An integrated single-classification abnormal traffic detection method and system based on wide network

Abstract

The present invention relates to the field of intrusion traffic detection, and discloses an integrated single-classification abnormal traffic detection method and system based on a width network, the method comprising the following steps: a sampling step, extracting a certain proportion of normal data according to a sampling probability; a training step, using the normal data to train a width autoencoder network as a weak classifier; an updating step, calculating the confidence of the current weak classifier according to the sample reconstruction error, and updating the sampling probability of the sample; an integration step, repeating the sampling step to the updating step until a number of weak classifiers are obtained, and an abnormal traffic detection model is obtained by integration; a detection step, using the abnormal traffic detection model to perform abnormal detection on unknown samples, obtaining abnormal detection results of multiple weak classifiers, and weighting the abnormal detection results according to the confidence of the weak classification to obtain the final detection result. The present invention applies the width learning autoencoder network to the single classification problem, solving the problems of slow training of deep networks and large memory consumption.

Description

Technical Field

[0001] The present invention relates to the field of traffic intrusion detection, and in particular to an integrated single-classification abnormal traffic detection method and system based on a wide network. Background Art

[0002] Today's enterprises face many challenges, especially in monitoring their network infrastructure. They need to ensure that they have a comprehensive understanding of the health and security of the network as the network grows in size and complexity. In order to eliminate any pressure on network performance, an important action that organizations should take is to monitor traffic using tools that scale with the organization. When there are blind spots in monitoring and traffic anomalies are unknown, the company's network will be on the verge of losing important data and compromising its security. Therefore, the traffic anomaly detection algorithm is the first line of defense for enterprises when facing abnormal attacks, and it plays a vital role.

[0003] Most of the existing traffic anomaly detection algorithms use deep learning algorithms for classification and prediction. There are two main disadvantages of this type of algorithm: (1) The model training speed is slow. Most deep learning algorithms use the gradient descent method to train and optimize the entire network structure, which leads to slow model training and excessive memory consumption; (2) Data imbalance leads to poor model performance. In the field of traffic anomaly detection, there is often little data on abnormal traffic behavior, and most of the data is traffic data under normal conditions. In this case, the model is trained based on the principle of binary classification. Due to the small number of abnormal samples, the trained model tends to judge unknown samples as positive classes. Summary of the invention

[0004] The purpose of the present invention is to solve the problems in the prior art.

[0005] The technical solution adopted by the present invention to solve the technical problem is: to provide an integrated single-classification abnormal traffic detection method based on a wide network, comprising the following steps:

[0006] Sampling step, extracting a certain proportion of normal data according to the sampling probability;

[0007] A training step, using the normal data to train a wide autoencoder network as a weak classifier;

[0008] Update step, calculate the confidence of the current weak classifier according to the reconstruction error of the sample, and update the sampling probability of the sample;

[0009] Integration step: repeat the sampling step to the updating step until several weak classifiers and their corresponding confidences are obtained, and the abnormal traffic detection model is obtained by integration;

[0010] In the detection step, anomaly detection is performed on unknown samples using an abnormal traffic detection model to obtain anomaly detection results of multiple weak classifiers. The anomaly detection results are weighted according to the confidence of the weak classification to obtain the final detection result.

[0011] Preferably, in the sampling step, for data containing only normal samples , according to the sampling probability A certain proportion of data is selected and input into the width autoencoder network, where: represents the i-th sample and k represents the k-th iteration.

[0012] Preferably, the training step comprises the following steps:

[0013] Randomly initialize the width to learn the weight matrices and bias vectors of the feature layer and enhancement layer of the autoencoder;

[0014] Calculate the output of each group of nodes in the feature layer, expressed as:

[0015] ;

[0016] Among them, p represents the number of groups of feature layers, is the feature layer mapping function; represents the randomly generated weight matrix in the mth group in the feature layer, Represents the mth group of randomly generated bias vectors in the feature layer;

[0017] The output of each group of nodes is combined to obtain the output of the feature layer, which is expressed as:

[0018] ;

[0019] The output of the feature layer is input into the enhancement layer to obtain the output of each group of nodes in the enhancement layer, which is expressed as:

[0020] ;

[0021] Where q represents the number of enhancement layers. is the enhancement layer mapping function; represents the randomly generated weight matrix in the mth group in the enhancement layer, represents the mth group of randomly generated bias vectors in the enhancement layer;

[0022] Combine the output of each group of nodes in the enhancement layer to get the output of the feature layer , expressed as:

[0023] ;

[0024] The output of the enhancement layer and the feature layer are concatenated to obtain the output of the hidden layer. , expressed as:

[0025] ;

[0026] Among them, l represents the dimension of the hidden layer;

[0027] The network structure is trained according to the loss function of the width learning autoencoder. The loss function is expressed as:

[0028] ;

[0029] in, represents the two-norm; Represents the output weights that need to be learned in the network structure, represents the trade-off coefficient, Indicates the parameters Optimization;

[0030] According to the ridge regression theory, the output weight is quickly solved and expressed as:

[0031] when hour, ;

[0032] when hour, ;

[0033] in, represents the unit matrix, and n represents the number of samples.

[0034] Preferably, the step of calculating the confidence of the current weak classifier according to the reconstruction error of the sample comprises the following steps:

[0035] Calculate the reconstruction error of the sample, expressed as:

[0036] ;

[0037] ;

[0038] in, Represents the original data of the i-th sample The reconstruction error, Represents the data after reconstruction of the i-th sample, Represents the hidden layer output of the i-th sample after the width autoencoder network; represents the square of the two-norm;

[0039] A single-class boosting strategy is designed to minimize the sum of reconstruction errors as the overall objective function, which is expressed as:

[0040] ;

[0041] ;

[0042] in, represents the overall objective function; is the total reconstruction error loss of the k-th width autoencoder network on all samples, and K represents the total number of weak classifiers; is the weight of the k-th width autoencoder network; represents the entropy-based regularization term, used to avoid invalid solutions; represents the weight parameter; St represents the constraint condition;

[0043] The confidence of the weak classifier is calculated according to the Lagrange multiplier method, which is expressed as:

[0044] ;

[0045] in, represents the confidence of the kth weak classifier, and ∈[0,1].

[0046] Preferably, the updating of the sampling probability of the sample comprises the following steps:

[0047] According to Jensen inequality, the overall objective function is transformed into an upper bound in exponential form, expressed as:

[0048] ;

[0049] Update the current sampling probability as the sampling probability of the next weak classifier, expressed as:

[0050] ;

[0051] in, represents the sampling probability of the k-1th weak classifier, Represents the sampling probability of the kth weak classifier;

[0052] The updated sampling probability is normalized and expressed as:

[0053] .

[0054] Preferably, the initial value of the sample sampling probability is Set to , n represents the number of samples.

[0055] Preferably, the detection step comprises the following steps:

[0056] Reconstruction error Sort from large to small to get the final reconstruction error set ;

[0057] According to the reconstruction error set Setting the judgment threshold , expressed as:

[0058] ;

[0059] in, is a preset ratio, and ;

[0060] The abnormal traffic detection model detects unknown samples based on the threshold Perform detection and judgment, and the judgment formula is expressed as:

[0061] ;

[0062] in, represents the label of the unknown sample, Represents the reconstruction error of the unknown sample after weak classification reconstruction. 1 represents a normal sample, and 0 represents an abnormal sample.

[0063] For abnormal samples, the abnormal traffic detection model obtains several detection results , weighted voting method is used on the test results, and then the final result is obtained.

[0064] The present invention also provides an integrated single-classification abnormal traffic detection system based on a wide network, comprising:

[0065] The sampling module extracts a certain proportion of normal data according to the sampling probability;

[0066] A training module, using the normal data to train a wide autoencoder network as a weak classifier;

[0067] The update module updates the sampling probability of the sample according to the reconstruction error of the sample and calculates the confidence of the current weak classifier;

[0068] The integration module repeats the sampling step to the updating step until a number of weak classifiers and their corresponding confidences are obtained, and the abnormal traffic detection model is obtained by integration;

[0069] The detection module uses the abnormal traffic detection model to perform anomaly detection on unknown samples, obtains the anomaly detection results of multiple weak classifiers, and weights the anomaly detection results according to the confidence of the weak classification to obtain the final detection result.

[0070] The present invention has the following beneficial effects:

[0071] (1) The present invention applies the width learning autoencoder network to the single classification problem, solving the problems of slow training of deep networks and large memory consumption;

[0072] (2) The present invention adopts a single classification algorithm to train a weak classifier, solving the problem of sample imbalance in the traffic anomaly detection algorithm;

[0073] (3) The present invention proposes an integrated algorithm to optimize the model. During the integration process, a subset of samples with larger reconstruction errors can be adaptively selected for targeted learning, and the reliability of the samples can be adaptively evaluated. Finally, multiple models are integrated to improve the overall robustness and accuracy.

[0074] The present invention is further described in detail below in conjunction with the accompanying drawings and embodiments, but the present invention is not limited to the embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0075] Figure 1 A method step diagram of an embodiment of the present invention;

[0076] Figure 2 A schematic diagram of a width network according to an embodiment of the present invention;

[0077] Figure 3 4 is a system structure diagram of an embodiment of the present invention. DETAILED DESCRIPTION

[0078] The present invention provides an integrated single-classification abnormal traffic detection algorithm based on a wide network. First, a certain proportion of normal data is extracted according to the sampling probability and input into the wide autoencoder network. Then the wide network autoencoder is trained. Then the sampling probability of the sample and the confidence of the weak classifier are updated according to the reconstruction error of the sample. Then, according to the reconstruction error, a threshold is set to perform abnormal detection on unknown samples. Finally, the above steps are iterated cyclically to obtain the abnormal detection results of multiple weak classifiers, and the final detection result is obtained by weighting according to the confidence of the weak classification.

[0079] See also Figure 1 FIG. 1 is a diagram showing steps of a method according to an embodiment of the present invention, comprising the following steps:

[0080] S101, sampling step, extracting a certain proportion of normal data according to the sampling probability;

[0081] S102, a training step, using the normal data to train a wide autoencoder network as a weak classifier;

[0082] S103, an updating step, calculating the confidence of the current weak classifier according to the reconstruction error of the sample, and updating the sampling probability of the sample;

[0083] S104, integration step, repeating the sampling step to the updating step until a number of weak classifiers and their corresponding confidences are obtained, and an abnormal traffic detection model is obtained;

[0084] S105, a detection step, performs anomaly detection on unknown samples using an abnormal traffic detection model, obtains anomaly detection results of multiple weak classifiers, and weights the anomaly detection results according to the confidence of the weak classification to obtain the final detection result.

[0085] Specifically, in S101, for data containing only normal samples , according to the sampling probability of the sample A certain proportion of data is screened out and input into the width autoencoder network; where n represents the number of samples and d represents the sample dimension. represents the i-th sample, and k represents the k-th iteration. Set the initial value of the sample sampling probability to .

[0086] Specifically, the width autoencoder network is as follows Figure 2 As shown; S102 includes the following steps:

[0087] S1021, randomly initialize the weight matrix and bias vector of the feature layer and enhancement layer of the width autoencoder network; wherein, represents the randomly generated weight matrix in the mth group in the feature layer, represents the mth group of randomly generated bias vectors in the feature layer, represents the randomly generated weight matrix in the mth group in the enhancement layer, represents the mth group of randomly generated bias vectors in the enhancement layer;

[0088] S1022, calculate the output of each group of nodes in the feature layer, and then combine the output of each group of nodes to obtain the output of the feature layer, which is expressed as:

[0089] ;

[0090] ;

[0091] Among them, p represents the number of groups of feature layers, is the feature layer mapping function;

[0092] S1023, input the output of the feature layer to the enhancement layer to obtain the output of each group of nodes in the enhancement layer, and then combine each group of nodes to obtain the output of the feature layer , expressed as:

[0093] ;

[0094] ;

[0095] Where q represents the number of enhancement layers. is the enhancement layer mapping function;

[0096] S1024, concatenate the outputs of the enhancement layer and the feature layer according to the following formula to obtain the output of the hidden layer: . Where l represents the dimension of the hidden layer.

[0097] ;

[0098] S1025, train the network structure according to the loss function of the width learning autoencoder, the formula is as follows:

[0099] ;

[0100] in, represents the two-norm, Represents the output weights that need to be learned in the network structure, is the trade-off coefficient;

[0101] S1026, according to the ridge regression theory, the output weight can be quickly solved as follows:

[0102] when hour, ;

[0103] when hour, .

[0104] Specifically, the S103 includes the following steps:

[0105] S1031, design a single-class Boosting strategy to update the sampling probability of the sample and the confidence of the weak classifier. In the single-classification algorithm based on autoencoder, the reconstruction error The smaller it is, the better the model can learn the positive samples. characteristics. The calculation formula is as follows.

[0106] ;

[0107] Which represents the data after reconstruction The calculation formula is as follows.

[0108] ;

[0109] Therefore, when training multiple integrated single-class abnormal traffic detection algorithm models based on wide networks, the overall objective function is to minimize the sum of reconstruction errors, as shown below: is the total reconstruction error loss of the k-th width autoencoder model on all samples, is the weight of the k-th width autoencoder model, based on the entropy regularization term To avoid invalid solutions, is the weight parameter.

[0110] ;

[0111] ;

[0112] S1032, confidence of weak classifiers according to Lagrange multiplier method After training the kth weak classifier, the reliability of the weak classifier can be adaptively measured according to the reconstruction error, which decreases as the reconstruction error increases, and ∈[0,1].

[0113] ;

[0114] S1033, updates the sample sampling probability, conducts targeted learning on the decision boundary samples with higher uncertainty, and converts the loss function into an exponential upper bound according to Jensen inequality.

[0115] ;

[0116] ;

[0117] It can be found that represents the overall loss of the first (K-1) models, The larger the value, the better the previous model is. The worse the learning effect is, the more targeted learning is needed for this sample in the next round. Standardize as follows:

[0118] ;

[0119] S1034, reconstruction error Sort from large to small to get the final reconstruction error set ;

[0120] S1035, according to the reconstruction error set, set the judgment threshold. In order to improve the robustness of the classifier, it is assumed that not all training samples belong to the target category, so the threshold is not set to the maximum reconstruction error in the training set, but to set a certain ratio To calculate, and Threshold Calculated as follows. Represents the value of the kth element in a collection.

[0121] ;

[0122] S1036: Detect unknown samples according to the threshold. . The judgment is made according to the set threshold. The judgment formula is as follows, where 1 represents that the sample is a normal sample and 0 represents that the sample is an abnormal sample.

[0123] ;

[0124] Specifically, in S104, steps S101 to S103 are repeated several times to obtain several weak classifiers, which are integrated to obtain an abnormal traffic detection model. In the field of abnormal traffic detection, the preferred value of the number of weak classifiers is 10.

[0125] Specifically, in S105, the abnormal traffic detection model is used to detect unknown samples, and several detection results are obtained, and a weighted voting method is performed to obtain the final result. Taking the abnormal traffic detection model detection integrating two weak classifiers as an example, the detection result of the first weak classifier for the unknown sample is 1, indicating normal, and the weight is 0.8; the detection result of the second weak classifier is -1, and the weight is 0.2; then the final result is 1*0.8+-1*0.2=0.6, indicating that the unknown sample is a normal sample (greater than 0 is a normal sample, less than 0 is an abnormal sample).

[0126] See also Figure 3 FIG. 1 is a system structure diagram of an embodiment of the present invention, including:

[0127] Sampling module 301, extracting a certain proportion of normal data according to sampling probability;

[0128] A training module 302 uses the normal data to train a wide autoencoder network as a weak classifier;

[0129] An updating module 303 updates the sampling probability of the sample according to the reconstruction error of the sample and calculates the confidence of the current weak classifier;

[0130] Integration module 304, repeating the sampling step to the updating step until a number of weak classifiers and their corresponding confidences are obtained, and the abnormal traffic detection model is obtained by integration;

[0131] The detection module 305 performs anomaly detection on unknown samples using the abnormal traffic detection model to obtain anomaly detection results of multiple weak classifiers, and weights the anomaly detection results according to the confidence of the weak classification to obtain the final detection result.

[0132] Based on two intrusion detection datasets, NSL-KDD and UNSW-NB15, 12 datasets are constructed to verify the effectiveness of the embodiments of the present invention. Normal traffic data is set as the target class, and different types of traffic attack data are set as the abnormal class. The details are shown in Table 1.

[0133] Table 1 Dataset introduction:

[0134]

[0135] Taking accuracy as an indicator, the calculation formula is as follows:

[0136] ;

[0137] The symbol definitions are shown in the confusion matrix in Table 2.

[0138] Table 2 Confusion Matrix:

[0139]

[0140] The integrated single-classification abnormal traffic detection method based on the width network of the embodiment of the present invention is compared with a variety of cutting-edge single-classification algorithms, including algorithms based on ensemble learning (IForest, LSCP), algorithms based on deep learning (DeepAE, DeepSVDD), algorithms based on extreme learning machines (OC-ELM, ML-OCELM) and algorithms based on width learning (OC-BLS, ST-OCBLS). The comparison results are shown in Table 3.

[0141] Table 3 Comparative experiment:

[0142]

[0143] The specific parameters in the model are set as follows: Threshold It is set to 0.01 and the number of classifiers is set to 10.

[0144] The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. An integrated single-classification abnormal traffic detection method based on a wide network, characterized in that: The steps include: Sampling step, extracting a certain proportion of normal data according to the sampling probability; A training step, using the normal data to train a wide autoencoder network as a weak classifier; Update step, calculate the confidence of the current weak classifier according to the reconstruction error of the sample, and update the sampling probability of the sample; Integration step: repeat the sampling step to the updating step until several weak classifiers and their corresponding confidences are obtained, and the abnormal traffic detection model is obtained by integration; In the detection step, anomaly detection is performed on unknown samples using an abnormal traffic detection model to obtain anomaly detection results of multiple weak classifiers, and the anomaly detection results are weighted according to the confidence of the weak classification to obtain the final detection result; The training step comprises the following steps: Randomly initialize the width to learn the weight matrices and bias vectors of the feature layer and enhancement layer of the autoencoder; Calculate the output of each group of nodes in the feature layer, expressed as: Among them, p represents the number of groups in the feature layer, g f (.) is the feature layer mapping function; represents the randomly generated weight matrix in the mth group in the feature layer, Represents the mth group of randomly generated bias vectors in the feature layer; The output of each group of nodes is combined to obtain the output of the feature layer, which is expressed as: Z=[Z1,Z2,...,Z p ]; The output of the feature layer is input into the enhancement layer to obtain the output of each group of nodes in the enhancement layer, which is expressed as: Where q represents the number of enhancement layers, g e (.) is the enhancement layer mapping function; represents the randomly generated weight matrix in the mth group in the enhancement layer, represents the mth group of randomly generated bias vectors in the enhancement layer; The outputs of each group of nodes in the enhancement layer are combined to obtain the enhancement layer output H, which is expressed as: H=[H1,H2,...,H q ]; The outputs of the enhancement layer and the feature layer are concatenated to obtain the output A of the hidden layer, which is expressed as: Among them, l represents the dimension of the hidden layer; The network structure is trained according to the loss function of the width learning autoencoder, which is expressed as: in, represents the two-norm; W out represents the output weight that needs to be learned in the network structure, λ represents the trade-off coefficient, Represents the parameter W out Optimization; According to the ridge regression theory, the output weight is quickly solved and expressed as: When n ≥ l, W out =(λI + A T A) -1 A T X; When n<l, W out =A T (λI+AA T ) -1 X; Among them, I represents the unit matrix, and n represents the number of samples; The step of calculating the confidence of the current weak classifier according to the reconstruction error of the sample comprises the following steps: Calculate the reconstruction error of the sample, expressed as: x * i =A(x i )W out ; Among them, r i Represents the original data x of the i-th sample i The reconstruction error, x * i represents the data after the reconstruction of the i-th sample, A(x i ) represents the hidden layer output of the i-th sample after the width autoencoder network; represents the square of the two-norm; A single-class boosting strategy is designed to minimize the sum of reconstruction errors as the overall objective function, which is expressed as: Among them, min L EOC-BLSAE represents the overall objective function; R k is the total reconstruction error loss of the k-th width autoencoder network on all samples, K represents the total number of weak classifiers; w k ln k represents the entropy-based regularization term, which is used to avoid invalid solutions; α represents the weight parameter; St represents the constraint condition; The confidence of the weak classifier is calculated according to the Lagrange multiplier method, which is expressed as: Among them, w k represents the confidence of the kth weak classifier, and w k ∈[0,1].

2. The integrated single-classification abnormal traffic detection method based on wide network according to claim 1 is characterized in that: In the sampling step, for data X containing only normal samples, according to the sampling probability φ k (x i ) selects a certain proportion of data and inputs it into the width autoencoder network, where x i represents the i-th sample and k represents the k-th iteration.

3. The integrated single-classification abnormal traffic detection method based on wide network according to claim 1 is characterized in that: The updating of the sampling probability of the sample comprises the following steps: According to Jensen inequality, the overall objective function is transformed into an upper bound in exponential form, expressed as: Update the current sampling probability as the sampling probability of the next weak classifier, expressed as: φ k (x i )=φ k-1 (x i )exp(w k-1 r i k-1 ); Among them, φ k-1 (x i ) represents the sampling probability of the k-1th weak classifier, φ k (x i ) represents the sampling probability of the kth weak classifier; The updated sampling probability is normalized and expressed as:

4. The integrated single-classification abnormal traffic detection method based on wide network according to claim 3 is characterized in that: The initial value of the sample sampling probability φ k (x1) is set to n represents the number of samples.

5. The integrated single-classification abnormal traffic detection method based on wide network according to claim 1 is characterized in that: The detection step comprises the following steps: The reconstruction error r i Sort from large to small to get the final reconstruction error set R s ; According to the reconstruction error set R s Set the decision threshold θ, expressed as: in, is a preset ratio, and The abnormal traffic detection model detects unknown samples x according to the threshold t Perform detection and judgment, and the judgment formula is expressed as: Among them, y t Represents the label of the unknown sample, r t Represents the reconstruction error of the unknown sample after weak classification reconstruction. 1 represents a normal sample, and 0 represents an abnormal sample. For abnormal samples, the abnormal traffic detection model obtains several detection results y k , weighted voting method is used on the test results, and then the final result is obtained.

6. An integrated single-classification abnormal traffic detection system based on a wide network, characterized in that: include: The sampling module extracts a certain proportion of normal data according to the sampling probability; A training module, using the normal data to train a wide autoencoder network as a weak classifier; The update module updates the sampling probability of the sample according to the reconstruction error of the sample and calculates the confidence of the current weak classifier; The integration module repeats the sampling step to the updating step until a number of weak classifiers and their corresponding confidences are obtained, and the abnormal traffic detection model is obtained by integration; The detection module uses the abnormal traffic detection model to perform anomaly detection on unknown samples, obtains the anomaly detection results of multiple weak classifiers, and weights the anomaly detection results according to the confidence of the weak classification to obtain the final detection result; The internal processing of the training module includes the following steps: Randomly initialize the width to learn the weight matrices and bias vectors of the feature layer and enhancement layer of the autoencoder; Calculate the output of each group of nodes in the feature layer, expressed as: Among them, p represents the number of groups in the feature layer, g f (.) is the feature layer mapping function; represents the randomly generated weight matrix in the mth group in the feature layer, Represents the mth group of randomly generated bias vectors in the feature layer; The output of each group of nodes is combined to obtain the output of the feature layer, which is expressed as: Z=[Z1,Z2,...,Z p ]; The output of the feature layer is input into the enhancement layer to obtain the output of each group of nodes in the enhancement layer, which is expressed as: Where q represents the number of enhancement layers, g e (.) is the enhancement layer mapping function; represents the randomly generated weight matrix in the mth group in the enhancement layer, represents the mth group of randomly generated bias vectors in the enhancement layer; The output of each group of nodes in the enhancement layer is combined to obtain the output H of the enhancement layer, which is expressed as: H=[H1,H2,...,H q ]; The outputs of the enhancement layer and the feature layer are concatenated to obtain the output A of the hidden layer, which is expressed as: A=[Z1,...,Z p |H1,...,H q ]=[Z|H]∈R n×l ; Among them, l represents the dimension of the hidden layer; The network structure is trained according to the loss function of the width learning autoencoder, which is expressed as: in, represents the two-norm; W out represents the output weight that needs to be learned in the network structure, λ represents the trade-off coefficient, Represents the parameter W out Optimization; According to the ridge regression theory, the output weight is quickly solved and expressed as: When n ≥ l, W out = (λI + A T A) -1 A T X; When n<l, W out =A T (λI+AA T ) -1 X; Among them, I represents the unit matrix, and n represents the number of samples; The step of calculating the confidence of the current weak classifier according to the reconstruction error of the sample comprises the following steps: Calculate the reconstruction error of the sample, expressed as: x * i =A(x i )W out ; Among them, r i Represents the original data x of the i-th sample i The reconstruction error, x * i represents the data after the reconstruction of the i-th sample, A(x i ) represents the hidden layer output of the i-th sample after the width autoencoder network; represents the square of the two-norm; A single-class boosting strategy is designed to minimize the sum of reconstruction errors as the overall objective function, which is expressed as: Among them, min L EOC-BLSAE represents the overall objective function; R k is the total reconstruction error loss of the k-th width autoencoder network on all samples, K represents the total number of weak classifiers; w k ln k represents the entropy-based regularization term, which is used to avoid invalid solutions; α represents the weight parameter; St represents the constraint condition; The confidence of the weak classifier is calculated according to the Lagrange multiplier method, which is expressed as: Among them, w k represents the confidence of the kth weak classifier, and w k ∈[0,1].

Images