Network intrusion detection model training method, intrusion detection method and related equipment

Abstract

The invention discloses a network intrusion detection model training method, an intrusion detection method and related equipment, and the method comprises the steps: collecting a real data set which is continuous time sequence network flow data; inputting the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model comprises a feature marking model and a local difference privacy detection model; coding and marking the real data set by adopting a feature marking model to obtain an input sequence; and inputting the input sequence into a local differential privacy detection model for intrusion classification identification to obtain an identification result, and updating parameters of the initial network intrusion monitoring model based on the identification result until a preset condition is met to obtain a target network intrusion monitoring model. According to the invention, the accuracy and timeliness of network intrusion detection are improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection model training method, an intrusion detection method and related equipment. Background Art

[0002] With the development of computer technology, the network should become more and more extensive, and network security has also become an important topic of concern. Traditional IDS mainly relies on static predefined rules and signature matching mechanisms, which are robust in protecting known threats. However, when facing new complex attack forms such as advanced persistent threats (APT) and zero-day attacks, its detection efficiency is significantly limited, exposing the disadvantages of single threat data detection means and insufficient detection capabilities. Although researchers have proposed a variety of innovative IDS technologies, these technologies still face many challenges. For example, HAST-IDS proposed by Wang et al., AI-IDS developed by Kim et al., and Vinayakumar et al. used deep neural network learning technology to improve the detection capabilities of IDS in complex attack scenarios, but when processing real-time data, problems such as affecting detection speed and untimely model updates still need to be solved. Similarly, GIDS by Seo et al. uses GAN to enhance the in-vehicle network IDS, but it is difficult to generalize to other environments; DIGFuPAS by Duy et al. uses GAN to deceive IDS in SDN to improve adversarial sample detection, but it is necessary to balance generation and detection; Fedgan-IDS by Tabassum et al. combines GAN and federated learning to protect privacy, but its detection capability needs to be verified; bidirectional GAN ​​by Xu et al. combines single-class classifiers to improve detection, but its generalization ability is insufficient.

[0003] The above content shows that overcoming the problems of single threat data detection methods, high detection difficulty, and low recognition rate of unknown network attacks is a technical challenge that needs to be solved urgently. Summary of the invention

[0004] The embodiment of the present invention provides a network intrusion detection model training method, a network intrusion detection method, an apparatus, a computer device and a storage medium to improve the efficiency of data repair.

[0005] In order to solve the above technical problems, the present application embodiment provides a network intrusion detection model training method, including:

[0006] Collecting a real data set, where the real data set is continuous time series network traffic data;

[0007] Inputting the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model;

[0008] Using the feature labeling model to encode and label the real data set to obtain an input sequence;

[0009] The input sequence is input into the local differential privacy detection model for intrusion classification and identification to obtain an identification result, and the parameters of the initial network intrusion monitoring model are updated based on the identification result until a preset condition is met to obtain a target network intrusion monitoring model.

[0010] Optionally, the feature labeling model is an attention mechanism model, and the step of encoding and labeling the real data set using the feature labeling model to obtain an input sequence includes:

[0011] Performing data classification and synthesis on the real data set to obtain a mixed data set;

[0012] Through linear projection, the mixed data set is linearly projected onto N tk dimension, and obtain feature embedding;

[0013] The attention mechanism is used to combine the feature embedding and the position embedding to obtain the input sequence. 3. The network intrusion detection model training method according to claim 2, characterized in that the data classification and synthesis of the real data set to obtain the mixed data set comprises:

[0014] In each time range, the representation features of continuous time series network traffic data {f (j)} j and classification {c (j)} j Segment into raw data segments Original data fragment {f (j) ,c (j)} j Contains a mixture of at least two known attack types;

[0015] Shuffle the original data segments to obtain a mixed data set S = {X (k) ,y (k) ,RoF (k)} k ,in is a data sample, Yes X (k) The number of features in y (k) is a one-hot encoded label indicating benign or one of the attack types, RoF (k) =1 means the data sample is real sample data, RoF (k) =0 indicates that the data sample is a generated sample.

[0016] Optionally, the local differential privacy detection model is obtained by combining a generative adversarial network model and an external classifier, and the input sequence is input into the local differential privacy detection model for intrusion classification and identification, and the identification result obtained includes:

[0017] A generative adversarial network is used to perform sample generation training and adversarial training on the input sequence, wherein the generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization, and a discriminant network adds a binary head;

[0018] The results of generative adversarial training are identified through an external classifier, and the external classifier adopts a multi-category auxiliary classifier or a SoftMax layer.

[0019] Optionally, identifying the result of generative adversarial training by an external classifier includes:

[0020] Using a discriminant network to assign InD or OOD labels to samples in the input sequence;

[0021] When the sensitivity analysis value of the class label determined by the external classifier is lower than the marking threshold, the class label is determined for identification by using an outlier detection method.

[0022] In order to solve the above technical problems, the present application provides a network intrusion detection method, including:

[0023] Collect real-time network data;

[0024] The real-time network data is input into a target network intrusion monitoring model to perform intrusion detection and obtain an intrusion detection result.

[0025] In order to solve the above technical problems, the embodiment of the present application also provides a network intrusion detection model training device, including:

[0026] A data collection module is used to collect a real data set, where the real data set is continuous time series network traffic data;

[0027] A data input module, used to input the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model;

[0028] A sample encoding module, used to encode and mark the real data set using the feature marking model to obtain an input sequence;

[0029] The model training module is used to input the input sequence into the local differential privacy detection model for intrusion classification and identification, obtain an identification result, and update the parameters of the initial network intrusion monitoring model based on the identification result until the preset conditions are met to obtain the target network intrusion monitoring model.

[0030] Optionally, the sample encoding module includes:

[0031] A sample augmentation unit, used for classifying and synthesizing the real data set to obtain a mixed data set;

[0032] A linear projection unit is used to linearly project the mixed data set onto N tk dimension, and obtain feature embedding;

[0033] The sequence generation unit is used to adopt an attention mechanism to combine the feature embedding and the position embedding to obtain the input sequence.

[0034] Optionally, the sample augmentation unit includes:

[0035] The data characterization subunit is used to represent the continuous time series network traffic data {f (j)} j and classification {c (j)} j Segment into raw data segments Original data fragment {f (j) ,c (j)} j Contains a mixture of at least two known attack types;

[0036] Shuffle the original data segments to obtain a mixed data set S = {X (k) ,y (k) ,RoF (k)} k ,in is a data sample, Yes X (k) The number of features in y (k) is a one-hot encoded label indicating benign or one of the attack types, RoF (k) =1 means the data sample is real sample data, RoF (k) =0 indicates that the data sample is a generated sample.

[0037] Optionally, the model training module includes:

[0038] A generative adversarial unit, configured to perform sample generation training and adversarial training on the input sequence using a generative adversarial network, wherein the generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization, and a discriminant network adds a binary head;

[0039] The classification recognition unit is used to recognize the result of generative adversarial training through an external classifier, and the external classifier adopts a multi-category auxiliary classifier or a SoftMax layer.

[0040] Optionally, the classification identification unit includes:

[0041] A label assignment subunit, used to assign InD or OOD labels to samples in the input sequence using a discriminant network;

[0042] The anomaly detection subunit is used to determine the category label for identification by using an outlier detection method when the sensitivity analysis value of the class label determined by the external classifier is lower than the marking threshold.

[0043] In order to solve the above technical problems, the embodiment of the present application further provides a network intrusion detection device, including:

[0044] Data acquisition module, used to collect real-time network data;

[0045] The intrusion detection module is used to input the real-time network data into the target network intrusion monitoring model to perform intrusion detection and obtain intrusion detection results.

[0046] In order to solve the above technical problems, an embodiment of the present application also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above network intrusion detection model training method when executing the computer program, or implements the steps of the above network intrusion detection method when executing the computer program.

[0047] In order to solve the above technical problems, an embodiment of the present application also provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, it implements the steps of the above-mentioned network intrusion detection model training method, or when the computer program is executed by a processor, it implements the steps of the above-mentioned network intrusion detection method.

[0048] The network intrusion detection model training method, network intrusion detection method, device, computer equipment and storage medium provided by the embodiment of the present invention collect a real data set, which is a continuous time series network traffic data; input the real data set into the initial network intrusion monitoring model, which includes a feature labeling model and a local differential privacy detection model; use the feature labeling model to encode and label the real data set to obtain an input sequence; input the input sequence into the local differential privacy detection model for intrusion classification and recognition to obtain a recognition result, and update the parameters of the initial network intrusion monitoring model based on the recognition result until the preset conditions are met to obtain a target network intrusion monitoring model. This is achieved by generating realistic network traffic samples, which are used to train and optimize the detection model, thereby enhancing the generalization ability of the model in the face of actual network environments, having the ability to identify unknown attacks, and improving the accuracy and timeliness of intrusion detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments of the present invention will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0050] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0051] Figure 2 is a flow chart of an embodiment of the network intrusion detection model training method of the present application;

[0052] Figure 3 It is a schematic diagram of the process of shuffling and marking original data segments in the present application;

[0053] Figure 4 This is a structural example diagram of a local differential privacy detection model in this application;

[0054] Figure 5 This is a flowchart of an outlier detection process in this application;

[0055] Figure 6 is a flow chart of an embodiment of the network intrusion detection method of the present application;

[0056] Figure 7 It is a structural schematic diagram of an embodiment of a network intrusion detection model training device according to the present application;

[0057] Figure 8 is a structural schematic diagram of an embodiment of a network intrusion detection device according to the present application;

[0058] Fig. 9 It is a structural diagram of an embodiment of a computer device according to the present application. DETAILED DESCRIPTION

[0059] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0060] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0061] Some professional terminology explanations for this application:

[0062] Network security threats: refers to various factors or behaviors that pose potential hazards to computer network systems, devices or data in the network. These threats may come from internal (such as employee misoperation, malicious behavior) or external (such as hacker attacks, virus transmission).

[0063] Transformer: A deep learning model for processing time series data, especially suitable for analyzing and classifying network traffic.

[0064] GAN: is a generative neural network that can learn a mapping from a simple latent (or noise) distribution to an arbitrarily complex data distribution to generate realistic data. In GAN, two models are trained simultaneously: the generator It attempts to generate synthetic samples that are close to the real data distribution, while the discriminator The estimation samples come from the real dataset rather than The probability of the output.

[0065] EC-GAN: A variant of generative adversarial networks that improves classification performance by attaching an external classifier

[0066] DP (Detection Model with Local Differential Privacy): DP constitutes a strong standard for guaranteeing the privacy of dataset aggregation algorithms.

[0067] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0068] See also Figure 1 ,like Figure 1 As shown, the system architecture 100 may include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is used to provide a medium for communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0069] Users can use terminal devices 101 , 102 , 103 to interact with server 105 via network 104 to receive or send messages, etc.

[0070] Terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 players (Moving Picture Experts Group Audio Layer III), MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers, desktop computers, etc.

[0071] The server 105 may be a server that provides various services, such as a background server that provides support for web pages displayed on the terminal devices 101 , 102 , and 103 .

[0072] It should be noted that the network intrusion detection model training method provided in the embodiment of the present application is executed by a server, and accordingly, the network intrusion detection model training device is arranged in the server.

[0073] It should be understood that Figure 1 The number of terminal devices, networks and servers in the embodiment is only for illustration. According to the implementation requirements, there may be any number of terminal devices, networks and servers. The terminal devices 101, 102, 103 in the embodiment of the present application may specifically correspond to application systems in actual production.

[0074] See also Figure 2 , Figure 2 A network intrusion detection model training method provided by an embodiment of the present invention is shown, and the method is applied in Figure 1 The server in is used as an example to illustrate the details as follows:

[0075] S201: Collect a real data set, where the real data set is continuous time series network traffic data.

[0076] S202: Inputting the real data set into the initial network intrusion monitoring model, where the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model.

[0077] S203: Use the feature labeling model to encode and label the real data set to obtain an input sequence.

[0078] In a specific optional implementation, the feature labeling model is an attention mechanism model. In step S203, the feature labeling model is used to encode and label the real data set, and the input sequence obtained includes:

[0079] Perform data classification and synthesis on the real data set to obtain a mixed data set;

[0080] Through linear projection, the mixed data set is linearly projected onto N tk dimension, and obtain feature embedding;

[0081] The attention mechanism is used to combine feature embedding and position embedding to obtain the input sequence.

[0082] In a specific optional implementation manner, data classification and synthesis are performed on the real data set to obtain a mixed data set including:

[0083] In each time range, the representation features of continuous time series network traffic data {f (j)} j and classification {c (j)} j Segment into raw data segments Original data fragment {f (j) ,c (j)} j Contains a mixture of at least two known attack types;

[0084] Shuffle the original data segments to obtain a mixed data set S = {X (k) ,y (k) ,RoF (k)} k ,in is a data sample, Yes X (k)The number of features in y (k) is a one-hot encoded label indicating benign or one of the attack types, RoF (k) =1 means the data sample is real sample data, RoF (k) =0 indicates that the data sample is a generated sample.

[0085] Figure 3 This is a schematic diagram of the process of shuffling and marking the original data fragments in this application. The input data shuffling and tokenization of the proposed TransECGAN (Transformer External Classifier GAN, attention mechanism-external classification generative adversarial network) is as follows Figure 3 As shown. In order to effectively deploy Transformer-based intrusion detection learning in NIDS systems, it is crucial to convert the continuous time series network traffic from real-world datasets into a format suitable for processing by Transformer encoder blocks. These blocks perform well in processing labeled embeddings of 1D sequences.

[0086] Among them, the time span T span is defined as the basic unit, the time step T step A series of time ranges are established, denoted as {r (i) |r (i) =[(i-1)T step ,iT step -T step +T span ]}, where i = 1, 2, .... In each time range, the sequential data representation feature {f (j)} j and classification {c (j)} j is segmented into raw data fragments. These fragments are represented as

[0087] Original data fragment {f (j) ,c (j)} j contains a mixture of multiple known attack (KA) types. The shuffle(·) function is used to separate each mixed raw data segment according to the KA type. For example, if a raw data segment contains feature sequences that are marked as benign and others marked as different KAs, the shuffle(·) function organizes them into separate segments, ensuring that the data for each specific attack type is grouped together. All these shuffled segments from the real dataset are then organized into a new real dataset S = {X (k) ,y (k) ,RoF (k)} k,in is a data sample, Yes X (k) The number of features in y (k) is a one-hot encoded label indicating benign or a certain type of KA, RoF (k) =1 is a sign that the data sample is real.

[0088] It should be noted that for the generated data fragments: these are processed by the shuffle(·) function to form a synthetic dataset, that is, The term “input sample” or “sample” refers to each data sample in both real and synthetic datasets. The Transformer architecture maintains a constant latent variable size N in all its layers. tk To accommodate this, the input sample X or (where X∈S and ) is mapped to N via a trainable linear projection tk Dimension, called feature embedding. Considering the importance of the relationship between sequence order and attack behavior, position embedding is combined with feature embedding to form the input sequence X0.

[0089] S204: Input the input sequence into the local differential privacy detection model for intrusion classification and identification, obtain the identification result, and update the parameters of the initial network intrusion monitoring model based on the identification result until the preset conditions are met to obtain the target network intrusion monitoring model.

[0090] In a specific optional implementation, the local differential privacy detection model is obtained by combining a generative adversarial network model and an external classifier. In step S204, the input sequence is input into the local differential privacy detection model for intrusion classification and identification, and the identification results obtained include:

[0091] Generative adversarial networks are used to perform sample generation training and adversarial training on the input sequence. The generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization. The discriminative network adds a binary head.

[0092] The results of generative adversarial training are identified through an external classifier, which uses a multi-category auxiliary classifier or a SoftMax layer.

[0093] Specifically, in the TransECGAN of this embodiment, a comprehensive model is designed to enhance the detection capability, integrating three basic components: Generator Discriminator and classifier Have weights respectively ω and θ. Figure 4 As shown, Figure 4This is a structural example diagram of a local differential privacy detection model in this application. This detection model is designed to enhance the robust generalization capability in different scenarios.

[0094] Wasserstein Discriminator Aims to distinguish between real and generated input samples. It receives input X∈S from a real dataset S or a generated dataset The input and output is a probability distribution f ω (X) or in represents generation, 1 represents truth. ω , the Wasserstein distance used in is crucial to the convergence of the model, which provides stable gradients during the training process. The loss for and as follows:

[0095]

[0096] ii) Generator It captures and replicates the data distribution to generate realistic input samples. It does this by passing a random 2D noise vector Z (i) Start this process and combine it with the randomly generated class labels as label conditions to enhance the generalization and accuracy of the model. By generating each input sample Class Label And the logo RoF (k) =0(fake), to create a data set for The effectiveness is measured by the following equation:

[0097]

[0098] iii) Classifier is an auxiliary multi-class classifier designed to ensure accurate classification of real and synthetic input samples. For each input sample, that is, for or Multi-class classifier By outputting a probability distribution or to assign it a class label, covering all possible class labels, such as benign or a certain type of KAs, regardless of whether it comes from the real S or generated for and The output probability distribution is evaluated by the following equation:

[0099]

[0100] Generator in TransECGAN Discriminator and classifier The Transformer encoder is used as the basic module and is divided into two main components: a multi-head self-attention (MSA) layer for detailed data review, and a multi-layer perceptron (MLP) layer with GELU nonlinearity and layer normalization (LN). In particular, A binary head is added as a Real-Fake Classifier (RFC) using the Sigmoid function to distinguish between real and generated input samples. A multi-class auxiliary classifier (AC) or SoftMax layer is integrated, which is suitable for multi-class classification tasks. After shuffling and tokenizing the input data, the input sequence X0 is processed to generate the output y, RoF or The calculation steps are controlled by the following equation:

[0101]

[0102] To protect the privacy of training data, TransECGAN implements LDP by adding carefully designed noise and gradient pruning strategies. This approach avoids adding conservative noise directly to the detection model parameters. Providing differential privacy guarantees for TransECGAN requires limiting the number of training samples to and The gradient g ω and g θ Impact

[0103] The gradient is first clipped to the L2 norm by the clip(·) function, and g ω (or g θ ) is changed to (or ), according to the trimming threshold C ω (or C θ ). The clipping ensures that if || g ω ||2≤C ω (or || g θ ||2≤C θ ), then keep g ω (or g θ ), and if ||g ω ||2>C ω (or || gθ ||2>C θ ), then scale it to the norm C ω (or C θ ). After cutting, (or ) injects carefully designed Gaussian noise, through (or ) to achieve (∈,δ)-differential privacy, where the noise scaling factor σ θ and σ ω Calculated as and The weights ω and θ of are proven to maintain differential privacy under any training sample, and the privacy of untrained data is naturally guaranteed because replacing this data does not change the output distribution, which essentially mimics the scenario of ∈ = 0 from the perspective of differential privacy. Weight The privacy of any training sample is also maintained through the post-processing characteristics of differential privacy, which means that any subsequent operations according to the differential privacy mechanism will not compromise privacy. The reason for this is that The function of _{\theta} ...

[0104] In a specific optional implementation, identifying the result of generative adversarial training by an external classifier includes:

[0105] A discriminant network is used to assign InD or OOD labels to samples in the input sequence;

[0106] When the sensitivity analysis value of the class label determined by the external classifier is lower than the labeling threshold, the outlier detection method is used to determine the class label for identification.

[0107] Specifically, in the intrusion detection system of the present embodiment, OOD (Out-of-Distribution) detection is a key function that can identify and respond to new, unseen or abnormal activities that deviate from typical network or system behaviors. OOD samples are those that fall outside the distribution of the training dataset, commonly known as outliers, while InD (In-Distribution) samples, or inliers, are samples that fall within the expected range. The proposed TransECGAN is particularly good at acting as an OOD detector by utilizing its discriminator to assign InD or OOD labels to input samples when the classifier determines that the MSP (Most Sensitive Point) of the class label is lower than its pseudo-label threshold τ.

[0108] Figure 5This is a flowchart of an outlier detection process in this application. Figure 5 The OOD detection process of TransECGAN is shown, which is achieved through a two-stage classification process. Considering m types of KAs (known attacks), this refined IDS performs multi-class classification of m+2 categories, where

[0109] m∈{Benign,KA1,...,KA m ,UA}, this set includes m+1 labeled categories from the training dataset (including Benign and m KAs), and an additional unknown attack (UA) category that is not in the training dataset. The classifier c assigns fine-grained labels to KAs, while the discriminator The UA category is finally determined (when MSP < τ). This design is based on the proven assumption:

[0110] Hypothesis S1: UA samples are more likely to be OOD than Benign or KA samples;

[0111] Hypothesis S2: The Benign sample is more likely to be OOD than the KA sample.

[0112] In the first stage, if the classifier Calculate the probability distribution of m+1 categories for the input sample (whether real or generated), and if MSP≥τ, the initial prediction is trusted and the class label is returned. If MSP<τ, the input sample is considered OOD and the class label from Instead, the final decision depends on Evaluation: If it is found to be true, then Returns the MSP category tag, which may indicate Benign or one of the m KAs; if it is identified as generated, the UA category tag is assigned.

[0113] In this embodiment, by collecting a real data set, the real data set is a continuous time series network traffic data; the real data set is input into the initial network intrusion monitoring model, the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model; the feature labeling model is used to encode and label the real data set to obtain an input sequence; the input sequence is input into the local differential privacy detection model for intrusion classification and recognition to obtain a recognition result, and the parameters of the initial network intrusion monitoring model are updated based on the recognition result until the preset conditions are met to obtain a target network intrusion monitoring model. By generating realistic network traffic samples, these samples are used to train and optimize the detection model, which enhances the generalization ability of the model in the face of actual network environments, has the ability to identify unknown attacks, and improves the accuracy and timeliness of intrusion detection.

[0114] See also Figure 6 , Figure 6 A network intrusion detection method provided by an embodiment of the present invention is shown. Figure 1 The server in is used as an example to illustrate the details as follows:

[0115] S205: Collecting real-time network data;

[0116] S206: Input the real-time network data into the target network intrusion monitoring model to perform intrusion detection and obtain intrusion detection results.

[0117] In this embodiment, by using a trained target network intrusion monitoring model, intrusion detection is quickly performed on real-time network data, thereby improving the timeliness of intrusion detection.

[0118] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0119] Figure 7 The principle block diagram of the network intrusion detection model training device corresponding to the network intrusion detection model training method in the above embodiment is shown. Figure 7 As shown, the network intrusion detection model training device includes a data acquisition module 31, a data input module 32, a sample encoding module 33 and a model training module 34. The functional modules are described in detail as follows:

[0120] The data collection module 31 is used to collect real data sets, which are continuous time series network traffic data;

[0121] A data input module 32, used to input a real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model;

[0122] The sample encoding module 33 is used to encode and mark the real data set using a feature marking model to obtain an input sequence;

[0123] The model training module 34 is used to input the input sequence into the local differential privacy detection model for intrusion classification and identification, obtain the identification result, and update the parameters of the initial network intrusion monitoring model based on the identification result until the preset conditions are met to obtain the target network intrusion monitoring model.

[0124] Optionally, the sample encoding module 33 includes:

[0125] The sample augmentation unit is used to classify and synthesize the real data set to obtain a mixed data set;

[0126] The linear projection unit is used to linearly project the mixed data set onto N tk dimension, and obtain feature embedding;

[0127] The sequence generation unit is used to use the attention mechanism to combine feature embedding and position embedding to obtain the input sequence.

[0128] Optionally, the sample augmentation unit includes:

[0129] The data characterization subunit is used to represent the continuous time series network traffic data {f (j)} j and classification {c (j)} j Segment into raw data segments Original data fragment {f (j) ,c (j)} j Contains a mixture of at least two known attack types;

[0130] The data shuffling subunit is used to shuffle the original data segments to obtain a mixed data set S = {X (k) ,y (k) ,RoF (k)} k ,in is a data sample, Yes X (k) The number of features in y (k) is a one-hot encoded label indicating benign or one of the attack types, RoF (k) =1 means the data sample is real sample data, RoF (k) =0 indicates that the data sample is a generated sample.

[0131] Optionally, the model training module 34 includes:

[0132] Generative adversarial unit, used to perform sample generation training and adversarial training on the input sequence using a generative adversarial network. The generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization, and the discriminative network adds a binary head;

[0133] The classification recognition unit is used to recognize the results of generative adversarial training through an external classifier. The external classifier uses a multi-category auxiliary classifier or a SoftMax layer.

[0134] Optionally, the classification and identification unit includes:

[0135] A label assignment subunit, used to assign InD or OOD labels to samples in the input sequence using a discriminant network;

[0136] The anomaly detection subunit is used to determine the category label for identification by using an outlier detection method when the sensitivity analysis value of the class label determined by the external classifier is lower than the labeling threshold.

[0137] Figure 8 FIG. 1 is a block diagram showing a principle of a network intrusion detection module corresponding to the network intrusion detection method in the above embodiment. Figure 8 As shown, the network intrusion detection model training device includes a data acquisition module 35 and an intrusion detection module 36. Each functional module is described in detail as follows:

[0138] A data acquisition module 35 is used to collect real-time network data;

[0139] The intrusion detection module 36 is used to input the real-time network data into the target network intrusion monitoring model to perform intrusion detection and obtain intrusion detection results.

[0140] For the specific definition of the network intrusion detection model training device, please refer to the definition of the network intrusion detection model training method above, which will not be repeated here. Each module in the above-mentioned network intrusion detection model training device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0141] To solve the above technical problems, the present application also provides a computer device. Fig. 9 , Fig. 9 This is a basic structural block diagram of the computer device in this embodiment.

[0142] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 with components connected to the memory 41, the processor 42, and the network interface 43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (Application Specific Integrated Circuit, ASIC), programmable gate arrays (Field-Programmable Gate Array, FPGA), digital processors (Digital Signal Processor, DSP), embedded devices, etc.

[0143] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0144] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or D interface display memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as the program code of the network intrusion detection model training method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0145] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run the program code stored in the memory 41 or process data, such as running the program code of the network intrusion detection model training method.

[0146] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0147] The present application also provides another implementation, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores an interface display program, and the interface display program can be executed by at least one processor so that the at least one processor performs the steps of the network intrusion detection model training method as described above.

[0148] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0149] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to replace some of the technical features therein with equivalents. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A network intrusion detection model training method, characterized in that: include: Collecting a real data set, where the real data set is continuous time series network traffic data; Inputting the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model; Using the feature labeling model to encode and label the real data set to obtain an input sequence; The input sequence is input into the local differential privacy detection model for intrusion classification and identification to obtain an identification result, and the parameters of the initial network intrusion monitoring model are updated based on the identification result until a preset condition is met to obtain a target network intrusion monitoring model.

2. The network intrusion detection model training method according to claim 1, characterized in that: The feature labeling model is an attention mechanism model, and the real data set is encoded and labeled by using the feature labeling model to obtain an input sequence including: Performing data classification and synthesis on the real data set to obtain a mixed data set; Through linear projection, the mixed data set is linearly projected onto N tk dimension, and obtain feature embedding; The input sequence is obtained by using an attention mechanism and combining the feature embedding and the position embedding.

3. The network intrusion detection model training method according to claim 2, characterized in that: The performing data classification and synthesis on the real data set to obtain a mixed data set comprises: In each time range, the representation features of continuous time series network traffic data {f (j) } j and classification {c (j) } j Segment into raw data segments The original data segment {f (j) ,c (j) } j Contains a mixture of at least two known attack types, where {f (j) } j Represents a series of time series data features, where j is the index of the feature, representing different time steps or data samples, {c (j) } j represents a series of classification labels, where j is the index of the label corresponding to each feature f (j) Classification results, original data fragment: represents a set of raw data fragments, each of which is represented by feature f (j) and Classification C (j) Here, f (j) Is a The eigenvector of (j) Is a The index j indicates the number of features and classifications in each segment, while i indicates different raw data segments; The original data segments are shuffled to obtain a mixed data set S = {X (k) ,y (k) ,RoF (k) } k ,in is a data sample, Yes X (k) The number of features in y (k) is a one-hot encoded label indicating benign or one of the attack types, RoF (k) =1 means the data sample is real sample data, RoF (k) =0 indicates that the data sample is a generated sample.

4. The network intrusion detection model training method according to claim 1, characterized in that: The local differential privacy detection model is obtained by combining a generative adversarial network model and an external classifier. The input sequence is input into the local differential privacy detection model for intrusion classification and identification, and the identification result obtained includes: A generative adversarial network is used to perform sample generation training and adversarial training on the input sequence, wherein the generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization, and a discriminant network adds a binary head; The results of generative adversarial training are identified through an external classifier, and the external classifier adopts a multi-category auxiliary classifier or a SoftMax layer.

5. The network intrusion detection model training method according to claim 4, characterized in that: The identifying the result of generative adversarial training by an external classifier includes: Using a discriminant network to assign InD or OOD labels to samples in the input sequence; When the sensitivity analysis value of the class label determined by the external classifier is lower than the marking threshold, the class label is determined for identification by using an outlier detection method.

6. A network intrusion detection method, characterized in that: include: Collect real-time network data; The real-time network data is input into a target network intrusion monitoring model for intrusion detection to obtain an intrusion detection result, wherein the target network intrusion monitoring model is trained according to the network intrusion detection model training method according to any one of claims 1 to 5.

7. A network intrusion detection model training device, characterized in that: include: A data collection module is used to collect a real data set, where the real data set is continuous time series network traffic data; A data input module, used to input the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model includes a feature labeling model and a local differential privacy detection model; A sample encoding module, used to encode and mark the real data set using the feature marking model to obtain an input sequence; The model training module is used to input the input sequence into the local differential privacy detection model for intrusion classification and identification, obtain an identification result, and update the parameters of the initial network intrusion monitoring model based on the identification result until the preset conditions are met to obtain the target network intrusion monitoring model.

8. A network intrusion detection device, characterized in that: include: Data acquisition module, used to collect real-time network data; The intrusion detection module is used to input the real-time network data into a target network intrusion monitoring model for intrusion detection to obtain an intrusion detection result. The target network intrusion monitoring model is trained according to the network intrusion detection model training method according to any one of claims 1 to 5.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the network intrusion detection model training method as described in any one of claims 1 to 5 is implemented, or when the processor executes the computer program, the network intrusion detection method as described in claim 6 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by the processor, it implements the network intrusion detection model training method as described in any one of claims 1 to 5, or, when the computer program is executed by the processor, it implements the network intrusion detection method as described in claim 6.

Images