state. Finally, the hidden state is taken as the output of the current cell. Its calculation formula is as follows:

[0061] O t = σ([W o *[h t-1 ,x t ]+b o )

[0062] h t = O t *tanh(C t )

[0063] where O t is the output of the output gate, h t is the current hidden state, W o is the weight matrix, and b o is the bias term.

[0064] Although traditional LSTM can only use the output information of the previous time step to predict the output of the current time step, in some cases, the output information of the current time step may also be related to the output of the future time step. To solve this problem, Bidirectional Long Short-Term Memory Network (BiLSTM) is introduced. BiLSTM consists of a forward LSTM and a backward LSTM, but the forward and backward LSTM networks are not directly connected. Its output is determined by the hidden states of the forward and backward LSTM layers. In this way, BiLSTM can capture both future and past information in the sequence.

[0065] Self-attention mechanism is a neural network mechanism for processing sequence data. Its core idea is to strengthen the representation of internal correlation in the sequence by calculating the dependency between positions in the sequence, so as to capture richer contextual information. Its working principle includes the following steps: input representation: first, each element (such as words, image blocks, etc.) in the input sequence is converted into a high-dimensional vector representation, and these vectors form an input matrix; Calculate attention weight: for each position in the input sequence, calculate the correlation between this position and all other positions to obtain the attention weight. This correlation is usually calculated by a dot product operation, and then normalized (for example, using the Softmax function) to obtain a weight matrix; Weighted sum: use the calculated attention weight to perform weighted sum on the representation of all positions in the input sequence; Output generation: pass the result of weighted sum to the subsequent network layer to generate the final output representation.

[0066] LeakyReLU (Leaky Rectified Linear Unit) is a variant of ReLU activation function, which is used to solve the problem of neuron death caused by ReLU at negative input. Unlike ReLU, LeakyReLU has a small non-zero slope in the negative input region, usually taking values such as 0.01 or 0.1. This improvement allows LeakyReLU to better handle abnormal and noisy data, improving the robustness of the model and increasing its flexibility in different application scenarios. The mathematical expression of LeakyReLU function is as follows:

[0067]

[0068] S1, receive and store data from the network.

[0069] Multi-angle feature fusion, time series signal segment and flow data block enter the processing stage, network flow data is usually composed of different features, such as source IP address, destination IP address, port number, protocol type, packet length, etc. Each data packet can be regarded as a data block containing multi-dimensional features, and these data can be organized into a two-dimensional matrix. Figure 6The figure shows multiple data blocks (e.g., "Data Block 1," "Data Block 2," through "Data Block N"), each representing a different portion or stage of signal and traffic data. These blocks are used to perform ShutfleNetV2 convolution, LSTM (Long Short-Term Memory) networks, and Channel Split feature extraction, which are used to capture long-term dependencies in sequence data and extract channel-level features. The feature dimensions of network traffic data are treated as different "channels." Channel Split first splits the input features according to the channel dimension, allowing different feature channels (such as packet size and port number) to be processed independently in the model. The feature matrix output after the convolution operation can contain combinations of local features, such as traffic patterns or port usage frequency. During processing, the time series features are further processed using the "Concat" operation, which recombines these components to generate a richer feature representation. Finally, the process introduces a self-attention mechanism, which is particularly suitable for processing sequence data. In this process, the self-attention mechanism may be used to enhance the model's understanding of the complex relationships between time series signals and traffic data. Ultimately, after a series of complex processing and analysis, the original timing signals and traffic data are converted into a more advanced form that is easier to understand and analyze.

[0070] S2. Build a model, perform feature extraction, obtain the first feature, and capture the time series feature of the first feature to obtain the second feature.

[0071] S3. Enhance the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature.

[0072] like Figure 7 The following diagram shows the architecture of the SLAN model. ShufflenetV2 and LSTM are used to process input data. Feature extraction: In the first stage, the ShufflenetV2 model extracts features from network traffic data. ShufflenetV2's convolutional layers (CNN) combined with the Leaky ReLU activation function extract local patterns and complex features from the data. Leaky ReLU allows negative values ​​to propagate with a small slope, effectively avoiding the "neuron death" problem caused by breakpoints, where some neurons' outputs remain permanently zero during training.

[0073] Temporal feature capture: The extracted features are then input into the LSTM network. LSTM is good at capturing the temporal features and time dependencies of data. This step ensures that the model can understand the dynamic changes in network traffic.

[0074] Feature Enhancement: The attention mechanism is introduced to further strengthen the model's focus on key features. The Leaky ReLU activation function, combined with the attention mechanism, maintains sensitivity to important features. This is particularly true when processing network traffic data, where features may exhibit different salience at different time steps. The nonlinear nature of the Leaky ReLU enhances the model's responsiveness to these features.

[0075] Feature processing: The features enhanced by the attention mechanism are integrated and processed through fully connected layers and inner product operations. These steps ensure efficient fusion and conversion of feature information.

[0076] Classification and output: In the final stage, the features are compressed through the pooling layer and finally classified through the Softmax layer to output the intrusion detection results.

[0077] S4. Classify the intrusion according to the fourth characteristic and take measures.

[0078] ROC curve optimization: By optimizing the ROC curve construction process, the system can ensure that it can find the optimal balance between accuracy and false alarm rate. Dynamic threshold adjustment: The system can dynamically adjust the classification threshold based on changes in the network environment by updating and learning historical data to respond to different types of network attacks.

[0079] like Figure 8 As shown. The detection process receives and stores signal data from the network, including historical traffic data. Signal data is read from the data classification storage module to perform complex feature extraction. Using the extracted features, the ROC curve is constructed to analyze the recognition performance under different thresholds. Based on the optimal threshold determined by the ROC curve, the network signal is classified into two categories: "identifiable intrusion" and "non-ROC probability range". "Identifiable intrusion" is a malicious attack behavior determined by the system. For the identified "identifiable intrusion" behavior, the system automatically takes corresponding defense measures and records relevant information. At the same time, for unidentifiable intrusions "non-ROC probability range", the system regards them as potential threats and marks them for subsequent analysis.

[0080] This method combines ShufflenetV2, LSTM, and an attention mechanism in a network architecture for network intrusion detection. ShufflenetV2 is used for efficient feature extraction, combined with LSTM to process time series data, and the attention mechanism for dynamic feature enhancement. The convolutional layers of ShufflenetV2 are used with the LeakyReLU activation function to extract local features from network traffic data. The LeakyReLU activation function is introduced to handle negative values ​​and improve the stability and robustness of feature extraction. A receiver operating characteristic (ROC) curve optimization method is used to adjust the detection system's accuracy and false alarm rate. A dynamic threshold adjustment mechanism updates the classification threshold in real time based on historical data and changes in the network environment. This enables real-time monitoring of network traffic data, automated defense, and potential threat flagging.

[0081] Example 2, reference Figure 9 , which is the second embodiment of the present invention, is different from the previous embodiment in that it provides a SLAN-based network intrusion detection system, including: a data acquisition module 100, a feature extraction module 200, a feature enhancement and integration module 300 and a classification module 400.

[0082] The data acquisition module 100 is used to receive and store data from the network.

[0083] The feature extraction module 200 is used to construct a model, perform feature extraction, obtain a first feature, and perform time series feature capture on the first feature to obtain a second feature.

[0084] The feature enhancement and integration module 300 is used to enhance the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature.

[0085] The classification module 400 is used to classify the intrusion according to the fourth feature and take measures.

[0086] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0087] The logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device). For purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transport a program for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0088] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0089] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0090] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit the present invention. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network intrusion detection method based on SLAN, characterized by: include, Receive and store data from the network; Build a model, perform feature extraction, obtain the first feature, and capture the time series feature of the first feature to obtain the second feature; The second feature is enhanced to obtain the third feature, and the third feature is integrated and processed to obtain the fourth feature; Classify the intrusion according to the fourth characteristic and take measures; The model mentioned is SLAN, which stands for ShufflenetV2-LSTM-Attention Network, ShufflenetV2-LSTM and attention mechanism. The first features include traffic patterns, timing dynamics, and channel-level features; The feature extraction includes performing feature extraction on network traffic data using a ShufflenetV2 model to obtain a first feature, wherein the convolutional layer CNN of ShufflenetV2 is combined with a Leaky ReLU activation function to extract local patterns and complex features from the data, and the Leaky ReLU allows negative values ​​to be passed with a small slope; The time series feature capture includes extracting features and then inputting them into the LSTM network to capture the time series characteristics and time dependencies of the data, ensuring that the model understands the dynamic changes in network traffic and obtains the second feature; The feature enhancement includes introducing an attention mechanism to strengthen the model's attention to key features, thereby obtaining a third feature; The integrating and processing the third feature includes integrating and processing the features enhanced by the attention mechanism through a fully connected layer and an inner product operation to obtain a fourth feature; The intrusion classification includes using the fourth feature to construct an ROC curve, analyzing the recognition performance under different thresholds, and performing binary classification processing on the network signal based on the optimal threshold determined by the ROC curve, and dividing the signal into two categories: recognizable intrusion and non-ROC probability range. The recognizable intrusion is the determined malicious attack behavior. For the identified recognizable intrusion behavior, corresponding defense measures are automatically taken and relevant information is recorded. At the same time, unrecognizable intrusions within the non-ROC probability range are regarded as potential threats and marked for subsequent analysis.

2. The SLAN-based network intrusion detection method according to claim 1, wherein: The data from the network includes time series signal segments and historical traffic data; The data blocks of time series signal segments and traffic data enter the processing stage. Each data packet is regarded as a data block containing multi-dimensional features. The data is organized into a two-dimensional matrix. Each data block represents a different part or stage of the signal and traffic data, and feature extraction is performed on the data block.

3. A system using the SLAN-based network intrusion detection method according to any one of claims 1 to 2, characterized in that: It includes a data acquisition module (100), a feature extraction module (200), a feature enhancement and integration module (300) and a classification module (400); The data acquisition module (100) is used to receive and store data from the network; The feature extraction module (200) is used to construct a model, perform feature extraction, obtain a first feature, and perform time series feature capture on the first feature to obtain a second feature; The feature enhancement and integration module (300) is used to enhance the second feature to obtain a third feature, and integrate and process the third feature to obtain a fourth feature; The classification module (400) is used to classify the intrusion according to the fourth feature and take measures.

4. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the SLAN-based network intrusion detection method according to any one of claims 1 to 2 are implemented.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the SLAN-based network intrusion detection method according to any one of claims 1 to 2 are implemented.

Images