Network intrusion detection method and device of gating multilayer perceptron based on spatio-temporal feature fusion

Abstract

The invention discloses a network intrusion detection method and device for a gating multilayer perceptron based on spatio-temporal feature fusion, and the method comprises the steps: carrying out the preprocessing of the network flow of an Internet of Things system, capturing the time features of network behaviors through a bidirectional LSTM network through designing a new spatio-temporal feature extraction and learning method, and carrying out the detection of the network intrusion of the gating multilayer perceptron. And capturing a network behavior spatial relationship through a full connection layer network with a gating unit, and finally obtaining a space-time fusion feature association relationship through a gMLP network of a feature fusion module. And finally, based on a classification sub-network of a full connection layer, accurately classifying network attack behaviors according to the space-time fusion feature vector. The gMLP is used for mining the space-time relation between network behaviors, so that the network intrusion detection capability is improved. A simple full connection layer is adopted as a classifier, so that malicious behaviors can be effectively detected according to the spatial-temporal correlation of the acquired data.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence information security technology, and in particular to a network intrusion detection method and device of a gated multi-layer perceptron with spatiotemporal feature fusion. Background Art

[0002] IoT threats or attacks often evolve with the heterogeneity and dynamics of the network, making network intrusion detection very difficult. Most of the existing deep learning-based network intrusion detection methods are good at identifying the most common attacks, such as newcomer attacks. For highly concealed or more advanced attacks, the detection effect of existing methods is often greatly reduced. Therefore, how to effectively identify highly concealed or more advanced attacks has become another new challenge for IoT security. To this end, researchers have noticed that it is not enough to simply explore the statistical characteristics of the surface of network behavior, so they began to take into account the interactive properties of network behavior nodes. As a result, many network intrusion detection solutions based on time feature analysis or spatial feature analysis have emerged. Methods based on time feature analysis often regard the potential internal interactions between sensors and actuators in network behavior as the key to detecting intrusions. These potential interactions are regarded as time features and are often represented by time series. Therefore, methods based on time feature analysis refer to extracting useful features from data with time attributes to help subsequent classifiers effectively judge network behavior. For spatial feature analysis, researchers usually regard the spatial association of network nodes as the interaction of network behavior. Therefore, the method based on spatial feature analysis refers to capturing the corresponding spatial information features for later network intrusion detection by modeling the topological structure of network behavior. Later, some scholars proposed using the method of spatiotemporal feature analysis to more accurately detect network intrusion behavior.

[0003] Even though these methods have achieved good results in network intrusion detection, they are often unable to cope with some strong and hidden attacks. For example, methods based on time feature analysis rely too much on known time feature patterns. For unknown or new attacks, there may be no obvious time features. Therefore, relying solely on time attributes, these methods may not be able to effectively detect unknown or new attacks. Existing methods based on spatial feature analysis only consider static topological features and do not pay attention to the characteristics of dynamic evolution of the network. In addition, both time analysis and space analysis methods rely heavily on high-quality labeled data to improve detection accuracy. Methods based on spatiotemporal feature analysis focus on modeling the spatiotemporal properties of network flows, but ignore the correlation between time and space features, which is often the key to identifying strong and hidden attacks. Therefore, existing network intrusion detection methods based on spatiotemporal features are difficult to effectively identify complex network attacks and are not suitable for detecting malicious network intrusion behaviors. Summary of the invention

[0004] The present invention proposes a network intrusion detection method and device of a gated multi-layer perceptron with spatiotemporal feature fusion, aiming to solve the technical problems in the prior art that it is difficult to effectively identify complex network attacks and is not suitable for detecting malicious network intrusion behaviors.

[0005] In order to solve the above technical problems, the technical solution adopted by the present invention is as follows:

[0006] The first aspect provides a network intrusion detection method of a gated multilayer perceptron with spatiotemporal feature fusion, comprising:

[0007] S1: Preprocess the input network traffic data and convert discrete characters into numerical features through encoding;

[0008] S2: input the preprocessed and encoded network traffic data into a pre-built network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a spatial feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the spatial feature processing module is a fully connected layer with a gating unit;

[0009] S3: The pre-processed and encoded network traffic data is encoded and reduced in dimension through the sparse autoencoder of the time feature processing module, and the low-dimensional data is processed through the bidirectional long short-term memory network module to capture the complex pattern of bidirectional traffic and obtain the time feature;

[0010] S4: Feature selection is performed on the preprocessed and encoded network traffic data, and then the interaction of network traffic data is captured through the spatial mapping of the gating unit through the fully connected layer with the gating unit, the spatial topological structure information of the data is obtained, and the spatial features are obtained;

[0011] S5: The obtained temporal features and spatial features are fused, and then the fused features are linearly transformed through the embedding layer to obtain a feature embedding vector, and then the obtained feature embedding vector is input into the block in the gated multilayer perceptron, and the spatiotemporal feature representation is obtained through the spatial depth convolution of the gated unit in the block;

[0012] S6: Input the obtained spatiotemporal feature representation into the classifier network to obtain the classification result as the network intrusion detection result.

[0013] In one embodiment, S1 includes:

[0014] S1.1: Collect network traffic data packets of the Internet of Things to form a feature vector set;

[0015] S1.2: Divide the data into normal sample sets and malicious sample sets according to the labels;

[0016] S1.3: Clean the divided sample set, remove discrete features to retain the attack attributes of each attack sample, and then convert the core discrete features into numerical features through one-hot encoding data.

[0017] In one embodiment, S3 includes:

[0018] S3.1: The preprocessed and encoded network traffic data X i Input into the sparse autoencoder and compressed into a low-dimensional vector representation X by the following formula h :

[0019] X h =E θ (X i )=σ(W ij X i +b ij )

[0020] Where E θ represents the compression function, σ is the activation function, b ij is the bias vector, W ij is the weight matrix;

[0021] S3.2: X i Through the time series generator, we can get the time series Then input it into the BiLSTM network for processing:

[0022] i t =H(W ix x t +W ih h t+1 +b i )

[0023] Among them, i t Get the vector representation of the t-th time step for a single-layer LSTM, W ix is the weight matrix, W ih is the weight matrix of the hidden layer, h t+1 is the hidden state at time step t, b i is the bias vector, H is the hidden layer function; the time feature representation is a bidirectional sequence, using and Represent the forward and backward sequences respectively. The time information of the forward and backward sequences is calculated as follows:

[0024]

[0025]

[0026]

[0027] in, and Represents the forward and backward hidden layers, y x is the temporal feature representation after aggregating context features, and They are the forward hidden layer weight matrix, the previous hidden state weight matrix, the backward hidden layer weight matrix and the previous hidden state weight matrix. and b y are the bias vectors of the forward hidden layer, backward hidden layer, and output layer, respectively.

[0028] In one embodiment, S4 includes:

[0029] S4.1: The preprocessed and encoded network traffic data is input into the spatial feature analysis module through feature selection. After feature selection, some important feature attributes are retained, including packet delivery rate, packet drop rate, protocol, end-to-end delay, energy consumption, mobility and node capacity distribution:

[0030] S4.2: The selected feature vector is then input into a fully connected layer network with a gated unit, which divides the input sample into two independent parts x1 and x2 according to the channel dimension. Then x1 is used for linear mapping to obtain f W,b (x), x2 through spatial mapping and f W,b (x) Element-wise multiplication to learn the spatial features s of the input samples x :

[0031] f w1,b1 (x) = w1x1 + b1

[0032] s x =x2*f w1,b1 (x)

[0033] f w1,b1 (x) is the feature obtained by linear mapping, w1 is the weight of the linear mapping layer, and b1 is the weight of the linear mapping layer.

[0034] In one embodiment, S5 includes:

[0035] S5.1: directly connect the obtained temporal features and spatial features through concat to obtain fused features;

[0036] S4.2: The fused features are linearly transformed to obtain feature embedding vectors, and the embedded feature vectors H f Through the spatial mapping of the spatial gating unit, the spatiotemporal features are obtained by performing dot product. Before the embedded feature vector is spatially mapped, H is transformed by the forward functionf Divide them into tensor matrices U and V of the same size, and then transpose the tensor V by exchanging the channel dimension and the sequence length dimension to obtain V T ;

[0037] V′=w2V T

[0038] H F =s(F)=U⊙V′

[0039] Where V′ is V T The matrix vector after linear transformation, w2 is the weight matrix of spatial mapping, ⊙ is the element-by-element product operation, s(·) is the spatial depth convolution function, H F It is the spatiotemporal feature representation.

[0040] In one implementation, the classifier network in S6 is obtained by training a simple network composed of a multi-layer perceptron, and a corresponding loss function is selected according to the network intrusion detection task.

[0041] Based on the same inventive concept, the second aspect of the present invention provides a network intrusion detection device of a gated multilayer perceptron with spatiotemporal feature fusion, comprising:

[0042] The data preprocessing module is used to preprocess the input network traffic data and convert discrete characters into numerical features through encoding;

[0043] An input module, used for inputting the preprocessed and encoded network traffic data into a pre-built network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a space feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the space feature processing module is a fully connected layer with a gating unit;

[0044] The time feature extraction module is used to encode and reduce the dimension of the pre-processed and encoded network traffic data through the sparse autoencoder of the time feature processing module, and to process the low-dimensional data through the bidirectional long short-term memory network module to capture the complex pattern of the bidirectional traffic and obtain the time feature;

[0045] The spatial feature extraction module is used to perform feature selection on the preprocessed and encoded network traffic data, and then capture the interaction of network traffic data through the spatial mapping of the gating unit through the fully connected layer with the gating unit, obtain the spatial topological structure information of the data, and obtain the spatial features;

[0046] The spatiotemporal fusion module is used to fuse the obtained temporal features and spatial features, and then linearly transform the fused features through the embedding layer to obtain the feature embedding vector, and then input the obtained feature embedding vector into the block in the gated multilayer perceptron, and obtain the spatiotemporal feature representation through the spatial depth convolution of the gated unit in the block;

[0047] The classification module is used to input the obtained spatiotemporal feature representation into the classifier network to obtain the classification result as the network intrusion detection result.

[0048] Based on the same inventive concept, the third aspect of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion described in the first aspect.

[0049] Based on the same inventive concept, the fourth aspect of the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion described in the first aspect is implemented.

[0050] Compared with the prior art, the advantages and beneficial technical effects of the present invention are as follows:

[0051] The invention proposes a network intrusion detection method of a gated multilayer perceptron with spatiotemporal feature fusion. The method obtains processed network flow data through preprocessing and encoding processing, and obtains training data to train a network intrusion detection model. The spatial feature processing module extracts spatial features of network data on a constructed gated unit full-connection layer network. The temporal feature processing module extracts temporal features from forward and backward information on time series data using a bidirectional long short-term memory network (Bidirectional-LSTM). The fusion module fuses complete spatial features and temporal features by superimposing the number of feature channels, and spatially maps the spatiotemporal fusion features through a gated multilayer perceptron (gMLP) to obtain a spatiotemporal feature correlation relationship, and obtains a final spatiotemporal feature representation, so as to improve the ability of network intrusion detection. Finally, the detection result is obtained through a classifier network, and malicious behavior is judged according to the spatiotemporal correlation of the acquired data, thereby improving the effectiveness and accuracy of detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0053] Figure 1 A flow chart of a network intrusion detection method of a gated multilayer perceptron with spatiotemporal feature fusion according to an embodiment of the present invention;

[0054] Figure 2 This is an example diagram of a network intrusion detection method of a gated multi-layer perceptron with spatiotemporal feature fusion according to an embodiment of the present invention;

[0055] Figure 3 The framework diagram of the network intrusion detection model of the gated multi-layer perceptron with spatiotemporal feature fusion according to an embodiment of the present invention. DETAILED DESCRIPTION

[0056] The present invention proposes a network intrusion detection method based on a gated multilayer perceptron with spatiotemporal feature fusion, preprocesses the network traffic of the Internet of Things system, captures the temporal characteristics of network behavior with a bidirectional LSTM network by designing a new spatiotemporal feature analysis method, and captures the spatial relationship of network behavior through a fully connected layer network with a gating unit, and finally obtains the spatiotemporal fusion feature association through a gMLP network of a feature fusion module. Finally, based on the classification subnetwork of the fully connected layer, the network attack behavior is accurately classified according to the spatiotemporal fusion feature vector.

[0057] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0058] Embodiment 1

[0059] The present invention discloses a network intrusion detection method of a gated multilayer perceptron with spatiotemporal feature fusion, see Figure 1 ,include:

[0060] S1: Preprocess the input network traffic data and convert discrete characters into numerical features through encoding;

[0061] S2: Construct a network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a spatial feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the spatial feature processing module is a fully connected layer with a gating unit;

[0062] S3: The pre-processed and encoded network traffic data is encoded and reduced in dimension through the sparse autoencoder of the time feature processing module, and the low-dimensional data is processed through the bidirectional long short-term memory network module to capture the complex pattern of bidirectional traffic and obtain the time feature;

[0063] S4: Feature selection is performed on the preprocessed and encoded network traffic data, and then the interaction of network traffic data is captured through the spatial mapping of the gating unit through the fully connected layer with the gating unit, the spatial topological structure information of the data is obtained, and the spatial features are obtained;

[0064] S5: The obtained temporal features and spatial features are fused, and then the fused features are linearly transformed through the embedding layer to obtain a feature embedding vector, and then the obtained feature embedding vector is input into the block in the gated multilayer perceptron, and the spatiotemporal feature representation is obtained through the spatial depth convolution of the gated unit in the block;

[0065] S6: Input the obtained spatiotemporal feature representation into the classifier network to obtain the classification result as the network intrusion detection result.

[0066] Specifically, S1 is data preprocessing and encoding, S2 is model construction, S3 is extracting temporal features from input data through the temporal feature processing module, S4 is feature selection and extracting spatial features from input data, S5 is feature fusion, and obtaining spatiotemporal feature representation through gMLP, and S6 is classification based on the spatiotemporal feature representation obtained in S5, thereby realizing intrusion detection.

[0067] In one embodiment, S1 includes:

[0068] S1.1: Collect network traffic data packets of the Internet of Things to form a feature vector set;

[0069] S1.2: Divide the data into normal sample sets and malicious sample sets according to the labels;

[0070] S1.3: Clean the divided sample set, remove discrete features to retain the attack attributes of each attack sample, and then convert the core discrete features into numerical features through one-hot encoding data.

[0071] In one embodiment, S3 includes:

[0072] S3.1: The preprocessed and encoded network traffic data X i Input into the sparse autoencoder and compressed into a low-dimensional vector representation X by the following formula h :

[0073] X h =E θ (X i )=σ(W ij X i +b ij )

[0074] Where E θ represents the compression function, σ is the activation function, b ij is the bias vector, W ij is the weight matrix;

[0075] S3.2: X i Through the time series generator, we can get the time series Then input it into the BiLSTM network for processing:

[0076] i t =H(W ix x t +W ih h t+1 +b i )

[0077] Among them, i t Get the vector representation of the t-th time step for a single-layer LSTM, W ix is the weight matrix, W ih is the weight matrix of the hidden layer, h t+1 is the hidden state at time step t, b i is the bias vector, H is the hidden layer function; the time feature representation is a bidirectional sequence, using and Represent the forward and backward sequences respectively. The time information of the forward and backward sequences is calculated as follows:

[0078]

[0079]

[0080]

[0081] in, and Represents the forward and backward hidden layers, y x is the temporal feature representation after aggregating context features, and They are the forward hidden layer weight matrix, the previous hidden state weight matrix, the backward hidden layer weight matrix and the previous hidden state weight matrix. and b y are the bias vectors of the forward hidden layer, backward hidden layer, and output layer, respectively.

[0082] Specifically, since the BiLSTM network is a bidirectional LSTM layer, the obtained temporal feature representation is also a bidirectional sequence.

[0083] In one embodiment, S4 includes:

[0084] S4.1: The preprocessed and encoded network traffic data is input into the spatial feature analysis module through feature selection. After feature selection, some important feature attributes are retained, including packet delivery rate, packet drop rate, protocol, end-to-end delay, energy consumption, mobility and node capacity distribution:

[0085] S4.2: The selected feature vector is then input into a fully connected layer network with a gated unit, which divides the input sample into two independent parts x1 and x2 according to the channel dimension. Then x1 is used for linear mapping to obtain f W,b (x), x2 through spatial mapping and f W,b (x) Element-wise multiplication to learn the spatial features s of the input samples x :

[0086] f w1,b1 (x) = w1x1 + b1

[0087] s x =x2*f w1,b1 (x)

[0088] f w1,b1 (x) is the feature obtained by linear mapping, w1 is the weight of the linear mapping layer, and b1 is the weight of the linear mapping layer.

[0089] In one embodiment, S5 includes:

[0090] S5.1: directly connect the obtained temporal features and spatial features through concat to obtain fused features;

[0091] S4.2: The fused features are linearly transformed to obtain feature embedding vectors, and the embedded feature vectors H f Through the spatial mapping of the spatial gating unit, the spatiotemporal features are obtained by performing dot product. Before the embedded feature vector is spatially mapped, H is transformed by the forward function f Divide them into tensor matrices U and V of the same size, and then transpose the tensor V by exchanging the channel dimension and the sequence length dimension to obtain V T;

[0092] V′=w2V T

[0093] H F =s(F)=U⊙V′

[0094] Where V′ is V T The matrix vector after linear transformation, w2 is the weight matrix of spatial mapping, ⊙ is the element-by-element product operation, s(·) is the spatial depth convolution function, H F It is the spatiotemporal feature representation.

[0095] Specifically, the concat connection method is: f =concat(y x ,s x ).

[0096] In one implementation, the classifier network in S6 is obtained by training a simple network composed of a multi-layer perceptron, and a corresponding loss function is selected according to the network intrusion detection task.

[0097] Specifically, a simple network composed of multi-layer perceptrons is trained as a classifier to identify network behaviors. The spatiotemporal feature representation generated in the previous step is used as input, and after training the fully connected layer, the attack type is automatically identified.

[0098] For multi-classification problems, the KL divergence loss function is selected to measure the output distribution With the true distribution x i The difference between.

[0099]

[0100] Where N is the total number of training samples.

[0101] For binary classification problems, choose the cross entropy loss function as the metric.

[0102]

[0103] Among them, p(y i ) is the predicted result, y i is the true label.

[0104] The object of the present invention is to propose a network intrusion detection method based on a gated multilayer perceptron with spatiotemporal feature fusion from the perspective of strong covert attack intrusion detection security of the Internet of Things. The method extracts the spatial features of network data on the constructed gated unit fully connected layer network, and extracts and time features from the forward and backward information on the time series data with a bidirectional long short-term memory network (Bidirectional-LSTM), and then experiments on the basis of integrating the complete spatial features and time features by superimposing the number of feature channels, and then spatially maps the spatiotemporal fusion features by a gated multilayer perceptron (gatingMultilayer Perceptron, gMLP) to obtain the spatiotemporal feature correlation, analyze and then improve the ability of network intrusion detection. From the perspective of traffic events, heterogeneity and evolution are crucial for behavior analysis, therefore, the learning of spatial correlation and time dependence is particularly critical for network intrusion detection. The spatiotemporal relationship of network behavior is mined by gMLP to improve the ability of network intrusion detection. Finally, a simple fully connected layer is used as a classifier to discriminate malicious behavior according to the spatiotemporal correlation of the acquired data.

[0105] Compared with the existing methods, the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion proposed in the present invention has the following main differences:

[0106] 1. The extracted features are different

[0107] The existing method (CN118400137A_Network behavior trust evaluation method and system based on spatiotemporal feature analysis) obtains a temporal trust score and a spatial trust score from a preprocessed network sample. The present invention obtains temporal features and spatial features (embedded vectors) respectively through a temporal feature processing module and a spatial feature processing module, specifically including encoding and reducing the dimension of the preprocessed and encoded network traffic data through a sparse autoencoder of the temporal feature processing module, processing the low-dimensional data through a bidirectional long short-term memory network module to capture the complex pattern of bidirectional traffic, and obtaining the temporal feature; performing feature selection on the preprocessed and encoded network traffic data, and then capturing the interaction of the network traffic data through a fully connected layer with a gating unit and the spatial mapping of the gating unit through the gating unit, obtaining the spatial topological structure information of the data, and obtaining the spatial feature.

[0108] 2. Unlike the multi-scale gated TCN in the patent application "Industrial Internet Time Series Data Anomaly Detection Method and Device Utilization" that extracts multi-scale time series features, the fully connected layer network of the gated unit in this application extracts the spatial features of the data. Unlike the BiLSTM in this patent application that obtains time dependency based on the correlation between different sequences obtained by GAT, the BiLSTM of the present invention directly extracts time features from the time series data generated by the time series generator, has higher computational efficiency, and retains the complete time information of all data. Unlike the cross-fusion of time series features and bidirectional spatiotemporal features in this application, the present invention splices and fuses time features and spatial features, which can retain the integrity of the data's spatiotemporal information to the greatest extent, and is beneficial to the classification and identification of traffic data by subsequent modules.

[0109] 3. Feature fusion method and network architecture

[0110] The present invention constructs a network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a space feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the space feature processing module is a fully connected layer with a gating unit. Regarding time feature extraction, by optimizing the model structure and parameters, the noise in the data is removed, and the stability and accuracy of the sparse autoencoder in the feature extraction process are improved. In addition, new optimization algorithms and data preprocessing technologies are introduced to improve the performance of the BiLSTM model in processing complex dynamic time features. Regarding feature fusion, the time feature and the space feature are fused and input into the gMLP together, and the space-time feature representation is obtained by the spatial depth convolution of the gating unit in the block. The gMLP does not simply extract spatial attributes, but uses a spatial mapping operation to capture the correlation between the time-space attributes, and realizes the extraction of the complex correlation between the time-space features. The existing methods gMLP and BiLSTM perform their respective functions and work independently. The present invention fuses the temporal features and spatial features and inputs them into gMLP together. gMLP plays a role in overall control. Therefore, the model structures of the two are also very different. The model of the present invention can make the temporal features and spatial features interact well, solving the problem of difficulty in interactively capturing the dynamic spatial and temporal attribute features of data.

[0111] The main key points of the present invention include:

[0112] Time feature analysis module, space feature analysis module and feature fusion module. The time feature extraction module of the BiLSTM model combined with the sparse autoencoder obtains more accurate time relationship features between traffic data, and realizes the effective extraction of complex dynamic time features. Compared with the extraction of spatial features by the gated multi-layer perceptron, the spatial feature analysis module based on the simple gated unit fully connected layer in the present invention realizes the extraction of spatial interaction features, which greatly improves the efficiency of spatial attribute extraction. The feature fusion module makes good use of the spatiotemporal correlation properties of traffic data to identify the attack types of traffic data. The gMLP of this module does not simply extract spatial attributes, but uses spatial mapping operations to capture the correlation between spatiotemporal attributes, and realizes the extraction of complex correlations between spatiotemporal features.

[0113] Technical difficulties:

[0114] Compared with the existing network behavior trustworthy assessment method based on spatiotemporal feature analysis, this solution solves the problem of identifying the types of network traffic attacks, which requires more refined data intrinsic attribute extraction to distinguish the types of attacks. The model framework of this solution is also different from the above-mentioned patent. The gMLP and BiLSTM of the existing method perform their respective functions and work independently. The gMLP of the present invention plays a role in overall control and solves the problem of difficulty in interactively capturing the dynamic spatial and temporal attribute features of traffic data.

[0115] The technical solution of the present invention is further specifically described below through embodiments and in conjunction with the accompanying drawings.

[0116] The method of the present invention is to solve the problem that the existing network intrusion detection method based on spatiotemporal feature analysis is not suitable for detecting a small number of attack behaviors such as strong covert attacks.

[0117] The collected network traffic data is preprocessed and encoded, and then imported as input data into the model of the gated multilayer perceptron based on spatiotemporal fusion feature analysis. First, it is input into the temporal feature analysis module to obtain the temporal feature vector through the BiLSTM network, and then it is input into the spatial feature analysis module to obtain the spatial feature vector through the fully connected layer network with gating units. Finally, the obtained temporal feature vector and spatial feature vector are fused through the feature channel number superposition operation concat to obtain a new spatiotemporal feature embedding vector, which is input into the feature fusion module to obtain the spatiotemporal fusion feature vector through the gMLP network, and finally the attack type of the network behavior is identified based on the spatiotemporal fusion feature vector.

[0118] Figure 2 It is a flow chart of the network intrusion detection method of the gated multilayer perceptron based on spatiotemporal fusion feature analysis in the present invention, and its detailed description process is as follows:

[0119] Step 1: The flow data in the IoT system is used as input, and the input is preprocessed to obtain a continuous vector suitable for model processing. These vectors are simultaneously input into two modules, where the time feature vector is obtained through the time feature analysis module, and the space feature vector is obtained through the space feature analysis module;

[0120] Step 2: According to the designed feature fusion module, the temporal feature vector and the spatial feature vector are fused to obtain the spatiotemporal feature embedding vector of the network behavior. The spatiotemporal feature embedding vector is then input into the gMLP network to obtain the spatiotemporal fusion feature vector.

[0121] Step 3: Classify the network attack behavior by inputting the spatiotemporal fusion feature vector into the classifier sub-network based on the fully connected layer.

[0122] From the above description, it can be seen that the network intrusion detection method of the present invention based on the gated multilayer perceptron of spatiotemporal fusion preprocesses the network traffic of the Internet of Things system, and captures the temporal characteristics of network behavior by using a bidirectional LSTM network through the design of a new spatiotemporal feature analysis method, and captures the spatial relationship of network behavior through a fully connected layer network with a gating unit, and finally obtains the spatiotemporal fusion feature association through the gMLP network of the feature fusion module. Finally, based on the classification subnetwork of the fully connected layer, the network attack behavior is accurately classified according to the spatiotemporal fusion feature vector.

[0123] Embodiment 2

[0124] Based on the same inventive concept, this embodiment discloses a network intrusion detection device of a gated multilayer perceptron with spatiotemporal feature fusion, see Figure 3 ,include:

[0125] The data preprocessing module 301 is used to preprocess the input network traffic data and convert discrete characters into numerical features through encoding;

[0126] An input module 302 is used to input the preprocessed and encoded network traffic data into a pre-built network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a spatial feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the spatial feature processing module is a fully connected layer with a gating unit;

[0127] The time feature extraction module 303 is used to encode and reduce the dimension of the pre-processed and encoded network traffic data through the sparse autoencoder of the time feature processing module, and process the low-dimensional data through the bidirectional long short-term memory network module to capture the complex pattern of the bidirectional traffic to obtain the time feature;

[0128] The spatial feature extraction module 304 is used to perform feature selection on the preprocessed and encoded network traffic data, and then capture the interaction of the network traffic data through the spatial mapping of the gating unit through the fully connected layer with the gating unit, obtain the spatial topological structure information of the data, and obtain the spatial features;

[0129] The spatiotemporal fusion module 305 is used to fuse the obtained temporal features and spatial features, and then linearly transform the fused features through the embedding layer to obtain a feature embedding vector, and then input the obtained feature embedding vector into the block in the gated multilayer perceptron, and obtain the spatiotemporal feature representation through the spatial depth convolution of the gated unit in the block;

[0130] The classification module 306 is used to input the obtained spatiotemporal feature representation into the classifier network to obtain a classification result as a network intrusion detection result.

[0131] Since the device introduced in the second embodiment of the present invention is a device used to implement the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the device, so it is not repeated here. All devices used in the method in the first embodiment of the present invention belong to the scope of protection of the present invention.

[0132] Embodiment 3

[0133] Based on the same inventive concept, the present invention further provides a computer-readable storage medium on which a computer program is stored. When the program is executed by a processor, the method described in the first embodiment is implemented.

[0134] Since the computer-readable storage medium introduced in the third embodiment of the present invention is a computer-readable storage medium used to implement the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, those skilled in the art can understand the specific structure and deformation of the computer-readable storage medium, so it is not repeated here. All computer-readable storage media used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0135] Embodiment 4

[0136] The present invention also provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in Embodiment 1 when executing the program.

[0137] Since the computer device introduced in the fourth embodiment of the present invention is a computer device used to implement the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion in the first embodiment of the present invention, based on the method introduced in the first embodiment of the present invention, the person skilled in the art can understand the specific structure and deformation of the computer device, so it is not repeated here. All computer devices used in the method of the first embodiment of the present invention belong to the scope of protection of the present invention.

[0138] Those skilled in the art will appreciate that embodiments of the present invention may be provided as methods, systems, or computer program products. Therefore, the present invention may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present invention may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0139] The present invention is described with reference to flowcharts and / or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0140] Although preferred embodiments of the present invention have been described, additional changes and modifications may be made to these embodiments by those skilled in the art once the basic creative concepts are known. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications that fall within the scope of the present invention. Obviously, those skilled in the art may make various changes and modifications to the embodiments of the present invention without departing from the spirit and scope of the embodiments of the present invention. Thus, if these modifications and variations of the embodiments of the present invention fall within the scope of the claims of the present invention and their equivalents, the present invention is also intended to include these modifications and variations.

Claims

1. A network intrusion detection method based on a gated multilayer perceptron with spatiotemporal feature fusion, characterized in that: include: S1: Preprocess the input network traffic data and convert discrete characters into numerical features through encoding; S2: input the preprocessed and encoded network traffic data into a pre-built network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a spatial feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the spatial feature processing module is a fully connected layer with a gating unit; S3: The pre-processed and encoded network traffic data is encoded and reduced in dimension through the sparse autoencoder of the time feature processing module, and the low-dimensional data is processed through the bidirectional long short-term memory network module to capture the complex pattern of bidirectional traffic and obtain the time feature; S4: Feature selection is performed on the preprocessed and encoded network traffic data, and then the interaction of network traffic data is captured through the spatial mapping of the gating unit through the fully connected layer with the gating unit, the spatial topological structure information of the data is obtained, and the spatial features are obtained; S5: The obtained temporal features and spatial features are fused, and then the fused features are linearly transformed through the embedding layer to obtain a feature embedding vector, and then the obtained feature embedding vector is input into the block in the gated multilayer perceptron, and the spatiotemporal feature representation is obtained through the spatial depth convolution of the gated unit in the block; S6: Input the obtained spatiotemporal feature representation into the classifier network to obtain the classification result as the network intrusion detection result.

2. The network intrusion detection method of the gated multi-layer perceptron with spatiotemporal feature fusion as claimed in claim 1, characterized in that: S1 includes: S1.1: Collect network traffic data packets of the Internet of Things to form a feature vector set; S1.2: Divide the data into normal sample sets and malicious sample sets according to the labels; S1.3: Clean the divided sample set, remove discrete features to retain the attack attributes of each attack sample, and then convert the core discrete features into numerical features through one-hot encoding data.

3. The network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion as claimed in claim 1, characterized in that S3 include: S3.1: The preprocessed and encoded network traffic data X i Input into the sparse autoencoder and compressed into a low-dimensional vector representation X by the following formula h : X h =E θ (X i )=σ(W ij X i +b ij ) Where E θ represents the compression function, v is the activation function, b ij is the bias vector, W ij is the weight matrix; S3.2: X i Through the time series generator, we can get the time series Then input it into the BiLSTM network for processing: i t =H(W ix x t +W ih h t+1 +b i ) Among them, i t Get the vector representation of the t-th time step for a single-layer LSTM, W ix is the weight matrix, W ih is the weight matrix of the hidden layer, h t+1 is the hidden state at time step t, b i is the bias vector, H is the hidden layer function; the time feature representation is a bidirectional sequence, using and Represent the forward and backward sequences respectively. The time information of the forward and backward sequences is calculated as follows: in, and Represents the forward and backward hidden layers, y x is the temporal feature representation after aggregating context features, and They are the forward hidden layer weight matrix, the previous hidden state weight matrix, the backward hidden layer weight matrix and the previous hidden state weight matrix. and b y are the bias vectors of the forward hidden layer, backward hidden layer, and output layer, respectively.

4. The network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion as claimed in claim 1, characterized in that S4 include: S4.1: The preprocessed and encoded network traffic data is input into the spatial feature analysis module through feature selection. After feature selection, some important feature attributes are retained, including packet delivery rate, packet drop rate, protocol, end-to-end delay, energy consumption, mobility and node capacity distribution: S4.2: The selected feature vector is then input into a fully connected layer network with a gated unit, which divides the input sample into two independent parts x1 and x2 according to the channel dimension. Then x1 is used for linear mapping to obtain f W,b (x), x2 through spatial mapping and f W,b (x) Element-wise multiplication to learn the spatial features s of the input samples x : is the feature obtained by linear mapping, w1 is the weight of the linear mapping layer, and b1 is the weight of the linear mapping layer.

5. The network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion according to claim 1, characterized in that S5 include: S5.1: directly connect the obtained temporal features and spatial features through concat to obtain fused features; S4.2: The fused features are linearly transformed to obtain feature embedding vectors, and the embedded feature vectors H f Through the spatial mapping of the spatial gating unit, the spatiotemporal features are obtained by performing dot product. Before the embedded feature vector is spatially mapped, H is transformed by the forward function f Divide them into tensor matrices U and V of the same size, and then transpose the tensor V by exchanging the channel dimension and the sequence length dimension to obtain V T ; V′=w2V T H F =s(F)=U⊙V′ Where V′ is V T The matrix vector after linear transformation, w2 is the weight matrix of spatial mapping, ⊙ is the element-by-element product operation, s(·) is the spatial depth convolution function, H F It is the spatiotemporal feature representation.

6. The network intrusion detection method of the gated multi-layer perceptron with spatiotemporal feature fusion as claimed in claim 1, characterized in that: The classifier network in S6 is obtained by training a simple network composed of multi-layer perceptrons, and the corresponding loss function is selected according to the network intrusion detection task.

7. A network intrusion detection device based on a gated multi-layer perceptron with spatiotemporal feature fusion, characterized in that: include: The data preprocessing module is used to preprocess the input network traffic data and convert discrete characters into numerical features through encoding; An input module, used for inputting the preprocessed and encoded network traffic data into a pre-built network intrusion detection model, wherein the network intrusion detection model includes a time feature processing module, a space feature processing module, a feature fusion module and a classifier network, the time feature processing module includes a sparse autoencoder and a bidirectional long short-term memory network module, and the space feature processing module is a fully connected layer with a gating unit; The time feature extraction module is used to encode and reduce the dimension of the pre-processed and encoded network traffic data through the sparse autoencoder of the time feature processing module, and to process the low-dimensional data through the bidirectional long short-term memory network module to capture the complex pattern of the bidirectional traffic and obtain the time feature; The spatial feature extraction module is used to perform feature selection on the preprocessed and encoded network traffic data, and then capture the interaction of network traffic data through the spatial mapping of the gating unit through the fully connected layer with the gating unit, obtain the spatial topological structure information of the data, and obtain the spatial features; The spatiotemporal fusion module is used to fuse the obtained temporal features and spatial features, and then linearly transform the fused features through the embedding layer to obtain the feature embedding vector, and then input the obtained feature embedding vector into the block in the gated multilayer perceptron, and obtain the spatiotemporal feature representation through the spatial depth convolution of the gated unit in the block; The classification module is used to input the obtained spatiotemporal feature representation into the classifier network to obtain the classification result as the network intrusion detection result.

8. The network intrusion detection device of the gated multi-layer perceptron with spatiotemporal feature fusion according to claim 7, characterized in that: The data preprocessing module is specifically used to perform the following steps: S1.1: Collect network traffic data packets of the Internet of Things to form a feature vector set; S1.2: Divide the data into normal sample sets and malicious sample sets according to the labels; S1.3: Clean the divided sample set, remove discrete features to retain the attack attributes of each attack sample, and then convert the core discrete features into numerical features through one-hot encoding data.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion as claimed in any one of claims 1 to 6 is implemented.

10. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the network intrusion detection method of the gated multilayer perceptron with spatiotemporal feature fusion as described in any one of claims 1 to 6 is implemented.

Images