Network intrusion detection method and device, electronic equipment and storage medium

Abstract

The invention provides a network intrusion detection method and device, electronic equipment and a storage medium, and relates to the technical field of network security, and the method comprises the steps: obtaining to-be-detected target network access behavior data; encoding and decoding the target network access behavior data by using an eccentric model to obtain target decoded data; performing network intrusion detection on the target network access behavior data by using an LSTM model according to the target decoded data to obtain a target detection result; wherein the LSTM model and the eccentric model are obtained by joint training. In this way, the network attack is detected through cooperation of the eccentric model and the LSTM model, the problem of shallow learning limitation is effectively solved, and the detection result is more accurate.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network intrusion detection method, device, electronic equipment and storage medium. Background Art

[0002] With the continuous development of artificial intelligence technology, deep learning methods have gradually become one of the research hotspots in the field of network security. Among them, Long Short Term Memory (LSTM), as a special recurrent neural network (RNN), has been widely used in many fields because of its ability to process long-term dependencies in sequence data. In the field of network security, especially in network attack detection, LSTM is widely used because of its advantages in processing time series data. By analyzing network traffic data, LSTM can identify abnormal behavior patterns, thereby helping to detect potential network attack incidents.

[0003] Specifically, LSTM controls the flow of information through its unique gating mechanism, allowing the model to remember past data and use this information when appropriate. This feature makes it very suitable for handling network attack detection tasks, because many network attack behaviors have certain sequential and time correlations. For example, by analyzing network traffic data over a period of time, LSTM can identify specific patterns or sequences that attackers may use, thereby providing early warning of potential security threats.

[0004] However, in practical applications, LSTM also shows certain limitations. On the one hand, when encountering new types of attacks, LSTM may not be able to accurately identify these unknown types of attacks due to the lack of samples corresponding to the new types of attacks in the training data set. On the other hand, for those attack behaviors that have changed in surface features but remain unchanged in deep features, LSTM may also have difficulty distinguishing normal network activities from malicious attack behaviors. Summary of the invention

[0005] The object of the present invention is to provide a network intrusion detection method, device, electronic device and storage medium to improve the accuracy of detection results.

[0006] In a first aspect, the present invention provides a network intrusion detection method, comprising: Obtain the target network access behavior data to be detected; The target network access behavior data is encoded and decoded using the eccentric model to obtain the target decoded data; According to the decoded data of the target, the LSTM model is used to perform network intrusion detection on the target network access behavior data to obtain the target detection result; among them, the LSTM model and the eccentricity model are obtained by joint training.

[0007] In an optional implementation manner, after obtaining the target network access behavior data to be detected, the method further includes: The target network access behavior data is vectorized to obtain the original target vector.

[0008] In an optional implementation, the target network access behavior data is encoded and decoded using an eccentric model to obtain target decoded data, including: The original target vector obtained by vectorizing the target network access behavior data is input into the eccentric model, and the decoded target vector output by the eccentric model is determined as the target decoded data; wherein the decoded target vector is obtained by encoding and decoding the original target vector by the eccentric model.

[0009] In an optional implementation, based on the decoded data of the target, the LSTM model is used to perform network intrusion detection on the target network access behavior data to obtain the target detection result, including: Combining the target decoded data and the target network access behavior data to obtain target combined sequence data; The target combination sequence data is input into the LSTM model to obtain the target detection result output by the LSTM model.

[0010] In an optional embodiment, the above method further includes: Obtain multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; Encode and decode each sample network access behavior data using the current eccentricity model to be trained to obtain sample decoded data; According to the decoded data of each sample, the current LSTM model to be trained is used to perform network intrusion detection on the corresponding sample network access behavior data to obtain the sample detection results; According to each sample detection result and the label of the corresponding sample network access behavior data, the parameters of the current eccentricity model and the current LSTM model are updated at the same time to obtain the trained eccentricity model and LSTM model.

[0011] In an optional implementation, after obtaining a plurality of sample network access behavior data and their labels, the method further includes: Each sample network access behavior data is vectorized to obtain the original sample vector.

[0012] In a second aspect, the present invention provides a network intrusion detection device, comprising: An acquisition module is used to acquire target network access behavior data to be detected; The encoding and decoding module is used to encode and decode the target network access behavior data using the eccentric model to obtain the target decoded data; The detection module is used to perform network intrusion detection on the target network access behavior data using the LSTM model according to the target decoded data to obtain the target detection result; wherein the LSTM model and the eccentricity model are obtained by joint training.

[0013] In an optional embodiment, the above device further includes a training module, which is used to: Obtain multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; Encode and decode each sample network access behavior data using the current eccentricity model to be trained to obtain sample decoded data; According to the decoded data of each sample, the current LSTM model to be trained is used to perform network intrusion detection on the corresponding sample network access behavior data to obtain the sample detection results; According to each sample detection result and the label of the corresponding sample network access behavior data, the parameters of the current eccentricity model and the current LSTM model are updated at the same time to obtain the trained eccentricity model and LSTM model.

[0014] In a third aspect, the present invention provides an electronic device including a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the computer program, the network intrusion detection method of any one of the aforementioned implementation modes is implemented.

[0015] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the network intrusion detection method of any one of the aforementioned implementation modes is executed.

[0016] The network intrusion detection method, device, electronic device and storage medium provided by the present invention can obtain the target network access behavior data to be detected; use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data; according to the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; wherein the LSTM model and the eccentric model are obtained by joint training. In this way, the eccentric model is used in conjunction with the LSTM model to detect network attacks, which effectively solves the problem of shallow learning limitations and makes the detection results more accurate. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0018] Figure 1 A schematic diagram of a flow chart of a network intrusion detection method provided by an embodiment of the present invention; Figure 2 A data flow diagram of a network intrusion detection method provided by an embodiment of the present invention; Figure 3 A schematic diagram of the training process of an LSTM model and an eccentricity model provided in an embodiment of the present invention; Figure 4 A schematic diagram of a flow chart of another network intrusion detection method provided by an embodiment of the present invention; Figure 5 A schematic diagram of the structure of a network intrusion detection device provided by an embodiment of the present invention; Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0019] The technical solution of the present invention will be clearly and completely described below in conjunction with the embodiments. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0020] Using LSTM (Long Short Term Memory) to detect network attacks is one of the commonly used methods at present, but LSTM has certain limitations. For example, when facing new attacks, it cannot be identified because the features of new attacks do not exist in the training data; when facing attacks with shallow features changing but the underlying features unchanged, it cannot be identified. Based on this, a network intrusion detection method, device, electronic device and storage medium provided by an embodiment of the present invention combine the classic LSTM neural network with an eccentric model to detect network intrusions, which can improve the accuracy of the detection results.

[0021] To facilitate understanding of this embodiment, a network intrusion detection method disclosed in an embodiment of the present invention is first introduced in detail.

[0022] The embodiment of the present invention provides a network intrusion detection method, which can be executed by an electronic device with data processing capability. Figure 1 The flowchart of a network intrusion detection method shown in FIG. 1 mainly includes the following steps S110 to S130: Step S110, obtaining target network access behavior data to be detected.

[0023] Here, the network access behavior data required for network intrusion detection is used as the target network access behavior data to be detected. Network access behavior data can include a variety of information, such as user identification information, timestamp, access URL (Uniform Resource Locator), HTTP (Hyper Text Transfer Protocol) method, browser and operating system information, geographic location information, and download / upload file information.

[0024] Among them, user identification information may include IP address, device ID, cookie ID, etc., which are used to identify specific users or devices. Timestamp is the time point when each network request occurs, which helps to track the time and frequency of user activities. The visited URL is the specific address of the web page browsed by the user, which may include the protocol (such as HTTP / HTTPS), domain name, path and query parameters. The HTTP method may be a request method such as GET or POST, indicating whether the user is obtaining resources or submitting data. Browser and operating system information may be information contained in the User-Agent string, such as browser type, version number, operating system platform, etc., which can be used to understand the user's technical environment. Geographic location information may be the user's location inferred based on the IP address or other positioning technologies. Download / upload file information may include details such as file transfer size and format, which can be used to monitor bandwidth usage or potential security risks.

[0025] Step S120, encoding and decoding the target network access behavior data using the eccentric model to obtain target decoded data.

[0026] The above-mentioned eccentric model can be a traditional deep neural network (DNN) network. The role of the eccentric model is to encode and then decode the network access behavior data to better extract deep-level features. The DNN network of the eccentric model can adopt an asymmetric encoding-decoding structure.

[0027] In order to facilitate the calculation of the eccentricity model and the LSTM model, after obtaining the target network access behavior data to be detected, the above method also includes: vectorizing the target network access behavior data to obtain an original target vector.

[0028] It should be noted that the embodiments of the present invention do not limit the specific vectorization processing method. For example, the above-mentioned vectorization processing method can adopt One-hot encoding or Bag of Words (BoW, i.e., bag of words model), etc. One-hot vectors can be obtained through One-hot encoding, and word-bag vectors can be obtained through the bag of words model.

[0029] In some possible embodiments, the above step S120 may include: inputting the original target vector obtained by vectorizing the target network access behavior data into the eccentric model, and determining the decoded target vector output by the eccentric model as the target decoded data; wherein the decoded target vector is obtained by encoding and decoding the original target vector by the eccentric model.

[0030] Step S130, based on the decoded data of the target, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain a target detection result; wherein the LSTM model and the eccentricity model are obtained by joint training.

[0031] When performing network intrusion detection, the above LSTM model not only uses the target network access behavior data, but also combines the target decoded data, which can effectively solve the problem of shallow learning limitations. It should be noted that for the network structure of the LSTM model and the eccentric model, its size and number of parameters can be set according to the amount of data in the training data set.

[0032] In some possible embodiments, the above step S130 may include: combining the target decoded data and the target network access behavior data to obtain target combined sequence data; inputting the target combined sequence data into the LSTM model to obtain the target detection result output by the LSTM model.

[0033] Optionally, the above-mentioned target decoded data may be a decoded target vector, and the target combination sequence data is in vector form. The decoded target vector may be combined with an original target vector corresponding to the target network access behavior data to obtain a target combination sequence vector.

[0034] It should be noted that the combination of the above-mentioned target decoded data and target network access behavior data can be set according to actual needs and is not limited here. For example, the original target vector is V and the decoded target vector is Dv, then the target combination sequence vector can be [V, Dv] or [Dv, V], etc.

[0035] The network intrusion detection method provided by the embodiment of the present invention can obtain the target network access behavior data to be detected; use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data; according to the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; wherein the LSTM model and the eccentric model are obtained by joint training. In this way, the eccentric model is used in conjunction with the LSTM model to detect network attacks, which effectively solves the problem of shallow learning limitations and makes the detection results more accurate.

[0036] The embodiment of the present invention also provides a joint training method for the above-mentioned eccentric model and LSTM model, including: obtaining multiple sample network access behavior data and their labels, the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; using the current eccentric model to be trained to encode and decode each sample network access behavior data to obtain sample decoded data; according to each sample decoded data, using the current LSTM model to be trained to perform network intrusion detection on the corresponding sample network access behavior data to obtain sample detection results; according to each sample detection result and the label of the corresponding sample network access behavior data, simultaneously updating the parameters of the current eccentric model and the current LSTM model to obtain the trained eccentric model and LSTM model.

[0037] Optionally, multiple pieces of the above-mentioned sample network access behavior data can be selected from a pre-constructed training data set to train the eccentric model and the LSTM model; the label of the sample network access behavior data can be 0 or 1, 0 indicates that the corresponding network access behavior is not a network intrusion behavior, and 1 indicates that the corresponding network access behavior is a network intrusion behavior.

[0038] Optionally, after obtaining multiple sample network access behavior data and their labels, the above method also includes: vectorizing each sample network access behavior data to obtain an original sample vector. Based on this, the original sample vector can be input into the current eccentricity model to obtain a decoded sample vector output by the current eccentricity model, that is, the sample decoded data; after the decoded sample vector is combined with the original sample vector, a sample combination sequence vector is obtained, and the sample combination sequence vector is input into the current LSTM model, and the current LSTM model outputs a sample detection result; according to the sample detection result and the label, the model loss value is calculated, and the current eccentricity model and the current LSTM model are simultaneously reversely updated according to the model loss value.

[0039] It should be noted that, for the steps not described in detail during the training process, reference can be made to the corresponding contents in the aforementioned network intrusion detection method, and they will not be repeated here.

[0040] For ease of understanding, the above network intrusion detection method is further introduced below.

[0041] The embodiment of the present invention proposes a network intrusion detection method that uses an eccentric model in conjunction with an LSTM model to detect network attacks, which can effectively solve the problem of shallow learning limitations and make the detection results more accurate.

[0042] The network intrusion detection method provided by the embodiment of the present invention is mainly divided into two parts: first, when training the LSTM model for network attack detection, the intervention of the eccentric model is added to enable the LSTM model to adapt to the existence of the eccentric model; second, when using the LSTM model for network attack detection, the eccentric model is added to improve the accuracy of the detection results.

[0043] See also Figure 2 In the data flow diagram of a network intrusion detection method shown in the figure, the network access behavior is first vectorized, and the vector of the network access behavior is directly given to the eccentric model and the LSTM model; the eccentric model encodes and then decodes the vector of the network access behavior, and the vector encoded and decoded by the eccentric model is given to the LSTM model; the LSTM model processes the vector of the network access behavior and the decoded vector, and gives a detection result of whether the behavior is a network intrusion behavior.

[0044] See also Figure 3 The diagram of the training process of an LSTM model and an eccentric model is shown. The process of training the LSTM model and the eccentric model is as follows: first, a training data set is obtained, which includes multiple network access behavior data and their labels; then, multiple data in the training data set are vectorized and output to the eccentric model and the LSTM model; the vectors encoded and decoded by the eccentric model are output to the LSTM model; the LSTM model outputs the prediction result (i.e., the sample detection result); the loss is calculated for the prediction result and the true result (i.e., the label), and the model parameters of the eccentric model and the LSTM model are reversely updated at the same time, and finally the training is completed when the iteration stop condition is met. Among them, the iteration stop condition can be set according to actual needs, such as the number of iterations reaching a preset number threshold, or the eccentric model and the LSTM model are converged, etc.

[0045] An exemplary training process is as follows: 1. Take n data from the training data set (n can be any integer greater than 0, such as 2, 4, 8, etc.); 2. Perform vectorization on each of the n pieces of data. You can use any method to vectorize, such as one-hot vector or word-bag vector, which is not required here. 3. Let the vector of the above data be V; Submit V to the eccentric model D for encoding and decoding to obtain Dv; V and Dv are combined into the sequence data [V,Dv]; Take [V,Dv] as input data and pass it to the LSTM model for calculation; 4. Calculate the loss based on the predicted results and actual results output by the LSTM model, and update the model parameters of the LSTM model and the eccentricity model based on the loss.

[0046] For the application of the above LSTM model + eccentricity model, see Figure 4 FIG. 1 is a flow chart of another network intrusion detection method shown in FIG. 1 . In this embodiment, the method for using the combination of the LSTM model and the eccentric model is as follows: 1. Perform data vectorization on the access behavior to be detected to obtain V; 2. Encode and decode V using the eccentric model to obtain Dv; 3. Combine Dv and V into a sequence vector [V,Dv]; 4. Submit [V, Dv] to LSTM to detect whether it is a network intrusion, give a judgment on whether it is a network intrusion, and complete the detection.

[0047] Corresponding to the above-mentioned network intrusion detection method, the embodiment of the present invention also provides a network intrusion detection device. Figure 5 A schematic diagram of the structure of a network intrusion detection device is shown, the device comprising: The acquisition module 501 is used to acquire the target network access behavior data to be detected; The encoding and decoding module 502 is used to encode and decode the target network access behavior data using the eccentric model to obtain the target decoded data; The detection module 503 is used to perform network intrusion detection on the target network access behavior data using the LSTM model according to the target decoded data to obtain the target detection result; wherein the LSTM model and the eccentricity model are obtained by joint training.

[0048] The network intrusion detection device provided by the embodiment of the present invention can obtain the target network access behavior data to be detected; use the eccentric model to encode and decode the target network access behavior data to obtain the target decoded data; according to the target decoded data, use the LSTM model to perform network intrusion detection on the target network access behavior data to obtain the target detection result; wherein the LSTM model and the eccentric model are obtained by joint training. In this way, the eccentric model is used in conjunction with the LSTM model to detect network attacks, which effectively solves the problem of shallow learning limitations and makes the detection results more accurate.

[0049] Furthermore, the above-mentioned device also includes a vectorization module, which is used to perform vectorization processing on the target network access behavior data to obtain an original target vector.

[0050] Furthermore, the above-mentioned encoding and decoding module 502 is specifically used to: input the original target vector obtained by vectorizing the target network access behavior data into the eccentric model, and determine the decoded target vector output by the eccentric model as the target decoded data; wherein, the decoded target vector is obtained by encoding and decoding the original target vector by the eccentric model.

[0051] Furthermore, the detection module 503 is specifically used to: combine the target decoded data and the target network access behavior data to obtain target combination sequence data; input the target combination sequence data into the LSTM model to obtain the target detection result output by the LSTM model.

[0052] Furthermore, the above device also includes a training module, which is used to: Obtain multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; Encode and decode each sample network access behavior data using the current eccentricity model to be trained to obtain sample decoded data; According to the decoded data of each sample, the current LSTM model to be trained is used to perform network intrusion detection on the corresponding sample network access behavior data to obtain the sample detection results; According to each sample detection result and the label of the corresponding sample network access behavior data, the parameters of the current eccentricity model and the current LSTM model are updated at the same time to obtain the trained eccentricity model and LSTM model.

[0053] Furthermore, the above training module is also used to: perform vectorization processing on each sample network access behavior data to obtain an original sample vector.

[0054] The network intrusion detection device provided in this embodiment has the same implementation principle and technical effects as those of the aforementioned network intrusion detection method embodiment. For the sake of brief description, for matters not mentioned in the network intrusion detection device embodiment, reference may be made to the corresponding contents in the aforementioned network intrusion detection method embodiment.

[0055] like Figure 6 As shown, an electronic device 600 provided by an embodiment of the present invention includes: a processor 601, a memory 602 and a bus, the memory 602 stores a computer program that can be run on the processor 601, when the electronic device 600 is running, the processor 601 and the memory 602 communicate through the bus, and the processor 601 executes the computer program to implement the above-mentioned network intrusion detection method.

[0056] Specifically, the memory 602 and the processor 601 can be general-purpose memories and processors, which are not specifically limited here.

[0057] The embodiment of the present invention also provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is run by a processor, the network intrusion detection method described in the above method embodiment is executed. The computer-readable storage medium includes: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a RAM, a magnetic disk or an optical disk, and other media that can store program codes.

[0058] The term "and / or" herein is only a description of the association relationship of the associated objects, indicating that there may be three relationships. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone. In addition, the term "at least one" herein represents any combination of at least two of any one or more of a plurality of. For example, including at least one of A, B, and C can represent including any one or more elements selected from the set consisting of A, B, and C.

[0059] In all examples shown and described herein, any specific values ​​should be interpreted as merely exemplary and not as limiting, and thus other examples of the exemplary embodiments may have different values.

[0060] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present invention. In this regard, each box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, a program segment or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or action, or can be implemented with a combination of dedicated hardware and computer instructions.

[0061] In the several embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely schematic. For example, the division of the modules is only a logical function division. There may be other division methods in actual implementation. For example, multiple modules or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, and the indirect coupling or communication connection of devices or modules can be electrical, mechanical or other forms.

[0062] The modules described as separate components may or may not be physically separated, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed on multiple network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0063] In addition, each functional module in each embodiment of the present invention may be integrated into one processing module, or each module may exist physically separately, or two or more modules may be integrated into one module.

[0064] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network intrusion detection method, characterized in that: include: Obtain the target network access behavior data to be detected; Encoding and decoding the target network access behavior data using an eccentric model to obtain target decoded data; According to the decoded data of the target, the LSTM model is used to perform network intrusion detection on the target network access behavior data to obtain a target detection result; wherein the LSTM model and the eccentricity model are obtained by joint training.

2. The method according to claim 1, characterized in that After obtaining the target network access behavior data to be detected, the method further includes: Vectorization is performed on the target network access behavior data to obtain an original target vector.

3. The method according to claim 1, characterized in that The method of encoding and decoding the target network access behavior data using the eccentric model to obtain target decoded data includes: The original target vector obtained by vectorizing the target network access behavior data is input into the eccentric model, and the decoded target vector output by the eccentric model is determined as the target decoded data; wherein the decoded target vector is obtained by encoding and decoding the original target vector by the eccentric model.

4. The method according to claim 1, characterized in that: The method of performing network intrusion detection on the target network access behavior data using the LSTM model according to the target decoded data to obtain a target detection result includes: Combining the target decoded data and the target network access behavior data to obtain target combined sequence data; The target combination sequence data is input into the LSTM model to obtain the target detection result output by the LSTM model.

5. The method according to claim 1, characterized in that The method further comprises: Acquire multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; Using the current eccentricity model to be trained, encoding and decoding each piece of the sample network access behavior data to obtain sample decoded data; According to each piece of decoded sample data, the current LSTM model to be trained is used to perform network intrusion detection on the corresponding sample network access behavior data to obtain a sample detection result; According to each of the sample detection results and the label of the corresponding sample network access behavior data, the parameters of the current eccentricity model and the current LSTM model are updated simultaneously to obtain the trained eccentricity model and the LSTM model.

6. The method according to claim 5, characterized in that After obtaining a plurality of sample network access behavior data and their labels, the method further includes: Each piece of the sample network access behavior data is vectorized to obtain an original sample vector.

7. A network intrusion detection device, characterized in that: include: An acquisition module is used to acquire target network access behavior data to be detected; A coding and decoding module, used for encoding and decoding the target network access behavior data using an eccentric model to obtain target decoded data; The detection module is used to perform network intrusion detection on the target network access behavior data using the LSTM model according to the decoded data of the target, so as to obtain the target detection result; wherein the LSTM model and the eccentricity model are obtained by joint training.

8. The device according to claim 7, characterized in that The device also includes a training module for: Acquire multiple pieces of sample network access behavior data and their labels, where the labels are used to identify whether the corresponding network access behavior is a network intrusion behavior; Using the current eccentricity model to be trained, encoding and decoding each piece of the sample network access behavior data to obtain sample decoded data; According to each piece of decoded sample data, the current LSTM model to be trained is used to perform network intrusion detection on the corresponding sample network access behavior data to obtain a sample detection result; According to each of the sample detection results and the label of the corresponding sample network access behavior data, the parameters of the current eccentricity model and the current LSTM model are updated simultaneously to obtain the trained eccentricity model and the LSTM model.

9. An electronic device comprising a memory and a processor, wherein the memory stores a computer program that can be run on the processor, characterized in that: When the processor executes the computer program, the network intrusion detection method according to any one of claims 1 to 6 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the network intrusion detection method according to any one of claims 1 to 6 is executed.

Images