Network traffic feature selection method based on symmetric uncertainty

Abstract

The invention discloses a network traffic feature selection method based on symmetric uncertainty, which comprises the following steps: S1, preprocessing network traffic data in a CICIDS-2017 data set, and dividing the network traffic data into a training set and a test set; s2, performing feature selection on the training set by using SU to obtain a training data set S (F1, F2,..., FN, C) containing a plurality of features and class labels thereof, and forming a candidate feature set; s3, performing correlation evaluation on each pair of features in the candidate feature set to obtain an optimal feature set; s4, performing CNN training on the test set to obtain a pre-trained CNN model; and S5, verifying the optimal feature set through a pre-trained CNN model to obtain a classification result. According to the method, an intrusion detection system can better identify a complex network attack mode, and the overall detection performance is improved.

Description

Technical Field

[0001] The present invention relates to the technical field of Internet network security, and in particular to a network traffic feature selection method based on symmetric uncertainty. Background Art

[0002] With the rapid development of the Internet and the sharp increase in data volume, network security issues have received increasing attention. Various network attack methods have emerged in an endless stream, such as DDoS, intrusion attacks, Trojan programs and data theft, which have posed a serious threat to the security of information systems. Therefore, how to effectively detect and respond to network attacks has become a research hotspot in the current information security field.

[0003] In the study of network security, intrusion detection system has been widely used as an important defense method. Intrusion detection system can timely detect and warn potential attack behaviors by analyzing network traffic, system logs and other data.

[0004] In intrusion detection systems, feature processing is one of the key steps to ensure the efficiency and accuracy of the system. Network traffic data is usually massive and high-dimensional, and contains a lot of information that is irrelevant or redundant to the classification task. Therefore, reasonable feature processing can not only reduce the data dimension, but also improve the performance and operation efficiency of the detection system.

[0005] In the field of network intrusion detection, commonly used feature selection methods include techniques based on statistics and information theory. For example, information gain, mutual information, chi-square test and other techniques are used to evaluate the correlation between features and classification targets. These methods help screen out the most relevant features and reduce the number of features by quantifying the contribution of each feature to the target classification.

[0006] In addition, in recent years, feature selection methods based on machine learning, such as feature importance evaluation methods based on recursive feature elimination and random forest, have also been applied in network traffic data processing and intrusion detection. These methods can automatically evaluate the importance of features and dynamically select the optimal feature subset, thereby enhancing the robustness and applicability of the model.

[0007] The continuous development of feature processing technology enables intrusion detection systems to better cope with complex network environments and massive amounts of traffic data. Reasonable feature extraction and selection methods help improve the real-time performance and detection accuracy of the system, and promote the development of technology in the field of network security.

[0008] However, the above prior art all has the following defects:

[0009] 1) Information redundancy and correlation issues: Existing feature selection methods, such as those based on information gain (IG) or mutual information (MI), can effectively evaluate the correlation between features and target variables, but often lead to information redundancy issues. That is, multiple features may carry similar or repeated information, which reduces the generalization performance of the model and increases computational costs. In addition, these methods do not adequately handle the nonlinear relationship between features and target variables, and may ignore key features with complex interactions.

[0010] 2) Insufficient accuracy of feature selection: Current feature selection techniques have limited accuracy when facing high-dimensional and complex network traffic data. Since these methods often perform feature selection based on a single indicator and fail to fully consider the mutual influence between features, key features may be omitted or irrelevant features may be retained, thereby reducing the overall performance of intrusion detection. In addition, too many features will not only increase the complexity of the model, but also affect its real-time response capabilities. Summary of the invention

[0011] The purpose of the present invention is to provide a network traffic feature selection method based on symmetric uncertainty to address the above problems, optimize the problems of the above-mentioned prior art, aiming to reduce feature redundancy and improve the accuracy of feature selection under high-dimensional data, thereby improving the overall performance of the intrusion detection system.

[0012] In order to achieve the above object, the technical solution of the present invention is:

[0013] A network traffic feature selection method based on symmetric uncertainty, comprising:

[0014] S1. Preprocess the network traffic data in the CICIDS-2017 dataset and divide it into a training set and a test set;

[0015] S2, use SU to perform feature selection on the training set to obtain a training data set S (F 1 ,F 2 ,…,F N ,C), forming a candidate feature set;

[0016] S3, then evaluate the correlation of each pair of features in the candidate feature set to obtain the optimal feature set;

[0017] S4, perform CNN training on the test set to obtain a pre-trained CNN model;

[0018] S5. Verify the optimal feature set through the pre-trained CNN model to obtain the classification result.

[0019] As an improvement to the above technical solution, in step S2, SU is used to perform feature selection on the training set to select the feature most relevant to the classification label. The calculation formula of the SU value is as follows:

[0020]

[0021] Among them, IG(X,Y) is the information gain between feature X and target variable Y, H(X) and H(Y) are the entropies of X and Y respectively;

[0022] Information gain IG(X,Y) measures the contribution of feature X to reducing the uncertainty of target variable Y, which is defined as formula 2:

[0023] IG(X,Y)=H(Y)-H(Y|X) (2).

[0024] As an improvement to the above technical solution, the sub-steps of step S2 are:

[0025] S201, set a predefined threshold δ and an initialized empty feature list S' list ;

[0026] S202, for each feature F i , calculate the SU between the feature and the class label i,c ,if SUi,c＞δ , then the feature F i Add candidate feature subset S' list .

[0027] As an improvement to the above technical solution, the correlation threshold is 0<δ<1.

[0028] As an improvement to the above technical solution, the correlation threshold is 0.9.

[0029] As an improvement to the above technical solution, the sub-steps of step S3 are:

[0030] S301, according to the symmetric uncertainty value SU i,c For the candidate feature subset S' list Sort in descending order and get S' list The feature F in j ;

[0031] S302, traverse the candidate feature subset S' list Each feature F i , if F i ≠F j , calculate Fi With F j SU between i,j ; If SU i,j ≥SU i,c , then F i From S' list Removed;

[0032] S303, repeat step S302 until all features are processed, until S best =S' list .

[0033] As an improvement to the above technical solution, in step S4, CNN training is performed on the test set using the Adam optimizer, the Relu activation function, the cross entropy loss for gradient descent, the batch size is 128, the learning rate is set to 0.0001, and 50 epochs are trained.

[0034] As an improvement to the above technical solution, in step S5, S best Verification through the pre-trained CNN model refers to the S best Perform robustness evaluation using the accuracy ACC, recall and F1 values;

[0035] ACC is used to evaluate the classification ability of the model before and after mixed sampling, which is expressed as the following formula 3:

[0036]

[0037] Recall is used to measure the model's ability to identify positive samples and is expressed as the following formula 4:.

[0038]

[0039] The F1 value provides a more balanced evaluation metric when considering both the precision and recall of the model; it is expressed as the following formula 5:

[0040]

[0041] Compared with the prior art, the present invention has the following advantages and positive effects:

[0042] The network traffic feature selection method based on symmetric uncertainty of the present invention aims to reduce the redundant information between features. By adopting the SU method, the correlation between features and classification targets can be measured more accurately while considering the mutual correlation between features. This method effectively eliminates the problem of information duplication between different features, thereby retaining the features that contribute most to the classification results and improving the generalization ability of the model.

[0043] By using symmetric uncertainty, the present invention not only considers the direct correlation between each feature and the target variable, but also measures the complex interactive relationship between features. When processing high-dimensional and complex network traffic data, this method can effectively distinguish important features from irrelevant features and significantly improve the accuracy of feature selection. Through this improvement, the intrusion detection system can better identify complex network attack patterns and improve overall detection performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0045] Figure 1 It is the algorithm flow chart of the present invention;

[0046] Figure 2 This is a diagram of the CNN model architecture of the present invention;

[0047] Figure 3a This is a heat map of the correlation of feature information entropy after the present invention is sorted by SU correlation;

[0048] Figure 3b This is a correlation heat map after removing redundant features in the present invention;

[0049] Figure 4 This is a comparison chart of evaluation indicators of the original sample and feature selection sample of the present invention.

[0050] Figure 5 Comparison chart of the test results of the CNN model trained with the original sample and the optimal feature set. DETAILED DESCRIPTION

[0051] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work, any modifications, equivalent substitutions, improvements, etc., should be included in the protection scope of the present invention.

[0052] This embodiment discloses a network traffic feature selection method based on symmetric uncertainty, the process is as follows Figure 1 shown.

[0053] In order to improve the model training accuracy and reduce feature redundancy, SU is applied for feature selection to select the features most relevant to the classification labels to construct the optimal feature set for the next step of adversarial sample generation.

[0054] In high-dimensional datasets, there are a large number of features, many of which may be redundant or irrelevant to the target variable. This not only increases computational overhead, but may also lead to a decrease in the generalization ability of the model. Therefore, data dimensionality reduction and feature selection before model training are crucial steps. This paper invents a feature selection algorithm based on symmetric uncertainty to select network traffic data features. It can effectively identify and select features with high correlation with label information and low redundancy to select the most suitable features for model training, thereby ensuring that other features and data packet structures are not damaged.

[0055] SU is a normalized mutual information measure used to measure the correlation between two variables. The SU value ranges from 0 to 1, and the larger the value, the stronger the correlation. Specifically, the calculation formula of the SU value is as follows

[0056] Formula 1.

[0057]

[0058] Among them, IG(X,Y) is the information gain between feature X and target variable Y, H(X) and H(Y) are the entropies of X and Y respectively. Information gain IG(X,Y) measures the contribution of features to reducing the uncertainty of the target variable, which is defined as formula 2:

[0059] IG(X,Y)=H(Y)-H(Y|X) (2)

[0060] In the process of using the feature selection algorithm based on symmetric uncertainty, the SU value between each feature and the target variable is first calculated. Then, a correlation threshold δ is pre-set to select features with high correlation with the target variable. Only those features with SU values ​​greater than or equal to the threshold will be retained to form a candidate feature set.

[0061] To further reduce redundant features, the correlation of each pair of features in the candidate feature set is evaluated. If the SU value between a pair of features is greater than or equal to the SU value between other features and the target variable, the two features are considered redundant. In this case, the redundant features are removed to further streamline the feature set. The specific process is shown in Algorithm 1.

[0062] Algorithm 1: SU-based optimal feature selection

[0063]

[0064] Algorithm 1 is used to select a subset of features with higher correlation from a given feature set. The input of the algorithm includes a training dataset S (F 1 ,F 2 ,…,F N ,C) and a predefined threshold δ, the output is a selected feature subset S best .

[0065] First, for each feature F i , calculate the SU between the feature and the class label i,c If SU i,c If it is greater than the predefined threshold δ, then the feature F i Add candidate feature subset S' list Next, according to the symmetric uncertainty value SU i,c For the candidate feature subset S' list Sort in descending order and get S' list The feature F in j .

[0066] Then, traverse S' list Each feature F i , if F i With F j Different, calculate F i With F j SU between i,j If SU i,j Greater than or equal to SU i,c , then F i From S' list Remove. Continue to obtain S' list Next feature F i Repeat the above process until all features are processed and the final feature subset S is selected. best It is the filtered S' list .

[0067] Next, the features that are most suitable for intrusion detection system model fitting are selected through experiments to form the optimal feature set.

[0068] The algorithm evaluates the importance of features by calculating the symmetric uncertainty between features and class labels, and improves the efficiency of feature selection by removing redundant features, thereby reducing the number of features while ensuring classification performance.

[0069] 2 Experimental design

[0070] 2.1 Experimental Preparation

[0071] To evaluate the robustness of the model, the CICIDS-2017 dataset is used as the input data of the intrusion detection system. The test results of the model are expressed using accuracy (ACC), recall, and F1 score. ACC is used to evaluate the classification ability of the model before and after feature selection, which can be expressed as shown in the following formula 3.

[0072]

[0073] Recall is used to measure the model's ability to identify positive samples, as shown in Formula 4 below.

[0074]

[0075] F1 provides a more balanced evaluation metric when considering both the precision and recall of the model.

[0076] This is shown in Formula 5 below.

[0077]

[0078] The deep learning model used in the experiment is a convolutional neural network (CNN), and the model architecture is as follows: Figure 2 As shown in the figure, the model training uses the Adam optimizer, Relu activation function, cross entropy loss for gradient descent, batch size is 128, the learning rate is set to 0.0001, and training is performed for 50 epochs.

[0079] 2.2 Experimental Results and Analysis

[0080] The features in the CICID-S2017 dataset are evaluated and selected using a feature selection algorithm based on symmetric uncertainty. The algorithm ranks the features according to their correlation with the abnormal traffic labels and identifies the features that are most relevant to the labels.

[0081] Among them, the correlation heat map of the top 20 features most relevant to the label information is shown in Figure 3. Figure 3a This is the heat map of the information entropy correlation of features after sorting by SU correlation. It can be seen that some of the features are redundant data for model training due to their high similarity. The correlation threshold δ is set to 0.9, and only the first one of the similar features that exceeds the threshold is retained. Figure 3bThis is the correlation heat map after removing redundant features. It is obvious that similar features have been eliminated and the redundancy in the features has been significantly reduced. The features selected from large to small correlation are PSH flag count, Min Packet Length, BwdPacket Length Min, Destination Port, Bwd Packet Length Max, Bwd Packets / s, FwdIAT Std, Fwd Packet Length Min, URG Flag Count, Avg Fwd Segment Size, Subflow FwdBytes, Idle Min, Packet Length Variance, Init_Win_bytes_forward, Flow IAT Std, FwdPacket Length Std, ACK Flag Count, Fwd IAT Total, Active Mean, and Packet LengthMean.

[0082] After the sorting selection is completed, in order to evaluate the specific impact of different feature numbers on model performance, the features are gradually added in order of SU value from small to large for model training. The experiment starts with a single most relevant feature and gradually increases the number of features until the top 30 highly relevant and low redundant features are covered. After the 30 features are trained, the accuracy curve is as follows Figure 4 shown. Figure 4 It shows that when the model used and the mixed sampling are both CNN, only the training set and the test set are used to fully train the model. The features are arranged from large to small according to the SU correlation, so the first few features with the strongest correlation with the label bring the largest accuracy improvement to the model. As the number of features increases, the model performance is improved, but the improvement gradually decreases. When the number of features reaches a certain threshold, the increase in accuracy becomes negligible and tends to fit. It can be considered that the model has achieved fitting.

[0083] The test results of the CNN model trained with the original sample and the optimal feature set are as follows: Figure 5 When 19 features are used in the model, the accuracy is 95.12%. The accuracy of the CNN model tends to fit and reach the optimal value, which can be considered to capture the key features of abnormal network traffic. Compared with the method before feature selection, the accuracy of this method is improved by 3.96%, and the recall and F1 are increased by 24.40% and 26.06% respectively.

[0084] By using the Symmetric Uncertainty (SU) method, the present invention can more comprehensively measure the correlation between features and target classifications during feature screening, while considering the mutual correlation between features. This method effectively eliminates the problem of information redundancy and avoids the problem of multiple features carrying similar information. In this way, the model can not only simplify the data structure and reduce the computational cost, but also improve the generalization performance of the classifier, so that the system can perform intrusion detection more accurately and quickly in complex network traffic scenarios.

[0085] When processing high-dimensional network traffic data, the present invention can accurately evaluate the complex interactive relationship between each feature and the classification target through the symmetric uncertainty method, effectively improving the accuracy of feature selection. This improvement ensures that the intrusion detection system will not miss key features when facing complex data, significantly improving the detection performance. In addition, more representative features are selected to avoid interference from irrelevant features, thereby improving the overall reliability and accuracy of the detection system.

Claims

1. A network traffic feature selection method based on symmetric uncertainty, characterized by: The steps include: S1. Preprocess the network traffic data in the CICIDS-2017 dataset and divide it into a training set and a test set; S2, use SU to perform feature selection on the training set to obtain a training data set S (F1, F2, ..., F N ,C), forming a candidate feature set, C is the feature of the label column; S3, then evaluate the correlation of each pair of features in the candidate feature set to obtain the optimal feature set; S4, perform CNN training on the test set to obtain a pre-trained CNN model; S5. Verify the optimal feature set through the pre-trained CNN model to obtain the classification result.

2. The network traffic feature selection method based on symmetric uncertainty as claimed in claim 1, characterized in that: In the step S2, SU is used to perform feature selection on the training set to select the features most relevant to the classification label. The calculation formula of the SU value is as follows: Among them, IG(X,Y) is the information gain between feature X and target variable Y, H(X) and H(Y) are the entropies of X and Y respectively; Information gain IG(X,Y) measures the contribution of feature X to reducing the uncertainty of target variable Y, which is defined as formula 2: IG(X,Y)=H(Y)-H(Y|X) (2).

3. The network traffic feature selection method based on symmetric uncertainty as claimed in claim 2, characterized in that: The sub-steps of step S2 are: S201, set a predefined threshold δ and an initialized empty feature list S' list ; S202, for each feature F i , calculate the SU between the feature and the class label i,c , if SU i,c >δ, then the feature F i Add candidate feature subset S' list .

4. The network traffic feature selection method based on symmetric uncertainty as claimed in claim 3 is characterized by: The correlation threshold is 0<δ<1.

5. The method for selecting network traffic features based on symmetric uncertainty as claimed in claim 4, characterized in that: The correlation threshold δ=0.

9.

6. The method for selecting network traffic features based on symmetric uncertainty as claimed in claim 3, characterized in that: The sub-steps of step S3 are: S301, according to the symmetric uncertainty value SU i,c For the candidate feature subset S' list Sort in descending order and get S' list The feature F in j ; S302, traverse the candidate feature subset S' list Each feature F i , if F i ≠F j , calculate F i With F j SU between i,j ; If SU i,j ≥SU i,c , then F i From S' list Removed; S303, repeat step S302 until all features are processed, until S best =S' list .

7. The method for selecting network traffic features based on symmetric uncertainty as claimed in claim 6, characterized in that: In step S4, CNN training is performed on the test set using the Adam optimizer, the Relu activation function, the cross entropy loss for gradient descent, the batch size is 128, the learning rate is set to 0.0001, and training is performed for 50 epochs.

8. The method for selecting network traffic features based on symmetric uncertainty as claimed in claim 7, characterized in that: In step S5, S best Verification through the pre-trained CNN model refers to the S best Perform robustness evaluation using the accuracy ACC, recall and F1 values; ACC is used to evaluate the classification ability of the model before and after mixed sampling, which is expressed as the following formula 3: Recall is used to measure the model's ability to identify positive samples and is expressed as the following formula 4: The F1 value provides a more balanced evaluation metric when considering both the precision and recall of the model; it is expressed as the following formula 5:

Images