Network intrusion detection model training method, intrusion detection method and related device

Abstract

The application discloses a network intrusion detection model training method, an intrusion detection method and related equipment, and comprises the following steps: collecting a real data set, wherein the real data set is continuous time series network flow data; inputting the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model comprises a feature marking model and a local differential privacy detection model; using the feature marking model to encode and mark the real data set to obtain an input sequence; inputting the input sequence into the local differential privacy detection model for intrusion classification and identification to obtain an identification result, updating parameters of the initial network intrusion monitoring model based on the identification result until a preset condition is reached, and obtaining a target network intrusion monitoring model. The application improves the accuracy and timeliness of network intrusion detection.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network intrusion detection model training method, an intrusion detection method and related equipment. BACKGROUND

[0002] With the development of computer technology, networks should be more and more widely used, and network security has become an important topic of concern. Traditional IDS mainly relies on static predefined rules and signature matching mechanisms, which are stable in protecting known threats. However, when facing new complex attack forms such as advanced persistent threats (APT) and zero-day attacks, the detection efficiency is significantly limited, and the drawbacks of single threat data detection method and insufficient detection ability are exposed. Although researchers have proposed a variety of innovative IDS technologies, these technologies still have many challenges. For example, Wang et al. proposed HAST-IDS, Kim et al. developed AI-IDS, and Vinayakumar et al. used deep neural network learning technology to improve the detection ability of IDS in complex attack scenarios, but the problems of affecting the detection speed when processing real-time data and the model updating not being timely still need to be solved. Similarly, Seo et al. GIDS uses GAN to enhance the vehicle-mounted network IDS, but it is difficult to generalize to other environments; Duy et al. DIGFuPAS uses GAN to deceive IDS in SDN to improve the detection of adversarial samples, but needs to balance generation and detection; Tabassum et al. Fedgan-IDS combines GAN and federated learning to protect privacy, but the detection ability needs to be verified; Xu et al. Bidirectional GAN combines one-class classifier to improve detection, but the generalization ability is insufficient.

[0003] The above shows that it is a technical problem to be solved to overcome the problems of single threat data detection method, high detection difficulty, and low recognition rate of unknown network attacks. SUMMARY

[0004] The embodiments of the present application provide a network intrusion detection model training method, a network intrusion detection method, a device, a computer device and a storage medium to improve the efficiency of data repair.

[0005] To solve the above technical problems, the present application provides a network intrusion detection model training method, comprising:

[0006] Collecting a real data set, the real data set being continuous time series network flow data;

[0007] Inputting the real data set into an initial network intrusion monitoring model, the initial network intrusion monitoring model comprising a feature labeling model and a local differential privacy detection model;

[0008] The feature labeling model is used to encode and label the real dataset to obtain the input sequence;

[0009] The input sequence is fed into the local differential privacy detection model for intrusion classification and identification to obtain the identification result. The parameters of the initial network intrusion detection model are updated based on the identification result until a preset condition is met to obtain the target network intrusion detection model.

[0010] Optionally, the feature labeling model is an attention mechanism model, and the step of encoding and labeling the real dataset using the feature labeling model to obtain the input sequence includes:

[0011] The real dataset is classified and synthesized to obtain a hybrid dataset;

[0012] The hybrid dataset is linearly projected and mapped to using linear projection. Dimensions are used to obtain feature embeddings;

[0013] The input sequence is obtained by combining the feature embedding and the position embedding using an attention mechanism.

[0014] Optionally, the step of classifying and synthesizing the real dataset to obtain a hybrid dataset includes:

[0015] Representation characteristics of continuous time series network traffic data within each time range and classification Segmented into raw data fragments Original data fragments It contains a mixture of at least two known attack types;

[0016] The original data fragments are shuffled to obtain a mixed dataset. ,in It is a data sample. yes The number of features in the middle, It is a one-hot encoded tag that indicates benign or one of the attack types. This indicates that the data sample is real sample data. The data sample is identified as a generated sample.

[0017] Optionally, the local differential privacy detection model is obtained by combining a generative adversarial network model and an external classifier. The step of inputting the input sequence into the local differential privacy detection model for intrusion classification and identification, and obtaining the identification result, includes:

[0018] The input sequence is subjected to sample generation training and adversarial training by using a generative adversarial network using a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization, and a binary head is added to the discriminator network;

[0019] The result of the generative adversarial training is identified by an external classifier, which uses a multi-class auxiliary classifier or a SoftMax layer.

[0020] Optionally, the identifying the result of the generative adversarial training by the external classifier comprises:

[0021] The samples in the input sequence are assigned an InD or OOD label by using the discriminator network.

[0022] When the external classifier determines that the sensitivity analysis value of the class label is lower than a marked threshold, the class label is determined for identification by using an outlier detection method.

[0023] To solve the above technical problems, the embodiments of the present application provide a network intrusion detection method, comprising:

[0024] Collecting real-time network data;

[0025] Inputting the real-time network data into a target network intrusion monitoring model for intrusion detection to obtain an intrusion detection result.

[0026] To solve the above technical problems, the embodiments of the present application also provide a network intrusion detection model training device, comprising:

[0027] A data collection module is configured to collect a real data set, which is continuous time series network flow data;

[0028] A data input module is configured to input the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model comprises a feature labeling model and a local differential privacy detection model;

[0029] A sample encoding module is configured to encode and label the real data set by using the feature labeling model to obtain an input sequence;

[0030] A model training module is configured to input the input sequence into the local differential privacy detection model for intrusion classification and identification to obtain an identification result, and update parameters of the initial network intrusion monitoring model based on the identification result until a preset condition is reached to obtain a target network intrusion monitoring model.

[0031] Optionally, the sample encoding module comprises:

[0032] a sample augmentation unit configured to perform data classification and synthesis on the real data set to obtain a mixed data set;

[0033] a linear projection unit configured to perform linear projection mapping of the mixed data set to a feature embedding by linear projection; a dimension, to obtain a feature embedding;

[0034] a sequence generation unit configured to adopt an attention mechanism to splice the feature embedding and a position embedding to obtain the input sequence.

[0035] Optionally, the sample augmentation unit comprises:

[0036] a data representation subunit configured to segment the representation features of the continuous time series network traffic data into original data segments in each time range; and classification segmented into original data segments , original data segments containing a mixture of at least two known attack types;

[0037] shuffling the original data segments to obtain a mixed data set , wherein is a data sample, is the number of features in is a one-hot encoded label indicating benign or one of the attack types, indicates that the data sample is real sample data, indicates that the data sample is a generated sample.

[0038] Optionally, the model training module comprises:

[0039] a generative adversarial unit configured to perform sample generation training and adversarial training on the input sequence by using a generative adversarial network, the generative adversarial network using a multi-head self-attention layer and a multi-layer perceptron layer with non-linearity and layer normalization, and the discriminative network adding a binary head;

[0040] a classification identification unit configured to identify the result of the generative adversarial training by an external classifier, the external classifier adopting a multi-class auxiliary classifier or a SoftMax layer.

[0041] Optionally, the classification identification unit comprises:

[0042] a label assignment subunit configured to assign an InD or OOD label to the samples in the input sequence by using the discriminative network;

[0043] Anomaly detection subunit, configured to determine a class label to recognize by using an anomaly value detection manner when the external classifier determines that a sensitivity analysis value of the class label is lower than a marking threshold.

[0044] To solve the above technical problems, the embodiment of the application further provides a network intrusion detection device, comprising:

[0045] A data acquisition module is configured to collect real-time network data.

[0046] An intrusion detection module is configured to input the real-time network data into a target network intrusion monitoring model to perform intrusion detection, and obtain an intrusion detection result.

[0047] To solve the above technical problems, the embodiment of the application further provides a computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the network intrusion detection model training method when executing the computer program, or the processor implements the steps of the network intrusion detection method when executing the computer program.

[0048] To solve the above technical problems, the embodiment of the application further provides a computer readable storage medium, which stores a computer program, wherein the computer program is executed by a processor to implement the steps of the network intrusion detection model training method, or the computer program is executed by the processor to implement the steps of the network intrusion detection method.

[0049] The network intrusion detection model training method, the network intrusion detection method, the device, the computer device and the storage medium provided by the embodiment of the application collect a real data set, which is continuous time sequence network flow data; input the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model comprises a feature marking model and a local differential privacy detection model; encode and mark the real data set by using the feature marking model to obtain an input sequence; input the input sequence into the local differential privacy detection model to perform intrusion classification and recognition, obtain a recognition result, and update parameters of the initial network intrusion monitoring model based on the recognition result until a preset condition is reached to obtain a target network intrusion monitoring model. The network intrusion detection model training method, the network intrusion detection method, the device, the computer device and the storage medium provided by the embodiment of the application generate realistic network flow samples, which are used to train and optimize the detection model, enhance the generalization ability of the model in the actual network environment, have the ability to identify unknown attacks, and improve the accuracy and timeliness of intrusion detection. BRIEF DESCRIPTION OF DRAWINGS

[0050] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the description of the embodiments of the present application will be briefly introduced as follows. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can also be obtained by those skilled in the art without any creative labor on the basis of these drawings.

[0051] Figure 1 is an exemplary system architecture diagram to which the present application can be applied;

[0052] Figure 2 is a flowchart of an embodiment of the network intrusion detection model training method of the present application;

[0053] Figure 3 is a flowchart of the original data segment shuffling and marking of the present application;

[0054] Figure 4 is a structural example diagram of a local differential privacy detection model of the present application;

[0055] Figure 5 is a flowchart of an anomaly value detection of the present application;

[0056] Figure 6 is a flowchart of an embodiment of the network intrusion detection method of the present application;

[0057] Figure 7 is a structural diagram of an embodiment of the network intrusion detection model training device according to the present application;

[0058] Figure 8 is a structural diagram of an embodiment of the network intrusion detection device according to the present application;

[0059] Figure 9 is a structural diagram of an embodiment of the computer device according to the present application. DETAILED DESCRIPTION

[0060] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which the present application belongs; the terms used in the specification of the application are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "include" and "have" and any variations thereof in the specification and claims of the present application and the above description of drawings are intended to cover non-exclusive inclusion. The terms "first", "second" and the like in the specification and claims of the present application and the above description of drawings are used to distinguish different objects, not to describe a specific order.

[0061] Reference to“an embodiment” herein means that a particular feature, structure, or characteristic described in connection with the embodiment can be included in at least one embodiment of the application. The appearances of the phrase“in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily all referring to a common set of embodiments, although they can. It is explicitly contemplated that one or more features of any embodiment described herein can be included in a different embodiment.

[0062] Some professional terms of the application are explained:

[0063] Cybersecurity threat: refers to various factors or behaviors that pose potential harm to computer network systems, devices, or data within the network. These threats can come from within (such as employee misoperation, malicious behavior) or from outside (such as hacking attacks, virus spread).

[0064] Transformer: a deep learning model for processing time series data, particularly suitable for network traffic analysis and classification.

[0065] GAN: a generative neural network that can learn the mapping from a simple latent (or noise) distribution to an arbitrarily complex data distribution, generating realistic data. In GAN, two models are trained simultaneously: the generator tries to generate synthetic samples that approximate the real data distribution, while the discriminator estimates the probability that the sample comes from the real data set rather than the output of the generator.

[0066] EC-GAN: a variant of generative adversarial networks that improves classification performance by adding an external classifier

[0067] DP (detection model with local differential privacy): DP constitutes a strong standard for ensuring the privacy of data set aggregation algorithms.

[0068] The technical solutions in the embodiments of the application will be described clearly and completely below in conjunction with the drawings in the embodiments of the application. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor fall within the scope of protection of the application.

[0069] Please refer to Figure 1 , for example Figure 1As shown, the system architecture 100 can include terminal devices 101, 102, 103, a network 104 and a server 105. The network 104 is a medium for providing communication links between the terminal devices 101, 102, 103 and the server 105. The network 104 can include various connection types, such as wired, wireless communication links or optical fiber cables, etc.

[0070] The user can use the terminal devices 101, 102, 103 to interact with the server 105 through the network 104 to receive or send messages, etc.

[0071] The terminal devices 101, 102, 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 (Moving Picture Experts Group Audio Layer III) players, MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers and desktop computers, etc.

[0072] The server 105 can be a server providing various services, such as a background server supporting the pages displayed on the terminal devices 101, 102, 103.

[0073] It should be noted that the network intrusion detection model training method provided by the embodiments of the present application is executed by the server, and correspondingly, the network intrusion detection model training device is arranged in the server.

[0074] It should be understood that Figure 1 The number of terminal devices, networks and servers in

[0075] Please refer to Figure 2 , Figure 2 A network intrusion detection model training method provided by an embodiment of the present application is shown, which is taken as an example for description of the server in Figure 1 The details are as follows:

[0076] S201: Collect a real data set, which is continuous time series network traffic data.

[0077] S202: inputting the real data set into an initial network intrusion monitoring model, the initial network intrusion monitoring model comprising a feature marking model and a local differential privacy detection model.

[0078] S203: encoding and marking the real data set by using the feature marking model to obtain an input sequence.

[0079] In a specific optional implementation, the feature marking model is an attention mechanism model, and in step S203, the encoding and marking of the real data set by using the feature marking model to obtain the input sequence comprises:

[0080] performing data classification and synthesis on the real data set to obtain a mixed data set;

[0081] linearly projecting the mixed data set to a dimension by linear projection to obtain feature embedding;

[0082] adopting an attention mechanism to combine the feature embedding and the position embedding to obtain the input sequence.

[0083] In a specific optional implementation, the performing of data classification and synthesis on the real data set to obtain the mixed data set comprises:

[0084] in each time range, segmenting the representation features of the continuous time sequence network flow data and the classification into original data segments , the original data segments containing a mixture of at least two known attack types;

[0085] shuffling the original data segments to obtain the mixed data set , wherein is a data sample, is the number of features in , is a one-hot encoded label representing benign or one of the attack types, represents that the data sample is real sample data, indicates that the data sample is generated sample data.

[0086] Figure 3 is a flowchart of the shuffling and marking of the original data segments by the present application, and the input data shuffling and marking of the proposed TransECGAN (Transformer External Classifier GAN, attention mechanism-external classification generative adversarial network) is as follows Figure 3 ​​As shown. To effectively deploy Transformer-based intrusion detection learning in NIDS systems, it is crucial to convert continuous time-series network traffic from real-world datasets into a format suitable for Transformer encoder block processing. These blocks perform well when processing labeled embeddings of 1D sequences.

[0087] Among them, time span Defined as the basic unit, time step A series of time ranges were established, denoted as ,in Within each timeframe, the sequential data representation features corresponding to the network flow in the real dataset. and classification It is segmented into raw data fragments. These fragments are represented as... .

[0088] raw data fragments It contains a mixture of various known attack (KA) types. The function is used to separate each mixed original data segment based on the KA type. For example, if an original data segment contains feature sequences labeled as benign and others labeled as different KAs, The function organizes them into separate fragments, ensuring that data for each specific attack type is grouped together. All these shuffled fragments from the real dataset are then combined into a new real dataset. ,in It is a data sample. yes The number of features in the middle, It is a one-hot encoded label that indicates a certain type of benign or KA. It is a marker indicating that the data sample is authentic.

[0089] It should be noted that for the generated data fragments: these are obtained through... Function processing to form a synthetic dataset, i.e. The term "input sample" or "sample" refers to each data sample in both real and synthetic datasets. The Transformer architecture maintains a constant latent variable size across all its layers. To accommodate this, input samples or (in and ) through trainable linear projection mapping to The dimension is called the feature embedding. Considering the importance of the relationship between sequence order and attack behavior, the position embedding and feature embedding are combined to form the input sequence. .

[0090] S204: input the input sequence into the local differential privacy detection model for intrusion classification and recognition, obtain a recognition result, and update the parameters of the initial network intrusion monitoring model based on the recognition result until a preset condition is reached, and obtain a target network intrusion monitoring model.

[0091] In a specific optional implementation, the local differential privacy detection model is obtained by combining a generative adversarial network model and an external classifier. In step S204, inputting the input sequence into the local differential privacy detection model for intrusion classification and recognition to obtain a recognition result includes:

[0092] The generative adversarial network is used for sample generation training and adversarial training of the input sequence. The generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization. The discriminator network adds a binary head.

[0093] The result of the generative adversarial training is recognized by the external classifier. The external classifier uses a multi-class auxiliary classifier or a SoftMax layer.

[0094] Specifically, in the TransECGAN of the present embodiment, a comprehensive model is designed to enhance the detection capability, which integrates three basic components: a generator , a discriminator and a classifier , respectively having weights , and . As shown in Figure 4 , Figure 4 is a structure example diagram of a local differential privacy detection model of the present application. This detection model aims to enhance the robust generalization capability in different scenarios.

[0095] The Wasserstein discriminator : aims to distinguish between real and generated input samples. It receives input from a real data set or input from a generated data set , and outputs a probability distribution or , where or indicates generation, and 1 indicates reality. The Wasserstein distance used in is crucial for the convergence of the model, which provides stable gradients during the training process. The loss of is as follows:

[0096] .

[0097] ii) Generator Captures and replicates data distributions to generate realistic input samples. It initiates this process by a random 2D noise vector ( ) and combines a randomly generated class label as a label condition to enhance the model’s generalization and accuracy. By generating each generated input sample , a class label

[0098] , and a flag , a dataset is made. For , , the effectiveness is measured by the following equation:

[0099] .

[0100] iii) Classifier : is a secondary multi-class classifier designed to ensure accurate classification of real and synthetic input samples. For each input sample, i.e., for or , the multi-class classifier assigns a class label to it by outputting a probability distribution or covering all possible class labels, e.g., benign or a certain type of KA, regardless of whether it originates from real or generated . outputs probability distributions for and , which are evaluated by the following equation:

[0101] .

[0102] Generator , discriminator , and classifier in TransECGAN utilize a Transformer encoder as a base module, which is divided into two main components: a multi-head self-attention (MSA) layer for detailed data review, and a multi-layer perceptron (MLP) layer with GELU nonlinearity and layer normalization (LN). Specifically, A binary head is added, and a sigmoid function is used as a Real-Fake classifier (RFC) to distinguish between real and generated input samples. Conversely, This integrates a multi-class auxiliary classifier (AC) or SoftMax layer, suitable for multi-class classification tasks. After shuffling and labeling the input data, the input sequence is processed. To generate output , or The calculation steps are controlled by the following equation:

[0103]

[0104] .

[0105] To protect the privacy of training data, TransECGAN implements differential privacy (LDP) by adding carefully designed noise and gradient pruning strategies. This approach avoids directly adding conservative noise to the detection model parameters. Providing differential privacy guarantees for TransECGAN requires limiting the privacy of each training sample pair. and gradient and Impact

[0106] The gradient first passes through Function trimming to L2 norm, (or ) changed to (or According to the clipping threshold (or Cutting ensures that if (or If ), then retain. (or ), and if (or If ), then scale it to the norm. (or After cutting, to (or Inject carefully designed Gaussian noise, through (or ) to achieve ( , Differential privacy, where the noise scaling factor and Calculated as . and weight and Proven to preserve differential privacy with respect to any training sample and the privacy of untrained data is naturally guaranteed as replacing these data does not change the output distribution, which essentially mimics the scenario from the perspective of differential privacy. The weights of also preserve privacy with respect to any training sample by the post-processing property of differential privacy, which states that any operation following the mechanism of differential privacy does not compromise privacy. The reason it applies here is that the function of — mapping to and — is essentially an operation of computing differentially private weights.

[0107] In a specific optional embodiment, the identifying the result of the generative adversarial training by the external classifier comprises:

[0108] adopting a discriminative network to assign an InD or OOD label to the samples in the input sequence;

[0109] when the external classifier determines that the sensitivity analysis value of the class label is lower than the label threshold, adopting an outlier detection method to determine the class label for identification.

[0110] Specifically, in the intrusion detection system of the embodiment, OOD (Out-of-Distribution) detection is a key function that can identify and respond to new, unseen, or abnormal activities that deviate from typical network or system behavior. OOD samples are those that fall outside the distribution of the training data set, often referred to as outliers, while InD (In-Distribution) samples, or inliers, are those that fall within the expected range. The proposed TransECGAN is particularly good at being an OOD detector by leveraging its discriminator to assign InD or OOD labels to input samples, when the classifier determines that the MSP (Most Sensitive Point) of the class label is lower than its pseudo-label threshold .

[0111] Figure 5 is a flowchart of an outlier detection process of the present application, Figure 5 showing the OOD detection process of the TransECGAN, which is implemented through a two-stage classification process. Considering a (known attack), this refined IDS performs multiclass classification of

[0112] this set includes labeled classes from the training dataset (including and kind ), and an additional unknown attack ( The category is not in the training dataset. (Classifier) for Assign fine-grained labels, while the discriminator Then it will be finally determined. Category (when) (Time). This design is based on proven assumptions:

[0113] • Hypothesis S1: UA samples are more likely to be OOD than... or sample;

[0114] • Hypothesis S2: Benign samples are more likely to be OOD than KA samples.

[0115] In the first stage, if the classifier Calculate the input sample (whether a real sample or a generated sample). The probability distribution of each category, and If so, the initial prediction is trusted and a class label is returned. If If so, the input sample will be considered OOD, and the data from that sample will not be trusted. The prediction of the MSP category. Instead, the final decision depends on... Assessment: If deemed true, then from return Category labels may indicate or kind One of them; if it is determined to be generated, then it is allocated. Category labels.

[0116] In this embodiment, a real-world dataset, consisting of continuous time-series network traffic data, is collected. This dataset is then input into an initial network intrusion detection model, which includes a feature labeling model and a local differential privacy (LDP) detection model. The feature labeling model encodes and labels the real-world dataset to obtain an input sequence. This input sequence is then fed into the LDP detection model for intrusion classification and identification, yielding a recognition result. Based on this result, the parameters of the initial network intrusion detection model are updated until preset conditions are met, resulting in the target network intrusion detection model. This approach generates realistic network traffic samples, which are used to train and optimize the detection model. This enhances the model's generalization ability in real-world network environments, enabling it to identify unknown attacks and improving the accuracy and timeliness of intrusion detection.

[0117] Please seeFigure 6 , Figure 6 A network intrusion detection method is shown, and the method is applied to a server in Figure 1 for example, and is described in detail as follows:

[0118] S205: Collect real-time network data;

[0119] S206: Input the real-time network data into the target network intrusion monitoring model for intrusion detection, and obtain an intrusion detection result.

[0120] In this embodiment, the trained target network intrusion monitoring model is used to quickly perform intrusion detection on real-time network data, thereby improving the timeliness of intrusion detection.

[0121] It should be understood that the size of the serial number of each step in the above embodiment does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiment of the application.

[0122] Figure 7 The principle block diagram of a network intrusion detection model training device corresponding to the network intrusion detection model training method described above is shown. As shown in Figure 7 , the network intrusion detection model training device includes a data collection module 31, a data input module 32, a sample encoding module 33, and a model training module 34. Each functional module is described in detail as follows:

[0123] The data collection module 31 is used to collect a real data set, and the real data set is continuous time series network flow data;

[0124] The data input module 32 is used to input the real data set into an initial network intrusion monitoring model, and the initial network intrusion monitoring model includes a feature marking model and a local differential privacy detection model;

[0125] The sample encoding module 33 is used to encode and mark the real data set by using the feature marking model to obtain an input sequence;

[0126] The model training module 34 is used to input the input sequence into the local differential privacy detection model for intrusion classification and recognition, obtain a recognition result, and update the parameters of the initial network intrusion monitoring model based on the recognition result until a preset condition is reached, and obtain a target network intrusion monitoring model.

[0127] Optionally, the sample encoding module 33 includes:

[0128] A sample augmentation unit is used to classify and synthesize the real data set to obtain a mixed data set;

[0129] Linear projection units are used to linearly project the mixed dataset onto a target dataset. Dimensions are used to obtain feature embeddings;

[0130] The sequence generation unit is used to combine feature embeddings and position embeddings using an attention mechanism to obtain the input sequence.

[0131] Optionally, the sample augmentation unit includes:

[0132] Data representation subunits are used to represent the characteristics of continuous time-series network traffic data within each time range. and classification Segmented into raw data fragments Original data fragments It contains a mixture of at least two known attack types;

[0133] The data shuffling subunit is used to shuffle the original data fragments to obtain a mixed dataset. ,in It is a data sample. yes The number of features, It is a one-hot encoded tag that indicates benign or one of the attack types. This indicates that the data sample is real sample data. The data sample is identified as a generated sample.

[0134] Optionally, the model training module 34 includes:

[0135] Generative Adversarial Unit (GAN) is used to train the input sequence for sample generation and adversarial training using a Generative Adversarial Network (GAN). The GAN uses a multi-head self-attention layer and a multi-layer perceptron layer with non-linearity and layer normalization. The discriminative network adds a binary head.

[0136] The classification and recognition unit is used to recognize the results of generative adversarial training through an external classifier, which may be a multi-class auxiliary classifier or a SoftMax layer.

[0137] Optionally, the classification and recognition unit includes:

[0138] The label assignment subunit is used to assign InD or OOD labels to samples in the input sequence using a discriminant network;

[0139] The anomaly detection subunit is used to determine the category label for identification when the sensitivity analysis value of the class label determined by the external classifier is lower than the labeling threshold.

[0140] Figure 8A principle block diagram of a network intrusion detection model device corresponding to the network intrusion detection method is shown. As shown in Figure 8 The network intrusion detection model training device includes a data acquisition module 35 and an intrusion detection module 36. The functions of the modules are described as follows.

[0141] The data acquisition module 35 is configured to acquire real-time network data.

[0142] The intrusion detection module 36 is configured to input the real-time network data into a target network intrusion detection model to perform intrusion detection and obtain an intrusion detection result.

[0143] The specific limitations of the network intrusion detection model training device can be found in the limitations of the network intrusion detection model training method described above, which will not be repeated here. The modules in the network intrusion detection model training device described above can be realized by software, hardware and combinations thereof. The modules described above can be embedded in or independent of the processor in the computer device in hardware form, or can be stored in the memory in the computer device in software form, so that the processor can call and execute the operations corresponding to the modules.

[0144] To solve the above technical problems, the embodiments of the present application further provide a computer device. For details, please refer to Figure 9 , Figure 9 The basic structure block diagram of the computer device of the present embodiment is shown.

[0145] The computer device 4 includes a memory 41, a processor 42 and a network interface 43 which are connected to each other through a system bus. It should be noted that only the computer device 4 with the components of the memory 41, the processor 42 and the network interface 43 is shown in the figure, but it should be understood that not all the components shown are required, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculation and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0146] The computer device can be a desktop computer, a notebook computer, a palm computer and a cloud server, etc. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad or a voice control device, etc.

[0147] The memory 41 includes at least one type of readable storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or D interface display memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or a memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the computer device 4. Of course, the memory 41 can also include both the internal storage unit and the external storage device of the computer device 4. In this embodiment, the memory 41 is generally used to store an operating system and various application software installed on the computer device 4, such as program codes of the network intrusion detection model training method, etc. In addition, the memory 41 can also be used to temporarily store various data that have been output or will be output.

[0148] The processor 42 can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run program codes or process data stored in the memory 41, such as program codes of the network intrusion detection model training method.

[0149] The network interface 43 can include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0150] The present application also provides another embodiment, i.e., to provide a computer readable storage medium storing an interface display program, which can be executed by at least one processor to enable the at least one processor to perform the steps of the network intrusion detection model training method as described above.

[0151] Those skilled in the art can clearly understand the above-mentioned embodiment method can be realized by means of software and the necessary general hardware platform, of course, it can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) execute the methods described in various embodiments of the present application.

[0152] Obviously, the above-described embodiments are only some of the embodiments of the present application, not all the embodiments, and the drawings show the preferred embodiments of the present application, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or make equivalent replacements to some of the technical features. Any equivalent structure made by using the contents of the specification and drawings, directly or indirectly applied to other related technical fields, is also within the scope of the patent protection of the present application.

Claims

1. A method for training a network intrusion detection model, characterized in that, The method comprises the following steps: collecting a real data set, which is continuous time series network traffic data; inputting the real data set into an initial network intrusion monitoring model, wherein the initial network intrusion monitoring model comprises a feature labeling model and a local differential privacy detection model; encoding and labeling the real data set by using the feature labeling model to obtain an input sequence, wherein the feature labeling model is a Transformer encoder based on an attention mechanism, which is used to segment, shuffle, linearly project and position embed the real data set to generate an input sequence with time series relationship; inputting the input sequence into the local differential privacy detection model for intrusion classification and identification to obtain an identification result, and updating parameters of the initial network intrusion monitoring model based on the identification result until a preset condition is reached to obtain a target network intrusion monitoring model, wherein the local differential privacy detection model is composed of a generative adversarial network model and an external classifier, the generative adversarial network uses a multi-head self-attention layer, a multi-layer perceptron layer with GELU nonlinearity and layer normalization, the discriminative network adds a binary head for Real / Fake classification, and the external classifier uses a multi-class auxiliary classifier or a SoftMax layer; the network intrusion detection model training method further comprises: assigning an InD or OOD label to a sample in the input sequence by using a discriminative network, and determining the class label by using an outlier detection method when the external classifier determines that the sensitivity analysis value of the class label is lower than a pseudo-label threshold.

2. The network intrusion detection model training method of claim 1, wherein, The feature labeling model is an attention mechanism model, and the encoding and labeling of the real data set by using the feature labeling model to obtain an input sequence comprises: performing data classification and synthesis on the real data set to obtain a mixed data set; by linear projection, linearly projecting the mixed dataset to dimensions to obtain a feature embedding; using an attention mechanism to combine the feature embedding and the position embedding to obtain the input sequence.

3. The network intrusion detection model training method of claim 2, wherein, The data classification and synthesis on the real data set to obtain a mixed data set comprises: In each time range, a representation of the continuous time series network traffic data and classification is segmented into raw data segments , the raw data segments contain a mixture of at least two known attack types, wherein represents a series of time series data features, wherein is the index of the feature, representing different time steps or data samples, represents a series of category labels, wherein is the index of the label, corresponding to the classification result of each feature , raw data segment: denotes a set of original data segments, where each segment is composed of features and classifications , is a feature vector belonging to , is a classification vector belonging to , indexed by denotes the number of features and classifications in each segment, while denotes different original data segments; shuffling the original data segments to obtain a mixed data set wherein is a data sample, is the number of features in is a one-hot encoded label indicating benign or one of the attack types, indicates that the data sample is a real sample data, indicates that the data sample is a generated sample.

4. The network intrusion detection model training method of claim 1, wherein, the local differential privacy detection model is obtained by combining a generative adversarial network model and an external classifier, and the inputting of the input sequence into the local differential privacy detection model for intrusion classification and identification to obtain an identification result comprises: using a generative adversarial network to perform sample generation training and adversarial training on the input sequence, wherein the generative adversarial network uses a multi-head self-attention layer and a multi-layer perceptron layer with nonlinearity and layer normalization, and the discriminative network adds a binary head; identifying the result of the generative adversarial training by using an external classifier, wherein the external classifier uses a multi-class auxiliary classifier or a SoftMax layer.

5. A network intrusion detection method characterized by, The method comprises the following steps: collecting real-time network data; inputting the real-time network data into a target network intrusion monitoring model for intrusion detection to obtain an intrusion detection result, wherein the target network intrusion monitoring model is trained according to the network intrusion detection model training method according to any one of claims 1 to 4.

6. A network intrusion detection model training apparatus, characterized by comprising: The method comprises the following steps: a data collection module is configured to collect a real data set, which is continuous time series network traffic data; The data input module is configured to input the real data set into an initial network intrusion monitoring model, and the initial network intrusion monitoring model includes a feature marking model and a local differential privacy detection model. The sample encoding module is configured to encode and mark the real data set by using the feature marking model to obtain an input sequence, wherein the feature marking model is a Transformer encoder based on an attention mechanism, and is configured to segment, shuffle, linearly project, and positionally embed the real data set to generate an input sequence with a time sequence relationship. The model training module is configured to input the input sequence into the local differential privacy detection model for intrusion classification and identification to obtain an identification result, and update parameters of the initial network intrusion monitoring model based on the identification result until a preset condition is reached to obtain a target network intrusion monitoring model, wherein the local differential privacy detection model is composed of a generative adversarial network model and an external classifier, the generative adversarial network uses a multi-head self-attention layer, a multi-layer perceptron layer with GELU nonlinearity and layer normalization, the discriminative network adds a binary head for Real / Fake classification, and the external classifier uses a multi-class auxiliary classifier or a SoftMax layer. The network intrusion detection model training method further includes: assigning an InD or OOD label to a sample in the input sequence by using a discriminative network, and determining a class label by using an outlier detection method when the external classifier determines that a sensitivity analysis value of the class label is lower than a pseudo-label threshold.

7. A network intrusion detection apparatus, characterized by comprising: The network intrusion detection model training method further includes: The data acquisition module is configured to collect real-time network data. The intrusion detection module is configured to input the real-time network data into a target network intrusion monitoring model for intrusion detection to obtain an intrusion detection result, and the target network intrusion monitoring model is trained according to the network intrusion detection model training method of any one of claims 1 to 4.

8. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, The processor executes the computer program to implement the network intrusion detection model training method of any one of claims 1 to 4, or the processor executes the computer program to implement the network intrusion detection method of claim 5.

9. A computer-readable storage medium storing a computer program, the computer program comprising instructions that, when executed by a computer, cause the computer to perform the method of any one of claims 1 to 8. The processor executes the computer program to implement the network intrusion detection model training method of any one of claims 1 to 4, or the processor executes the computer program to implement the network intrusion detection method of claim 5.

Images